Joke.WindowCloser

SUMMARY

Behavior

When this program runs, it causes the cursor to move randomly, and closes all open windows. Every time a window is opened, the mouse moves randomly and the program closes the window. There are no dropped files and no registry entries created.

Symptoms

The cursor moves by itself and closes open windows.
Programs are detected as Joke.WindowCloser.

Transmission

Has to be manually executed.

Protection

• Initial Rapid Release version January 30, 2006
• Latest Rapid Release version January 30, 2006
• Initial Daily Certified version January 30, 2006
• Latest Daily Certified version December 18, 2007 revision 020
• Initial Weekly Certified release date February 1, 2006

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

TECHNICAL DETAILS

Joke.WindowCloser comes as a packed executable file. When this file is executed, the mouse will move randomly and all open windows will close. Whenever a window is opened, this behavior repeats. The program is memory resident, but drops no files and creates no registry keys.

If program is executed, it can be disabled via the Windows task manager (CTR+ALT+DEL) by stopping the application (Windows 98 only). Windows 2000 and XP users may have to log off or restart the computer to stop the application.

REMOVAL

The following instructions pertain to all Symantec antivirus products that support Security Risk detection. You may need to stop the application manually before you can run any other application window. To do this, press CTL+ALT+DEL for the Windows Task Manager and end the process associated with this application. If the program does not allow you to run the Task Manager Window, you may need to shut down your computer to stop the application.

1. Update the definitions.
2. Run a full system scan and delete all the files detected as Joke.WindowCloser.
   

For specific details on each of these steps, read the following instructions.

1. Updating the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. Scanning for and deleting the files

1. Start your Symantec antivirus program and run a full system scan.
2. If any files are detected as Joke.WindowCloser, click Delete.

---

Note: If your Symantec antivirus product reports that it cannot delete a detected file, the application can be stopped using the Windows Task Manager. Delete the file using Windows Explorer or DOS command shell.