Not to be confused with Shoerec, a Windows 9x virus.

Virus.DOS.Shoe.1904 is a very dangerous memory resident parasitic polymorphic encrypted virus on DOS.


When the virus is run, it copies itself to upper memory block when there is a free block available, or to the conventional memory, and then it hooks INT 8, 21h, and infect any EXE executable that is accessed by writing itself to the end of the file.

Advanced details

The TSR of the virus occupies 2,016 bytes of memory.


On 1st of any even month (February, April(April Fools), ...) and the virus is in memory, when the user attempts to copy a file, the virus clears the screen and displays the message:

OOPS .. Sorry
For help call now:
555-SHOE or
No rights reserved by M.WEINHOLD

And then it erases the disk sectors.


Shoe DOS Virus

Shoe DOS Virus

Shoe virus review by danooct1

Community content is available under CC-BY-SA unless otherwise noted.