Sophos

W32/Shoerec

Aliases
  • Win32/Shoerec
  • PE_SHOEREC.A.
Category
Type
What to do
Prevalence low high

Summary

 
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

This virus has been posted on a number of usenet newsgroups as infected Macromedia Shockwave animation files named BOXING.EXE, FUN.EXE and NOSTRESS.EXE.

If the file runs, it displays a picture of a boxer that can be hit by a punch chosen from a displayed toolbar.

Picture of a boxer.

The virus runs before this animation.

The virus chooses a random letter and then searches through the directory tree. It compares the first character of all files with the one previously chosen.

If the characters are the same, the virus infects the file.

If the current date is different from the date of the file infection, the virus launches the payload.

The payload randomly changes the icon arrangement on the desktop so it appears that icons are running away from the mouse pointer. The virus may mutate so that it is not further infectable, but still deletes a number of randomly chosen files, depending on the date.

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer