| Alias: | (= HC = HyperCard Virus) |
| Strain: | --- |
| detected when: | 28 March 1991 |
| where: | MacClub Benelux Bšllingen (Belgium) |
| Classification: | Hypercard stacks infector (written in Hypertalk) |
| Length: | 3359 Bytes (in Hypertalk) |
Preconditions | |
| Operating System(s): | MacOS proprietary and Hypercard |
| Version/Release: | All |
| Computer model(s): | Apple Macintosh: all models with 128 KByte ROM |
| Caroname: | 2-Tunes |
Attributes | |
| Easy identification: | 1) Text (messages) messages in the virus: "Hey what are you doing?", "Don't panic" 2) Name of damage routine: "eleven". |
Type of Infection: | All Hypercard stacks |
| Infection Technique: | --- |
| Infection Trigger: | Virus will infect other stack scripts any time but in a German system not between November 11th and November 30th, and not from December 11th to December 31st. On English systems, this virus infects at any time. |
| Storage Media affected: | |
| Interrupts hooked: | --- |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | |
| Encoding Method: | |
| Damage: | Transient damage: the following visual/acoustic effects appear: 1)If the damage routine is active, the message "Hey, what are you doing ?" appears 17 seconds after start. 2)After 2 minutes, the tune "Muž I denn ..", a German folksong popularized by Elvis Pres- ley is played; this is repeated every 4 minutes. 3)4 minutes after activation, the song "Behind the blue mountains" is played; the system may shut down after this tune. 4)1 minute later, the virus displays Hypercards popup menus 'toolbox' and 'pattern'. If a user closes these menues, they will be reopened every minute. 5)15 Minutes after activation, the message "Don't panic" will appear. Permanent damage: --- |
| Damage Trigger: | Virus damage is active in systems with German calendar if date is between November 11th and 30th, or between December 11th and 31th, both in years between 1991 and 1999; no damage will appear on systems with English calendar. Damage starts 17 seconds after activating an infected stack. |
| Particularities: | --- |
| Similarities: | --- |
Agents | |
| Countermeasures: | --- |
| Standard means: | |
Acknowledgements | |
| Location: | Virus Test Center, University Hamburg, Germany |
| Classification by: | Thomas Piehl, Ralf Stegen |
| Documentation by: | Ralf Stegen |
| Date: | 15-July-1991 |
| Information Source: | --- |
(c) 1996 Virus-Test-Center, University of Hamburg