Virus.DOS.Lokjaw.Scramble is a memory resident parasitic encrypted DOS virus.

There are 3 variants:

  • Virus.DOS.Lokjaw.Scramble.1253
  • Virus.DOS.Lokjaw.Scramble.1254
  • Virus.DOS.Lokjaw.Scramble.1256


When the virus is loaded into memory, it hooks INT 21h to infect any DOS executable file that is run. When the user issues a DIR directory listing command, the virus would infect all the DOS executable files from the list, thus to slow down the response the file listing command (unless there are no files to infect).

The virus behaves stealthy so there will have no observable file size change when it is in memory.

If COMMAND.COM has been infected by the virus, the system will fail to recognize it on next start.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Lokjaw.Scramble.1253 4,096
Lokjaw.Scramble.1254 4,096
Lokjaw.Scramble.1256 4,096

MD5 hashes:

Variant Hash
Lokjaw.Scramble.1253 da083f9c120c73669d46d30c1086ed1c
Lokjaw.Scramble.1254 4659a66c3ed94f31a21f827cacf4ddb5
Lokjaw.Scramble.1256 325e67fd34de01f04486029050651214


When the user attempts to run MSAV or MWAV, the virus terminates it and display the message:

Bad Command or file name

Which is similar to that in Jerusalem, but the virus does not delete the programs.

Other details

Lokjaw.Pfeiffer.1203 has the same file infection behavior and it has been identified as Lokjaw.Scramble.1203 by some antiviruses, consuming 4K in memory.

The virus contains the internal text strings:

BEER and TEQUILA forever !
[Scramble] By Nikedemus
Read CRYPT Today!

See also

Community content is available under CC-BY-SA unless otherwise noted.