About: Ghostball   Sponge Permalink

An Entity of Type : dbkwik:resource/uazuHg3wEfJ5Uid5iYR3Jw==, within Data Space : dbkwik.org associated with source dataset(s)

When an infected .com file is run, Ghostball searches for another .com file to infect in the current directory. It checks if the "seconds" field of the file's timestamp is set to 62, which means the file is already infected. If it is not, Ghostball will infect it. If the file has the read-only attribute set, the virus will remove it and replace it when it has completed the infection. It adds a JMP instruction to the beginning of the file and appends its 2,351 bytes to it. Ghostball then tries to drop a copy of the PingPong virus onto the boot sector of drive A:.

AttributesValues
rdf:type
rdfs:label
  • Ghostball
rdfs:comment
  • When an infected .com file is run, Ghostball searches for another .com file to infect in the current directory. It checks if the "seconds" field of the file's timestamp is set to 62, which means the file is already infected. If it is not, Ghostball will infect it. If the file has the read-only attribute set, the virus will remove it and replace it when it has completed the infection. It adds a JMP instruction to the beginning of the file and appends its 2,351 bytes to it. Ghostball then tries to drop a copy of the PingPong virus onto the boot sector of drive A:.
dcterms:subject
dbkwik:malware/pro...iPageUsesTemplate
Date
  • October, 1989
Origin
  • Iceland
Platform
  • DOS
Name
  • Ghostballs
Type
  • Virus
pl
  • Assembly
filetype
  • .COM
AKA
  • Virus.Multi.Ghostball.2351
Creator
  • Unknown
Size
  • 2351(xsd:integer)
abstract
  • When an infected .com file is run, Ghostball searches for another .com file to infect in the current directory. It checks if the "seconds" field of the file's timestamp is set to 62, which means the file is already infected. If it is not, Ghostball will infect it. If the file has the read-only attribute set, the virus will remove it and replace it when it has completed the infection. It adds a JMP instruction to the beginning of the file and appends its 2,351 bytes to it. Ghostball then tries to drop a copy of the PingPong virus onto the boot sector of drive A:.
Alternative Linked Data Views: ODE     Raw Data in: CXML | CSV | RDF ( N-Triples N3/Turtle JSON XML ) | OData ( Atom JSON ) | Microdata ( JSON HTML) | JSON-LD    About   
This material is Open Knowledge   W3C Semantic Web Technology [RDF Data] Valid XHTML + RDFa
OpenLink Virtuoso version 07.20.3217, on Linux (x86_64-pc-linux-gnu), Standard Edition
Data on this page belongs to its respective rights holders.
Virtuoso Faceted Browser Copyright © 2009-2012 OpenLink Software