SHOE-B v9.0 (July 10, 1989)
Entry.................. SHOE-B v9.0
Alias(es).............. ---
Strain................. Brain/Pakistani
Detected: when......... November 1988
          where........ Houston University
Classification......... System (Boot sector) virus
Length of Virus........ approx. 3k (not all is actually used)
------------------------ Preconditions---------------------------------- 
Operating System(s).... MS-DOS
Version/Release........ Should work with all versions
Computer models........ IBM-PC's and compatibles
-------------------------- Attributes----------------------------------- 
Easy identification.... The volume label of the infected disk will
                        read: "(c) Brain"
Type of infection...... The virus installs itself in high memory after
                        booting with an infected disk. It captures all 
                        read and  write calls to the disk, checks for 
                        infection and, if not yet present, infects the 
                        disk. Infection occurs by flagging five blocks  
                        as bad, copying itself and the original boot
                        sector into those five blocks, and replacing the 
                        boot sector with its own. The virus identifies
                        itself by checking the boot sector for the
                        word 1234h at position 0004h in the boot sector.
Infection trigger...... Counter: will attempt to infect initially
                        after 31 read/write calls, subsequently after 
                        every fourth call.
Media affected......... Only floppy disks; Hard disks not infected.
Interrupts hooked...... Int 13h functions 2,3 (read,write).
Damage................. Destroys five blocks (as well as the boot
                        sector) upon infection, otherwise nothing.
Damage trigger......... ---
Particularities........ The virus looks whether attempts are made to
                        read the boot sector; in this case, the virus
                        transfers the original boot sector. The virus
                        can therefore not be identified with utilities 
                        such as PC-TOOLS or NORTON  UTILITIES. 
                        An infected boot sector contains the following 
                        typical text: "Welcome to the Dungeon 
                        (c) 1986 Basit & Amjads (pvt) Ltd    
                        VIRUS_SHOE RECORD v9.0 Dedicated to the dynamic  
                        memories of millions of virus who are no longer 
                        with us today - Thanks GOODNESS!! BEWARE OF THE
                        er..VIRUS: \this program is catching   program    
                        follows after these messeges..... $#%$!!  ";  
                        this text is never displayed.
Similarities........... Similar to all viruses of Pakistani/Brain strain.
----------------------- Agents -----------------------------------------
Countermeasures........ ----
Countermeasures successful ---
Standard Means......... The DOS command "SYS n:" (where n is the drive
                        of the infected disk) will disinfect the disk
                        IF AND ONLY IF you have booted from a clean disk.
                        You will have to use utilities such as PC-TOOLS  
                        to recover the "bad" sectors.
----------------------- Acknowledgements-------------------------------- 
Location............... VTC Hamburg, FRG
Classification by...... Morton Swimmer
Documentation by....... Morton Swimmer
Date................... June 29, 1989
Information source..... PC VIRUS LISTING (Jim Goodwin)

.