Type Multipartite virus
Date Discovered 1989.10
Place of Origin Iceland
Source Language Assembly
Platform DOS
File Type(s) .com
Infection Length 2,351 bytes
Reported Costs

Ghostballs is considered the first multipartite virus. It is actually a variant of Vienna that drops a copy of the Pingpong virus on diskettes.


When an infected .com file is run, Ghostballs searches for another .com file to infect in the current directory. It checks if the "seconds" field of the file's timestamp is set to 62, which means the file is already infected. If it is not, Ghostballs will infect it. If the file has the read-only attribute set, the virus will remove it and replace it when it has completed the infection. It adds a JMP instruction to the beginning of the file and appends its 2,351 bytes to it. Ghostballs then tries to drop a copy of the [[PingPong]] virus onto the boot sector of drive A:.


Ghostballs itself is sometimes considered a variant of the Vienna virus. It is very similar to the original Vienna, especially with regard to it changing the seconds field on a file's timestamp to the impossible value of 62. Ghostballs itself has few variants of its own, none of them any different from the original.


The virus gets its name from the text string contained in the virus: GhostBalls, Product of Iceland. Some antivirus products may shorten the name to "Ghost". Others refer to it as "Ghostorb", as "balls" refer to testicles in American and some other dialects of English, and may be considered offensive.

Other Facts

Ghostballs is one of two virus families to come from Iceland. The other is the .exe-infecting Icelandic.


Fridrik Skulason. University of Iceland, Computing Services. Reports collected and collated by PC-Virus Index: Ghostballs. 1989.11.02

F-Secure Antivirus, F-Secure Virus Descriptions : GhostBalls.

Kaspersky Lab Virus.Multi.Ghostball.2351.a.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License