|
|
Macro.Word.Alie Viruses Information
| Name: |
Macro.Word.Alie |
| Category: |
Viruses |
| Description:
|
Details
Macro.Word.Alien
These are encrypted Word macro viruses. They contain three macros in NORMAL.DOT and infected files:
"Alien.a": AutoClose, AutoOpen, FileSaveAs
"Alien.b": AutoClose, AutoOpen, FileSaveas
These viruses infect the system global data area on opening an infected document and infect the files that are opened or closed. Before infecting the viruses perform several actions to check the file/system and avoid incorrect infection - they search for virus macros in files/system, check them for ExecuteOnly attribute and so on. Depending on these conditions the viruses set several flags, and depending on these flags they infect the file/system.
The viruses check the file name, and if it contains "ALIEN" substring, the viruses do not infect files and system.
The viruses also remove menu items "Tools/Customizeall" and "Tools/Macro...". Other trigger routines are activated starting from:
"Alien.a" - Oct 1 1996
"Alien.b" - Jan 10 1997
Depending on the system random counter they display several messages and perform several actions. On August 1, with probability 1/2 they display the MessageBox:
Alien
Another Year of Survival ...
Then they try to hide Program Manager's window and terminate MS Word.
On Sundays, with probability 1/2 they display the MessageBox:
Alien
It's Sunday & I intend to relax !
and also try to hide Program Manager and terminate MS Word.
They also display the MessageBoxes with "Alien" title and the strings inside of box:
Never Open Others Files !
Never Trust An Alien !
Don't Believe All Tips !
Always Back Up Your Data."
Don't Believe The Hype !
Three Cheers For The Alien. Hip Hip Hooray !
I'll Be Back !
Hi Beautiful !
You Facinate Me.
Look No Further ...
The 'Alien' Virus Has Arrived !
The Alien Lives ...
If the file name length is less than 9, they display:
Tip From The Alien
Longer File Names Should Be Used
The viruses also contain "copyright" text:
End of Fun (All good (and bad) things DO come to an end !)
This Code was written in Chandigarh (India) on 01.08.1996
Behold the Alien Virus !! Lets See how it survives ! |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Helloween.25
Valentine.233
Find.66
Fly.176
Imi.1536.
Khai.183
Mordor.53
RingWorm.30
FOG.AirRaid.172
Win95.S
|
|
