Type File virus
Date Discovered 2000.03.21
Place of Origin
Source Language
Platform MS Windows
File type(s) .exe
Infection Length
Reported Costs

Shoerec is a virus with a payload similar to that of Magistr. Another part of its payload pays tribute to the Brain virus.


2,000 Subscribers - Shoerec Windows Virus05:04

2,000 Subscribers - Shoerec Windows Virus

Shoerec in action

When executed, Shoerec generates a random letter and searches for all files in the current directory with that name three times. It infects Portable executables, hiding as a process thread and then appending itself to the file.

Four months after the initial infection, the virus activates a payload similar to that of Magistr. It causes icons to move away from the cursor as if trying to run away from it.

There is another payload that activates on the 1st, 2nd or 3rd of any month. It infects files on these days with a trojan routine. Seven months after infecting the files, the routine will erase all files on the current drive. It also creates and overwrites the WIN.COM with either random junk or the following text (paying homage to Brain):

  (c) 1999 Brain & Amjads (pvt) Ltd   
  Dedicated to the dynamic memories of millions of virus 
  who are no longer with us today - Thanks


Shoerec was originally posted to newsgroups as the files FUN.EXE, BOXING.EXE or NOSTRESS.EXE. Its icon made it look like a Shockwave file. When executed, it would execute a shockwave flash game the user could carry out certain boxing moves on a boxer.


Kaspersky Lab. SecureList, Virus.Win9x.Shoerec. 2001.01.14

Proland, Shoerec virus

Ad blocker interference detected!

Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.