| Marburg | |
|---|---|
| Type | File virus |
| Creator | GriYo |
| Date Discovered | 1998.07.23 |
| Place of Origin | Madrid, Spain |
| Source Language | Assembly |
| Platform | MS Windows |
| File Type(s) | .exe, .scr |
| Infection Length | 8,590 bytes |
Marburg is a Windows 9x virus by GriYo. It is a more primitive version of his CTX virus. The virus was accidentally released a few times in commercial software. It is named after a deadly human virus discovered in Germany in a research laboratory that housed monkeys.
Behavior
When Marburg is executed, it is decrypted and searches for .scr (screensaver) and .exe files in the current, Windows and system directories. In some files, Marburg overwrites the code at its host entry-point with a block or polymorphic code, though depending on the structure of the file, it may not. It sometimes appends itself to the last section of the file. File sizes will be divisible by 101, and the virus will avoid infecting files with a file size divisible by that number.
Marburg has retroviral features and avoids infecting some antivirus products. It avoids infecting files with the letter "V" or "PAND", "F-PR", or "SCAN" in their names. Marburg deletes"CHKLIST.MS", "AVP.CRC" and "IVB.NTZ" in any directory where it infects files.
The virus has a graphical payload, which displays the Windows error icon (a red dot with a white "X"
Variants
Marburg.B is 8,582 bytes long and functionally similar to the original.
Effects
Marburg made it into the wild. It was released accidentally in commercial software a few times. Very shortly after it was created, PC Gamer Magazine distributed the virus in its British, Swedish and Slovenian editions. On the 12th of August in 1998, MGM made an announcement saying its "WarGames" CD contained a file infected with the virus. That same month, the magazine "PC Power Play" from Australia accidentally distributed the virus on a cover CD.
Name and Origin
As with most of GriYo's viruses, Marburg is named for a human/animal virus. Marburg is a city in the Hessen state of Germany. In 1967, a previously unknown virus infected laboratory workers doing research involving Green Monkeys. There were 31 cases and 7 deaths.
Sources
GriYo. 29A, Issue 3, Marburg virus.
Peter Szor, Mikko Hypponen. F-Secure, Marburg. 1998
Carey Nachenberg. W95.Marburg.A / W95.Marburg.B. 2007.02.13