Fandom

Virus Information

Ghostballs

245pages on
this wiki
Add New Page
Talk0 Share
Ghostballs
Type Multipartite virus
Creator
Date Discovered 1989.10
Place of Origin Iceland
Source Language Assembly
Platform DOS
File Type(s) .com *
Infection Length 2,351 bytes
Reported costs

Ghostballs is considered the first multipartite virus. It is actually a variant of Vienna that drops a copy of the PingPong virus on diskettes.

BehaviorEdit

When an infected .com file is run, Ghostballs searches for another .com file to infect in the current directory. It checks if the "seconds" field of the file's timestamp is set to 62, which means the file is already infected. If it is not, Ghostballs will infect it. If the file has the read-only attribute set, the virus will remove it and replace it when it has completed the infection. It adds a JMP instruction to the beginning of the file and appends its 2,351 bytes to it. Ghostballs then tries to drop a copy of the PingPong virus onto the boot sector of drive A:.

VariantsEdit

Ghostballs itself is sometimes considered a variant of the Vienna virus. It is very similar to the original Vienna, especially with regard to it changing the seconds field on a file's timestamp to the impossible value of 62. Ghostballs itself has few variants of its own, none of them any different from the original.

NameEdit

The virus gets its name from the text string contained in the virus: GhostBalls, Product of Iceland. Some antivirus products may shorten the name to "Ghost". Others refer to it as "Ghostorb", as "balls" refer to testicles in American and some other dialects of English, and may be considered offensive.

SourcesEdit

Fridrik Skulason. University of Iceland, Computing Services. Reports collected and collated by PC-Virus Index: Ghostballs. 1989.11.02

F-Secure Antivirus, F-Secure Virus Descriptions : GhostBalls.

Kaspersky Lab Virus.Multi.Ghostball.2351.a.

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.