Virus Database

Bolek.1326

Description Bolek.1326

It's a not dangerous memory resident parasitic virus. It writes itself at the end of EXE-files. On execution it searches for the EXE-files and hits them, then it hooks INT 21h and infects EXE-files that are executed. It hooks INT 1, 3, 9, 15h, 1Ch also, depending on several conditions it displays different characters. This virus also contains the internal text string "Bolek".

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Alien

Description Macro.Word.Alien

These are encrypted Word macro viruses. They contain three macros in NORMAL.DOT and infected files:
"Alien.a": AutoClose, AutoOpen, FileSaveAs
"Alien.b": AutoClose, AutoOpen, FileSaveas

These viruses infect the system global data area on opening an infected document and infect the files that are opened or closed. Before infecting the viruses perform several actions to check the file/system and avoid incorrect infection - they search for virus macros in files/system, check them for ExecuteOnly attribute and so on. Depending on these conditions the viruses set several flags, and depending on these flags they infect the file/system.
The viruses check the file name, and if it contains "ALIEN" substring, the viruses do not infect files and system.
The viruses also remove menu items "Tools/Customizeall" and "Tools/Macro...". Other trigger routines are activated starting from:
"Alien.a" - Oct 1 1996
"Alien.b" - Jan 10 1997

Depending on the system random counter they display several messages and perform several actions. On August 1, with probability 1/2 they display the MessageBox:
Alien
Another Year of Survival ...

Then they try to hide Program Manager's window and terminate MS Word.
On Sundays, with probability 1/2 they display the MessageBox:
Alien
It's Sunday & I intend to relax !

and also try to hide Program Manager and terminate MS Word.
They also display the MessageBoxes with "Alien" title and the strings inside of box:
Never Open Others Files !
Never Trust An Alien !
Don't Believe All Tips !
Always Back Up Your Data."
Don't Believe The Hype !
Three Cheers For The Alien. Hip Hip Hooray !
I'll Be Back !
Hi Beautiful !
You Facinate Me.
Look No Further ...
The 'Alien' Virus Has Arrived !
The Alien Lives ...

If the file name length is less than 9, they display:
Tip From The Alien
Longer File Names Should Be Used

The viruses also contain "copyright" text:
End of Fun (All good (and bad) things DO come to an end !)
This Code was written in Chandigarh (India) on 01.08.1996
Behold the Alien Virus !! Lets See how it survives !

Macro.Word.Allian

Description Macro.Word.Allian

This is encrypted macro virus. It contains two macros that have identical code inside: AutoOpen, AutoNew. The virus infects the global macros area and documents on opening an existing document or creating a new document. After infecting the virus displays the message:
UNIVERSITI TEKNOLOGI MALAYSIA
ARE YOU A FSKSM STUDENT?
ANSWER YES OR YOUR DOCUMENT WILL BE LOCKED BY MY PASSWORD !
FAKULTI SAINS KOMPUTER DAN SISTEM MAKLUMAT

If a user answers "Yes" the virus sets the password "Saya!" for the current document.

Home