This is a destructive, direct infector Windows PE virus that infects EXE files. It encrypts its text to disable the user from seeing it by using a normal file viewer. It creates a thread of itself to catch files also infects files that start with a particular character in a particular time. For instance it cannot find files that match the character, no file is infected.
    When it is activated, it first decrypts itself. After decryption the infected file shows the following text:
"© 1999 Brain & Amjads (pvt) Ltd.
VIRUS_SHOE RECORD v20.0"
" Dedicated to the dynamic memories of millions of virus who are no longer with us today – Thanks."

    It appends the encrypted virus code at the end of the file and modifies the PE header to gain the control when the infected file is executed. Then infects Windows applications in the Windows directory, System directory, Program files directory and their subdirectories. Then it saves the system date/time in the virus body. When the infected application is executed, the current date/time is compared to the date/time previously saved. If at least 4 months after the file is being infected is passed, the payload is triggered.