Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.



13 February 2007
Infection Length:
34,816 bytes (packed)
Risk Impact:
Systems Affected:


When this program runs, it causes the cursor to move randomly, and closes all open windows. Every time a window is opened, the mouse moves randomly and the program closes the window. There are no dropped files and no registry entries created.


The cursor moves by itself and closes open windows.
Programs are detected as Joke.WindowCloser.


Has to be manually executed.

Antivirus Protection Dates

  • Initial Rapid Release version 02 October 2014 revision 022
  • Latest Rapid Release version 01 February 2015 revision 020
  • Initial Daily Certified version 30 January 2006
  • Latest Daily Certified version 02 August 2008 revision 002
  • Initial Weekly Certified release date 01 February 2006
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Joke.WindowCloser comes as a packed executable file. When this file is executed, the mouse will move randomly and all open windows will close. Whenever a window is opened, this behavior repeats. The program is memory resident, but drops no files and creates no registry keys.

If program is executed, it can be disabled via the Windows task manager (CTR+ALT+DEL) by stopping the application (Windows 98 only). Windows 2000 and XP users may have to log off or restart the computer to stop the application.

The following instructions pertain to all Symantec antivirus products that support Security Risk detection. You may need to stop the application manually before you can run any other application window. To do this, press CTL+ALT+DEL for the Windows Task Manager and end the process associated with this application. If the program does not allow you to run the Task Manager Window, you may need to shut down your computer to stop the application.
  1. Update the definitions.
  2. Run a full system scan and delete all the files detected as Joke.WindowCloser.
For specific details on each of these steps, read the following instructions.

1. Updating the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. Scanning for and deleting the files
  1. Start your Symantec antivirus program and run a full system scan.
  2. If any files are detected as Joke.WindowCloser, click Delete.

Note: If your Symantec antivirus product reports that it cannot delete a detected file, the application can be stopped using the Windows Task Manager. Delete the file using Windows Explorer or DOS command shell.