McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• 2 Tunes

• HC virus

• Two Tunes

Characteristics

This is a script virus infecting HyperCard stacks on Apple Macintosh computers.

This virus has no relation to a PC virus sometimes called Three_Tunes.1784 or 3Tunes.

Symptoms

Strings "Hey what are you doing?" and "Don't panic" are visible. The name of the damage routine is "eleven".

The virus damage is active in systems with German calendars if the date is between November 11th and 30th, or between December 11th and 31st in any year between 1991 and 1999. No damage occurs on systems with English calendar. The damage starts 17 seconds after activating the infected stack. If the damage routine is active, the message "Hey what are you doing?" appears 17 seconds after start. After 2 minutes the tune "Muss I denn..." (a German folk song popularized by Elvis Presley) is played and repeated every 4 minutes. 4 minutes after activation, the song "Behind the Blue Mountains" is played and the system may shut down after this tune. If not, 1 minute later the virus displays Hypercars's pop-up menus "toolbox" and pattern". If the user closes them they will be reopened every minute. 15 minutes after activation "Don't panic" message will appear.

Method of Infection

The virus will infect other stack scripts any time, but in a German system not between November 11th and November 30th and not between December 11th and December 31st.

Removal

Please use the latest updates of Virex for cleaning. If this threat is detected on a Macintosh please use Virex to repair it.

If the infected object was found on a non-Apple file server it can be cleaned using Virex from a Macintosh client.

Infected Emails (usually in BinHex format) will be currently either deleted or quarantined depending on the configuration of mail scanner. Quarantined mails should be transferred to a Macintosh and cleaned using Virex.

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• 2 Tunes

• HC virus

• Two Tunes

Characteristics

Characteristics -

This is a script virus infecting HyperCard stacks on Apple Macintosh computers.

This virus has no relation to a PC virus sometimes called Three_Tunes.1784 or 3Tunes.

Symptoms

Symptoms -

Strings "Hey what are you doing?" and "Don't panic" are visible. The name of the damage routine is "eleven".

The virus damage is active in systems with German calendars if the date is between November 11th and 30th, or between December 11th and 31st in any year between 1991 and 1999. No damage occurs on systems with English calendar. The damage starts 17 seconds after activating the infected stack. If the damage routine is active, the message "Hey what are you doing?" appears 17 seconds after start. After 2 minutes the tune "Muss I denn..." (a German folk song popularized by Elvis Presley) is played and repeated every 4 minutes. 4 minutes after activation, the song "Behind the Blue Mountains" is played and the system may shut down after this tune. If not, 1 minute later the virus displays Hypercars's pop-up menus "toolbox" and pattern". If the user closes them they will be reopened every minute. 15 minutes after activation "Don't panic" message will appear.

Method of Infection

Method of Infection -

The virus will infect other stack scripts any time, but in a German system not between November 11th and November 30th and not between December 11th and December 31st.

Removal -

Removal -

Please use the latest updates of Virex for cleaning. If this threat is detected on a Macintosh please use Virex to repair it.

If the infected object was found on a non-Apple file server it can be cleaned using Virex from a Macintosh client.

Infected Emails (usually in BinHex format) will be currently either deleted or quarantined depending on the configuration of mail scanner. Quarantined mails should be transferred to a Macintosh and cleaned using Virex.

Variants

Variants -

N/A