FANDOM


Virus.DOS.Lokjaw.Scramble is a memory resident parasitic encrypted DOS virus.

There are 3 variants:

  • Virus.DOS.Lokjaw.Scramble.1253
  • Virus.DOS.Lokjaw.Scramble.1254
  • Virus.DOS.Lokjaw.Scramble.1256

Behavior

When the virus is loaded into memory, it hooks INT 21h to infect any DOS executable that is run. When the user issues a DIR directory listing command, the virus would infect all DOS executable from the list, thus to slow down the response the file listing command (unless there are no files to infect).

The virus behaves stealthy so there will have no observable file size change when it is in memory.

If COMMAND.COM has been infected by the virus, the system will fail to recognize it on next start.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Lokjaw.Scramble.1253 4,096
Lokjaw.Scramble.1254 4,096
Lokjaw.Scramble.1256 4,096

Payload

When the user attempts to run MSAV or MWAV, the virus terminates it and display the message:

Bad Command or file name

Which is similar to that in Jerusalem, but the virus does not delete the programs.

Other details

Lokjaw.Pfeiffer.1203 has the same file infection behavior and it has been identified as Lokjaw.Scramble.1203 by some antiviruses, consuming 4K in memory.

The virus contains the internal text strings:

BEER and TEQUILA forever !
[Scramble] By Nikedemus
Read CRYPT Today!

See also

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.