Lavot Virus

Virus Name: Lavot Aliases: WET V Status: New Discovered: July, 1998 Symptoms: Diskette Boot Sectors & MBR altered; decrease in total system & available free memory Origin: Netherlands Eff Length: N/A Type Code: BRtX - Resident Diskette Boot Sector & MBR Infector Detection Method: ViruScan Removal Instructions: ViruScan /clean following cold clean system boot General Comments: The Lavot virus was received in July, 1998. It is reported to be "in the wild" in the Netherlands. Lavot is a memory resident stealth infector of diskette boot sectors and the system hard disk master boot record. The first time a system is booted from a Lavot infected diskette, the Lavot virus will infect the system hard disk master boot record and become memory resident. Total system and available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 2,048 bytes. Interrupt 12's return will have been moved. Once the Lavot virus is memory resident, it will infect diskette boot sectors when non-write protected diskettes are accessed on the system, though it does not infect 360KB diskettes. When the Lavot virus is memory resident, anti-viral programs cannot detect its presence on disk. If an anti-viral program detects its presence in memory, the system should be rebooted from a known uninfected diskette and then rechecked for the virus on disk.