"2-Tunes" Virus (15-July-1991)
Entry...............: 2-Tunes Virus
Alias(es)...........: (= HC = HyperCard Virus)
Virus Strain........: ---                                          
Virus detected when.: 28 March 1991           
              where.: MacClub Benelux Bllingen (Belgium)
Classification......: Hypercard stacks infector (written in Hypertalk)
Length of Virus.....: 3359 Bytes (in Hypertalk)
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary and Hypercard            
Version/Release.....: All                     
Computer model(s)...: Apple Macintosh: all models with 128 KByte ROM
--------------------- Attributes ------------------------------------
Easy Identification.: 1) Text (messages) messages in the virus:
                         "Hey what are you doing?", "Don't panic"
                      2) Name of damage routine: "eleven".
Resource pattern....: ---
Type of infection...: Virus infects hypercard stack scripts.
Infection trigger...: Virus will infect other stack scripts any time 
                         but in a German system not between November 
                         11th and November 30th, and not from December
                         11th to December 31st. On English systems,
                         this virus infects at any time.
Applications affected: All Hypercard stacks
Traps intercepted...: ---
Damage..............: Transient damage: the following visual/acoustic
                      effects appear:
                      1)If the damage routine is active, the message
                        "Hey, what are you doing ?" appears 17 seconds
                        after start. 
                      2)After 2 minutes, the tune "Mu I denn ..", 
                        a German folksong popularized by Elvis Pres-
                        ley is played; this is repeated every 4 
                        minutes. 
                      3)4 minutes after activation, the song "Behind
                        the blue mountains" is played; the system may
                        shut down after this tune. 
                      4)1 minute later, the virus displays Hypercards
                        popup menus 'toolbox' and 'pattern'. If a user
                        closes these menues, they will be reopened 
                        every minute. 
                      5)15 Minutes after activation, the message 
                        "Don't panic" will appear.
                      Permanent damage: ---
Damage Trigger......: Virus damage is active in systems with German
                         calendar if date is between November 11th 
                         and 30th, or between December 11th and 31th,
                         both in years between 1991 and 1999; no damage 
                         will appear on systems with English calendar.
                      Damage starts 17 seconds after activating an
                         infected stack.
Peculiarities.......: ---
Similarities........: ---
--------------------- Agents -----------------------------------------
Countermeasures/direct: Manual search and deleting the virus by hand
Countermeasures/software: ---
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Thomas Piehl, Ralf Stegen
Documentation by....: Ralf Stegen
Date................: 15-July-1991
Information Source..: --- 

.