Marbas Virus

Virus Name: Marbas Aliases: Marbas.1303 V Status: New Discovered: January, 1996 Symptoms: .COM file growth; file date/time changes Origin: Unknown Eff Length: 1,303 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: NAV, NAVDX, IBMAV, AVTK, ViruScan, F-Prot, PCScan, ChAV, NAV/N, IBMAV/N, NProt, AVTK/N, NShld, NProt, Innoc Removal Instructions: Delete infected files General Comments: The Marbas or Marbas.1303 virus was received in January, 1996. Its origin or point of isolation is unknown. Marbas is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with the Marbas virus is executed, this virus will infect all of the .COM files located in the current directory. Infected programs will have a file length increase of 1,303 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings are encrypted within the Marbas viral code: "[PolyMorphisM ]" "[Marbas]" "[Put Satanachia]" "[-Satan's Fire-]" "*.com *.* .." "[ Pride ][ Avarice ][ Lechery ][ Anger ][ Gluttony ][ Envey ][ Sloth ]" "[So on his nightmare, through the evening fog, Flits the squat fiend o'er fen, lake, and bog; Seeks some love-wildered maid with sleep oppressed, Alights, and grinning sits upon her breast... Back o'er her pillow sinks her blushing head, Her snow-white limbs hang helpless from the bed; While with quick sighs and suffocative breath Her interrupted heart pulse swims in death.]" "????????COM" Known variant(s) of Marbas are: Marbas.1313: Also received in January, 1996, this is a 1,313 byte variant of the Marbas virus described above. It infects all of the .COM files in the current directory when an infected program is executed, adding 1,313 bytes to the file's length. The viral code will be located at the end of the file and the program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. This variant contains the same encrypted text strings as the original virus. Origin: Unknown January, 1996.