These are encrypted Word macro viruses. They contain three macros in
NORMAL.DOT and infected files:
“Alien.a”: AutoClose, AutoOpen, FileSaveAs
“Alien.b”: AutoClose, AutoOpen, FileSaveas
These viruses infect the system global data area on opening an infected
document and infect the files that are opened or closed. Before infecting
the viruses perform several actions to check the file/system and avoid
incorrect infection – they search for virus macros in files/system, check
them for ExecuteOnly attribute and so on. Depending on these conditions the
viruses set several flags, and depending on these flags they infect the
The viruses check the file name, and if it contains “ALIEN” substring, the
viruses do not infect files and system.
The viruses also remove menu items “Tools/Customize…” and
“Tools/Macro…”. Other trigger routines are activated starting from:
“Alien.a” – Oct 1 1996
“Alien.b” – Jan 10 1997
Depending on the system random counter they display several messages and
perform several actions. On August 1, with probability 1/2 they display the
Another Year of Survival …
Then they try to hide Program Manager’s window and terminate MS Word.
On Sundays, with probability 1/2 they display the MessageBox:
It’s Sunday & I intend to relax !
and also try to hide Program Manager and terminate MS Word.
They also display the MessageBoxes with “Alien” title and the strings
inside of box:
Never Open Others Files !
Never Trust An Alien !
Don’t Believe All Tips !
Always Back Up Your Data.”
Don’t Believe The Hype !
Three Cheers For The Alien. Hip Hip Hooray !
I’ll Be Back !
Hi Beautiful !
You Facinate Me.
Look No Further …
The ‘Alien’ Virus Has Arrived !
The Alien Lives …
If the file name length is less than 9, they display:
Tip From The Alien
Longer File Names Should Be Used
The viruses also contain “copyright” text:
End of Fun (All good (and bad) things DO come to an end !)
This Code was written in Chandigarh (India) on 01.08.1996
Behold the Alien Virus !! Lets See how it survives !