McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• Aldus

• Brandow

• DREW

• MacMag

Characteristics

A HyperCard stack called 'New Apple Products' which was a dropper for this virus was used to put it in the wild. The virus infected only system files which, in turn infected other system files. The Peace virus spreads from machine to machine, and then displayed a universal message of peace on March 2, 1988. The virus destroyed itself after the message appeared. Consequently, it is rarely reported.

Please note that a dropper of Peace virus is sometimes referred to as MacMag trojan.

Symptoms

After March 2, 1988 the infected System would display a message of peace and show the icon with an American symbol. After that the virus will remove itself.

Method of Infection

The HyperCard dropper of the virus carried a resource DREW 0 which was planted by the HyperCard script into the System file under INIT with "DR" name. The dropper also has short XCMD 95 resource called "Effects" (408 bytes long).

Removal

Please use the latest updates of Virex for cleaning. If this threat is detected on a Macintosh please use Virex to repair it.

If the infected object was found on a non-Apple file server it can be cleaned using Virex from a Macintosh client.

Infected Emails (usually in BinHex format) will be currently either deleted or quarantined depending on the configuration of mail scanner. Quarantined mails should be transferred to a Macintosh and cleaned using Virex.

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• Aldus

• Brandow

• DREW

• MacMag

Characteristics

Characteristics -

A HyperCard stack called 'New Apple Products' which was a dropper for this virus was used to put it in the wild. The virus infected only system files which, in turn infected other system files. The Peace virus spreads from machine to machine, and then displayed a universal message of peace on March 2, 1988. The virus destroyed itself after the message appeared. Consequently, it is rarely reported.

Please note that a dropper of Peace virus is sometimes referred to as MacMag trojan.

Symptoms

Symptoms -

After March 2, 1988 the infected System would display a message of peace and show the icon with an American symbol. After that the virus will remove itself.

Method of Infection

Method of Infection -

The HyperCard dropper of the virus carried a resource DREW 0 which was planted by the HyperCard script into the System file under INIT with "DR" name. The dropper also has short XCMD 95 resource called "Effects" (408 bytes long).

Removal -

Removal -

Please use the latest updates of Virex for cleaning. If this threat is detected on a Macintosh please use Virex to repair it.

If the infected object was found on a non-Apple file server it can be cleaned using Virex from a Macintosh client.

Infected Emails (usually in BinHex format) will be currently either deleted or quarantined depending on the configuration of mail scanner. Quarantined mails should be transferred to a Macintosh and cleaned using Virex.

Variants

Variants -

N/A