Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Win.Desktop.Puzzle


Aliases:


Win.Desktop.Puzzle
Desktop.Puzzle

Malware

W32

Summary

This is a trojan written in Delphi. The original filename is SLIDESCR.EXE. When executed under Windows 95 it blocks task manager and opens a messagebox with the following text:

 Slider 1.0
   Oops, looks like somebody doesn't like you very much !
   You have to finish this sliding tile puzzle before you
   can continue whatever it is you're doing !
   Use the cursor keys to move the pieces (black piece is
   the empty one).



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

After 'OK' is pressed the trojan splits Windows desktop into several parts, mixes them and waits for the user to restore the original desktop by solving the sliding tile puzzle. It also swaps functions of cursor keys: 'Up' becomes 'Down', 'Left' becomes 'Right' and that makes solving the puzzle more difficult. There's no way to continue working with other Windows applications until you complete the puzzle.

Under Windows NT the task manager is not blocked by the trojan and the puzzle task could be killed.

If the trojan is executed from DOS session (full screen mode) the desktop data is not acquired correctly and the puzzle parts are blank. This happens because the desktop image is acquired by the trojan before Windows switches from DOS screen to its desktop.





Technical Details: Alexey Podrezov, F-Secure



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.