Fandom

Malware Wiki

Ghostball

1,326pages on
this wiki
Add New Page
Comments0 Share

Virus.Multi.Ghostball.2351 or Ghostball is a multipartite virus on DOS, it is one of the first multiparite viruses ever discovered. It is actually a variant of Vienna that drops a copy of the PingPong virus on diskettes.

BehaviorEdit

When an infected .com file is run, Ghostball searches for another .com file to infect in the current directory. It checks if the "seconds" field of the file's timestamp is set to 62, which means the file is already infected. If it is not, Ghostball will infect it. If the file has the read-only attribute set, the virus will remove it and replace it when it has completed the infection. It adds a JMP instruction to the beginning of the file and appends its 2,351 bytes to it. Ghostball then tries to drop a copy of the PingPong virus onto the boot sector of drive A:.

VariantsEdit

Ghostball itself is sometimes considered a variant of the Vienna virus. It is very similar to the original Vienna, especially with regard to it changing the seconds field on a file's timestamp to the impossible value of 62. Ghostball itself has few variants of its own, none of them any different from the original.

NameEdit

The virus gets its name from the text string contained in the virus: GhostBall, Product of Iceland. Some antivirus products may shorten the name to "Ghost". Others refer to it as "Ghostorb", as "balls" refer to testicles in American and some other dialects of English, and may be considered offensive.

SourcesEdit

Fridrik Skulason. University of Iceland, Computing Services. Reports collected and collated by PC-Virus Index: Ghostball. 1989.11.02

F-Secure Antivirus, F-Secure Virus Descriptions : GhostBall.

Kaspersky Lab Virus.Multi.Ghostball.2351.a.

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.