Outland Virus
Virus Name: Outland
Aliases: 2136, Oliver
V Status: Rare
Discovered: December, 1992
Symptoms: .COM & .EXE growth; decrease in total system & available free
memory; Boot sector altered
Origin: Unknown
Eff Length: 2,136 - 2,150 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: AVTK, F-Prot, IBMAV, ViruScan, Sweep,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, NAV/N,
IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Outland, Oliver or 2,136, virus was submitted in December, 1992.
Its origin or point of isolation are unknown. Outland is based on
the Dark Avenger virus, and like Dark Avenger, is a memory resident
infector of .COM, .EXE, and overlay files. It also alters the boot
sector of the drive or diskette, maintaining a counter there.
When the first Outland infected program is executed, the Outland
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, hooking interrupts 21 and
27. Total system and available free memory, as indicated by the
DOS CHKDSK program, will have decreased by 4,368 bytes. Interrupt
12's return will not have been moved.
Once the Outland virus is memory resident, it will infect .COM, .EXE
and overlay files when they are executed or opened. Infected .COM
programs will have a file length increase of 2,136 bytes. Infected
.EXE files will have a file length increase of 2,136 to 2,150 bytes.
The virus will be located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
The following text strings are visible within the Outland viral
code in all infected programs:
"Bill the Cat Lives!"
"Oliver Wendell Jones"
"Politically Incorrect Personal Computers Presents:"
"the OLIVER VIRUS!"
"Nya Ha Ha! Men Rule! America Kicks Butt! Rap Sucks!"
"Eat Fatty Food! Dames Melt Like Jell-O for Naughty Men!"
"Ted Kennedy Sucks Barney Frank`s Fag Cock!"
"Banana 6000 P.I.P.C. (C) I spell -Lightening- wrong!"
The Outland virus maintains a counter in the boot sector of the
current drive. It is unknown what it does when it activates.
See: Dark Avenger