
             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************
 
 
==== Computer Virus Catalog 1.2: "GhostBalls" Virus (Nov 2, 1989) ====
 
Entry...............: "GhostBalls"
Alias(es)...........: Ghost
Virus Strain........: Vienna (Dos-62)
Virus detected when.: Oct. '89
              where.: Iceland
Classification......: .COM file infecting virus/ Extending/ Direct/
                      Non-Resident

Length of Virus.....: 2351 bytes added to file
 
-------------------- Preconditions --------------------------------

Operating System(s).: MS-DOS
Version/Release.....: 2.0 or higher
Computer model(s)...: IBM PC,XT,AT and compatibles
 
-------------------- Attributes ----------------------------------

Easy Identification.: .COM files: "seconds" field of the timestamp
                      changed to 62, as in the original Vienna virus.
                      Infected files end in a block of 512 zero bytes.

Type of infection...: Extends .COM files. Adds 2531 bytes to the end
                      of the file and places a JMP instruction at the
                      beginning.

                      When an infected program is run, it will search
                      for a program to infect, and also try to place a
                      modified copy of the Ping-Pong virus on the boot
                      sector in drive A.

                      The virus will remove the Read-Only attribute
                      from programs in order to infect them.  It is
                      replaced afterwards.

Infection Trigger...: One .COM file in the current directory with the
                      "seconds" field not equal to 62 will be infected
                      each time an infected program is run.

Storage media affected: Boot sectors on diskettes.

Interrupts hooked...:

Damage..............: .COM files and boot sectors modified. No
                      permanent damage.

Damage Trigger......:

Particularities.....: The destruction of 1 program in 8 in the
                      original Vienna virus has been disabled.  The
                      Ping-Pong copy placed on drive A:  has been
                      modified in two ways:  It will work on a '286
                      machine but has been patched so it will not
                      infect other diskettes.  Virus contains the text
                      string:
 
                                "GhostBalls, Product of Iceland"

Similarities........:
 

--------------------- Agents ----------------------------------------

Countermeasures.....: Any program that identifies the Vienna virus by
                      using signatures should be able to find infected
                      files.  VIRSCAN (46) will identify infected
                      files.  F-FCHK (by the author of this article)
                      will identify infected files and remove the
                      infection.

Countermeasures successful:

Standard means......:
 
-------------------- Acknowledgement ----------------------------

Location............: University of Iceland/Computing Services
Classification by...: Fridrik Skulason  (frisk@rhi.hi.is)
Documentation by....: Fridrik Skulason
Date................: November 2, 1989
Information Source..:


======================= End of GhostBalls =========================


  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++








