Virus Name: Marl
V Status: Rare
Discovered: February, 1992
Symptoms: .COM file growth
Eff Length: 560 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: NAV, ViruScan, F-Prot, Sweep, AVTK,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N, AVTK/N,
Removal Instructions: Delete infected files
The Marl virus was received in February, 1992. Its origin, or
point of isolation, is unknown. Marl is a non-resident, direct
action infector of .COM programs.
When a program infected with the Marl virus is executed, the Marl
virus will search the current directory and infect the first
uninfected .COM program it finds. If COMMAND.COM is located in
this directory, it may become infected.
Programs infected with the Marl virus will have a file length
increase of 560 bytes. The virus will be located at the end of
the infected program. The file's date and time in the DOS disk
directory listing will not be altered. No text strings are
visible within the viral code.
Marl does not appear to do anything besides replicate, and is an
earlier version of the Marauder virus.