frisk@RHI.HI.IS (Fridrik Skulason) (10/28/89)
New virus - first report......
I have just obtained a copy of a new virus, which seems to be of Icelandic
origin, at least a text string inside the virus contains the message
"Ghostballs, Product of Iceland"
The virus is a combination of the Vienna virus and the Ping-Pong virus.
It infects .COM files, just like "Vienna", but at the same time it
tries to place a copy of Ping-Pong on the boot sector in drive A: This
copy of Ping-Pong has, however, been heavily patched. Actually it can
not be called a virus, since it does not replicate - large parts of
the code have been replaced with NOP instructions. The "Vienna" part
seems to have been only slightly modified, but I have not yet had time
to disassemble it.
Infected files grow by 2351 bytes.
This virus was discovered when a person I had given an utility to
remove the Ping-Pong virus called back to complain that it did not
work, the virus would simply reappear on all diskettes, even if he
booted from a "clean" diskette. The reason was that most of his .COM
files on the hard disk had been infected.
One final note - the patched Ping-Pong virus seems based on the '286
variant reported recently.