Not to be confused with Shoerec, a Windows 9x virus.
When the virus is run, it copies itself to upper memory block when there is a free block available, or to the conventional memory, and then it hooks INT 8, 21h, and infect any EXE executable that is accessed by writing itself to the end of the file.
The TSR of the virus occupies 2,016 bytes of memory.
On 1st of any even month (February, April, ...) and the virus is in memory, when the user attempts to copy a file, the virus clears the screen and displays the message:
OOPS .. Sorry For help call now: 555-SHOE or 555-RGNE No rights reserved by M.WEINHOLD
And then it erases the disk sectors.