Youth Virus

Virus Name: Youth Aliases: V Status: Rare Discovered: October, 1992 Symptoms: .COM file growth; decrease in total system & available free memory; hard disk corruption Origin: Sweden Eff Length: 640 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: F-Prot, ViruScan, AVTK, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Youth virus was submitted in October, 1992. It is originally from Sweden, though some of the text in virus virus is in German and French. Youth is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with the Youth virus is executed, Youth will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,792 bytes. Interrupts 21 and 22 will be hooked by the virus. Once the Youth virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 640 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in all infected programs: "McAfee, geht nach Hause! Wir sind unberwindlich" "DemoralizedYouth vous a eu" The text roughly translates from German and French to: "McAfee, go back Home! We are in control" "DemoralizedYouth got you" Known variant(s) of Youth are: Futhark: Based on the Youth virus, this variant's size in memory is 2,432 bytes, hooking interrupt 21. It infects .COM programs when they are executed, adding 968 to 1,479 bytes to the programs it infects. The virus will be located at the beginning of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found in all infected files: "[Futhark] by -:\) DEMORALIZED YOUTH (/:-" "Ni S Solu Sot Uk Ni Sakse Stain Skorin" Origin: Sweden October, 1992. Hannibal: Based on the Youth virus, this variant's size in memory is 2,512 bytes, hooking interrupt 21. It infects .COM programs when they are executed, adding 970 bytes to the programs it infects. The file length increase is hidden by the virus when the virus is memory resident. The virus will be located at the beginning of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found in all infected files: "* DeMoRaLiZeD YoUtH *" "(c) Hannibal Lechter" "Ni S Sakse Stain Skorin" Origin: Sweden June, 1993. Youth.580: Based on the Youth virus, this variant's size in memory is 1,664 bytes, hooking interrupts 21 and 22. Once resident, it infects .COM programs when they are executed, adding 580 bytes to their length. The virus will be located at the beginning of all infected files. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "58". The following text string can be found in all infected files: "Demoralized Youth" Origin: Sweden July, 1994. See: Silence