In October 1989, some PC users received a nasty visitor in the form of the Ghostball virus, malware with double the tricks and none of the treats. Discovered by Icelandic virus expert Fridrik Skulason, Ghostball was one of the first known multipartite viruses.
Unlike a typical virus, which attacks the system, program files, or the boot sector, a multipartite virus such as Ghostball targets the boot sector and program files simultaneously. So, when a user turns on his or her computer, the virus is triggered by the boot sector, and then program files launch destructive payloads.
Ghostball placed a viral code on a machine’s boot sector. In addition, whenever an infected .COM file was launched, the virus scanned the machine for other .COM files to infect. The malware combined code from two previous viruses. Its .COM file attack code was based on the Vienna virus, while its code targeting boot sectors was inspired by the Ping Pong virus.
The primary symptom of a Ghostball attack was a specific increase in file size, as infected files grew by 2,351 bytes. An infected file might also display a message reading “GhostBalls, Product of Iceland Copyright © 1989, 4418 and 5F10 MS DOS 3.2.”
The only cure for Ghostball? Remove all infected .COM files from a machine.
Tech Time Warp is a weekly feature that looks back at interesting moments and milestones in tech history.
Photo: Lemon Tree Images/Shutterstock