Threat Description



Category: Malware
Platform: W32


WM/Alien is a Word macro virus.

When an infected document is opened, the virus infects the global template. After that it infects all documents that are either opened or closed. It removes the "Tools/Customize..." and "Tools/Macro..." menu selections as well.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.


You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.

Technical Details

At random times while the virus infects the global template or the active document, it displays a random message boxes. These message boxes have the following title:


and the message text is one of the following:

Another Year of Survival ...
  It's Sunday & I intend to relax !
  Now You See Me - Now You Don't !
  Never Open Others Files !
  Never Trust An Alien !
  Don't Believe All Tips !
  Always Back Up Your Data.
  Don't Believe The Hype !
  Three Cheers For The Alien. Hip Hip Hooray !
  I'll Be Back !
  Hi Beautiful !
  You Facinate Me.
  Look No Further ...
  The 'Alien' Virus Has Arrived !
  The Alien Lives ...
  Longer File Names Should Be Used.

It also sometimes attempts to hide the Windows Program Manager or Word, exit from Windows completely or close the active document.

Description Created: Analysis: Sami Rautiainen, F-Secure


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More