Youth Virus


 Virus Name:  Youth 
 Aliases:    
 V Status:    Rare 
 Discovered:  October, 1992 
 Symptoms:    .COM file growth; decrease in total system & available free 
              memory; hard disk corruption 
 Origin:      Sweden 
 Eff Length:  640 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  F-Prot, ViruScan, AVTK, Sweep, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, 
                    NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Youth virus was submitted in October, 1992.  It is originally 
       from Sweden, though some of the text in virus virus is in German 
       and French.  Youth is a memory resident infector of .COM programs, 
       including COMMAND.COM. 
 
       The first time a program infected with the Youth virus is executed, 
       Youth will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  Total system and available 
       free memory, as indicated by the DOS CHKDSK program, will have 
       decreased by 1,792 bytes.  Interrupts 21 and 22 will be hooked by 
       the virus. 
 
       Once the Youth virus is memory resident, it will infect .COM 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 640 bytes with the 
       virus being located at the beginning of the file.  The program's 
       date and time in the DOS disk directory listing will not be 
       altered.  The following text strings can be found within the viral 
       code in all infected programs: 
 
               "McAfee, geht nach Hause! Wir sind unberwindlich" 
               "DemoralizedYouth vous a eu" 
 
       The text roughly translates from German and French to: 
 
               "McAfee, go back Home! We are in control" 
               "DemoralizedYouth got you" 
 
       Known variant(s) of Youth are: 
       Futhark: Based on the Youth virus, this variant's size in memory 
                is 2,432 bytes, hooking interrupt 21.  It infects .COM 
                programs when they are executed, adding 968 to 1,479 bytes 
                to the programs it infects.  The virus will be located at 
                the beginning of the file.  The program's date and time in 
                the DOS disk directory listing will not be altered.  The 
                following text strings can be found in all infected files: 
                "[Futhark] by -:\) DEMORALIZED YOUTH (/:-" 
                "Ni S Solu Sot Uk Ni Sakse Stain Skorin" 
                Origin:  Sweden  October, 1992. 
       Hannibal: Based on the Youth virus, this variant's size in memory 
                is 2,512 bytes, hooking interrupt 21.  It infects .COM 
                programs when they are executed, adding 970 bytes to the 
                programs it infects.  The file length increase is hidden 
                by the virus when the virus is memory resident.  The virus 
                will be located at the beginning of the file.  The program's 
                date and time in the DOS disk directory listing will not be 
                altered.  The following text strings can be found in all 
                infected files: 
                "* DeMoRaLiZeD YoUtH *" 
                "(c) Hannibal Lechter" 
                "Ni S Sakse Stain Skorin" 
                Origin:  Sweden  June, 1993. 
       Youth.580: Based on the Youth virus, this variant's size in memory 
                is 1,664 bytes, hooking interrupts 21 and 22.  Once resident, 
                it infects .COM programs when they are executed, adding 580 
                bytes to their length.  The virus will be located at the 
                beginning of all infected files.  The program's date and time 
                in the DOS disk directory listing will not appear to be 
                altered, though the seconds field will have been set to "58". 
                The following text string can be found in all infected files: 
                "Demoralized Youth" 
                Origin:  Sweden  July, 1994. 
 
       See:  Silence 

Show viruses from discovered during that infect .

Main Page