| Ghost | |
|---|---|
| Type | Boot sector virus |
| Creator | Pash |
| Date Discovered | 1988-11-20 |
| Place of Origin | Doncaster, England |
| Source Language | |
| Platform | Atari ST |
| Infection Length | 1 boot sector |
| Reported Costs | |
Ghost is a virus for the Atari ST. For the Atari ST platform, it produced quite a large number of variants, mostly in the late 1980s, but some appearing as late as 1997. Many are simply broken copies of the original, which do not replicate or deliver a payload properly.
Behavior
When a disk infected with Ghost is booted, it becomes memory resident by hooking Resvector and Hdv_bpb. The virus is reset-resistent so it will stay in memory as long as the system is not totally shut off. It infects disks as they are inserted and accessed.
After every 10 infections, it will reverse the y directions (up and down) for the mouse.
Variants
The Ghost virus produced a few variants, none as widespread as the original. Ghost.B, AKA Mutant Ghost, discovered on the 15th of June 1989, has a few damaged bytes and can crash easily. Ghost.C, discovered on the 9th of March in 1990 also has a few errors, causing the mouse inversion routine to malfunction, however it copies itself normally. Ghost.D, .E, and .F are corrupted and similar to Ghost.B, and may not spread or deliver the payload.
Ghost.Toi was discovered on the 10th of November in 1990. This variant triggers the payload routine after five copies have been made. It also changes some random bits in memory, which can cause unpredictable behavior and crashes. It originated in Denver, Colorado in the US, and the TOI programming group is believed to be responsible for its creation.
Origin and Effects
Ghost was widespread in Europe, particularly England, where it originated. It also appeared in the Netherlands, Sweden, and West Germany. Because of its payload, it was also given the names the "Mouse Virus" and "Inversion virus".
Other Facts
An Antighost virus appeared in France in 1992. This is a nematode that attacks Ghost.
Sources
Richard Karsmakers. THE KNOWN VIRUSES ON ATARI TOS COMPUTERS AND THEIR SYMPTOMS.