Virus Database

Macro.Word.Alien

Description Macro.Word.Alien

These are encrypted Word macro viruses. They contain three macros in NORMAL.DOT and infected files:
"Alien.a": AutoClose, AutoOpen, FileSaveAs
"Alien.b": AutoClose, AutoOpen, FileSaveas

These viruses infect the system global data area on opening an infected document and infect the files that are opened or closed. Before infecting the viruses perform several actions to check the file/system and avoid incorrect infection - they search for virus macros in files/system, check them for ExecuteOnly attribute and so on. Depending on these conditions the viruses set several flags, and depending on these flags they infect the file/system.
The viruses check the file name, and if it contains "ALIEN" substring, the viruses do not infect files and system.
The viruses also remove menu items "Tools/Customizeall" and "Tools/Macro...". Other trigger routines are activated starting from:
"Alien.a" - Oct 1 1996
"Alien.b" - Jan 10 1997

Depending on the system random counter they display several messages and perform several actions. On August 1, with probability 1/2 they display the MessageBox:
Alien
Another Year of Survival ...

Then they try to hide Program Manager's window and terminate MS Word.
On Sundays, with probability 1/2 they display the MessageBox:
Alien
It's Sunday & I intend to relax !

and also try to hide Program Manager and terminate MS Word.
They also display the MessageBoxes with "Alien" title and the strings inside of box:
Never Open Others Files !
Never Trust An Alien !
Don't Believe All Tips !
Always Back Up Your Data."
Don't Believe The Hype !
Three Cheers For The Alien. Hip Hip Hooray !
I'll Be Back !
Hi Beautiful !
You Facinate Me.
Look No Further ...
The 'Alien' Virus Has Arrived !
The Alien Lives ...

If the file name length is less than 9, they display:
Tip From The Alien
Longer File Names Should Be Used

The viruses also contain "copyright" text:
End of Fun (All good (and bad) things DO come to an end !)
This Code was written in Chandigarh (India) on 01.08.1996
Behold the Alien Virus !! Lets See how it survives !

Check other viruses! Be aware! Use Antiviral Software

Shutdown.698

Description Shutdown.698

This is a dangerous non-memory resident parasitic virus. It searches for COM files, and writes itself to the beginning of the file. In March, it erases the disk sectors and displays the following:
Computers must be shutdown to dedicate my sister!
It also displays:
-- HKs VTech --

ShyDemon family

Description ShyDemon family

These are not dangerous nonmemory resident encrypted parasitic viruses. They searches for .COM files, then for EDIT.COM file, then write themselves to the end of the file. On May 30th they display the message:
(C) Shy Demon Is A Dark Wizard 1996 Production
Helloall Hope I'm Not Disturbing....
Don't Wanna Cause Any Trouble... But I Just Infected 2 Files...
And If You're Not Nive To Me I Will Infect More...
Please Don't Kill Me!
We Virii's Also Have A Life You Know...
See Ya Next [03.30], Gotta Run...

The viruses also contain the text strings:
[Shy Demon - Dark Wizard - Sweden - 96.03.10]
*.com edit.com

Home