Sonik Youth Virus
Virus Name: Sonik Youth
V Status: Rare
Discovered: August, 1993
Symptoms: .EXE file growth; file date/time altered;
.EXE programs deleted
Eff Length: 854 - 866 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan, IBMAV, Sweep, F-Prot, NAV, AVTK 7.68+,
NAVDX, VAlert, ChAV,
NShld, Sweep/N, NAV/N, IBMAV/N, AVTK/N 7.68+
Removal Instructions: Delete infected files
The Sonik Youth virus was submitted in August, 1993. Its origin or
point of isolation is unknown. Sonik Youth is a non-resident, direct
action infector of .EXE programs.
When a program infected with the Sonik Youth virus is executed, this
virus will infect one .EXE program located in the current directory.
Infected programs will have a file length increase of 854 to 866
bytes. 160 bytes will have been added to the beginning of the file,
with the remainder of the virus being at the end of the file. The
file's date and time in the DOS disk directory listing will have been
altered, but not to the current system date and time. The following
text strings are visible within the viral code in all Sonik Youth
"My mother used to say"
"You're the boy that can enjoy invisibility"
"The pleasure is everlasting"
"Sonik Youth originally released 29 April '92"
The following text string is encrypted within the viral code:
"*.EXE \* \"
Systems which have had the Sonik Youth virus present for some time
may experience the virus deleting .EXE programs from the current
directory when an infected program is executed.