Fandom

Malware Wiki

Ghost 2

1,335pages on
this wiki
Add New Page
Comments0 Share

Editor Note: The proper title is: Ghost_2 but wikia restrictions do not allow _ in the title.

Virus.DOS.Ghost_2.5000 or Ghost_2 is a virus that runs on MS-DOS.

Details

Ghost_2 is a memory resident encrypted parasitic stealth-virus. It hooks INT 21h and 25h, and writes itself to the beginning of COM- and EXE-files that are executed, opened or closed. If the resulting COM-file length is out of segment (64K), the virus converts the file to EXE format.

Payload

While installing its TSR copy, if there is no free system memory, the virus displays the following message, and exits to DOS:

Swap file creation error at 0FAD:2DEC.

Program aborted.

The virus contains code that overwrites .PAS- and .CPP-files with the following text:

There is nothing in the world that I ever wanted more than to never feel

breaking apart all my programs again. The spiderman is always hungry

but this code is never executed.

"Marine DOS Virus " also has the same code.

In January, the virus corrupts the data on the hard drive, and then displays the following message (there may be any random digit instead of "000000000"), and "drops snow" on the screen:

Happy New Year !

Ghost 1.0 is terminating its work now. Please wait...

Write down this number : 0000000000 and pray for your data rescue.

The virus also contains the internal text strings:

COMMAND.COM

.COM.EXE.PAS.CPP

I feel so tired.

The way the rain comes down how it`s how I feel inside.

I`ve been living so long with my pictures of you

Remembering you standing quiet in the rain

Videos

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.