Threat description




Delwin was found from Denmark in Spring 1995. It infects the MBR of the hard drive as well as all accessed EXE files. Delwin is a fast infector.

Delwin is also a full stealth virus, hiding all the changes to boot sectors and EXE files as long as it is resident.

The virus is encrypted and contains the text "DELWIN". Delwin activates when WIN.COM is executed. After this, it will modify the 'check-dos-version' service to always report v2.10. This will prevent many programs from being executed. Otherwise the virus is harmless.

Delwin.1759 got widespread circulation in May 1996 when an infected copy of the full version of 'Duke Nukem 3D' game was distributed via pirate systems.

There is also another variant, 1199 bytes in length.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info