|Place of Origin||Iceland|
|File Type(s)||.com *|
|Infection Length||2,351 bytes|
When an infected .com file is run, Ghostballs searches for another .com file to infect in the current directory. It checks if the "seconds" field of the file's timestamp is set to 62, which means the file is already infected. If it is not, Ghostballs will infect it. If the file has the read-only attribute set, the virus will remove it and replace it when it has completed the infection. It adds a JMP instruction to the beginning of the file and appends its 2,351 bytes to it. Ghostballs then tries to drop a copy of the PingPong virus onto the boot sector of drive A:.
Ghostballs itself is sometimes considered a variant of the Vienna virus. It is very similar to the original Vienna, especially with regard to it changing the seconds field on a file's timestamp to the impossible value of 62. Ghostballs itself has few variants of its own, none of them any different from the original.
The virus gets its name from the text string contained in the virus: GhostBalls, Product of Iceland. Some antivirus products may shorten the name to "Ghost". Others refer to it as "Ghostorb", as "balls" refer to testicles in American and some other dialects of English, and may be considered offensive.
Fridrik Skulason. University of Iceland, Computing Services. Reports collected and collated by PC-Virus Index: Ghostballs. 1989.11.02
F-Secure Antivirus, F-Secure Virus Descriptions : GhostBalls.
Kaspersky Lab Virus.Multi.Ghostball.2351.a.