Threat Description



Aliases: WET, Lavot, W.E.T.
Category: Malware
Type: Virus
Platform: W32


This boot sector virus is known to be in the wild in the Netherlands.

WET is only able to infect a hard disk when you try to boot the machine from an infected diskette. At this time WET infects the DOS boot sector on hard drive, and after that it will go Resident, to high DOS memory during every boot-up from the hard disk. When WET infects floppies, it does not save the original boot sector anywhere.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.


Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Technical Details

Most other boot sector viruses infect the MBR on hard drives, not the DOS boot sector.

Once WET gets resident to memory, it will infect practicly all non-writeprotected diskettes used in the machine. WET uses stealth mechanisms to conceal it's presence.

The following text string can be seen in infected boot sectors:

(c) 1990 W.E.T.  

The virus is suspected to have been written signifantly later than the copyright statement implies.

WET also ovewrites the file system type in the boot sector with its own code. The side effect from this is that the DOS sys command can NOT be used to overwrite the boot sector on the hard drive - it will just produce an error.

WET is difficult to remove unless you have a program capable of disinfecting it. Contact F-Secure anti-virus support for more info.

Description Details: Mikko Hypponen, F-Secure


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More