Ghostball Virus

What Does Ghostball Virus Mean?

The Ghostball virus is the first known multipartite virus. It is a file-infecting virus that is capable of infecting COM files and disk boot sectors.


The Ghostball virus was written based on code from two different viruses. The code that infects the COM files is inspired by a modified version of the Vienna virus. The boot sector infector portion of the virus is derived from the Ping Pong virus. Ghostballs was discovered by Fridrik Skulason of Iceland in 1989.

Techopedia Explains Ghostball Virus

Ghostball infects generic COM files and disk boot sectors of a computer. The virus targets the disk boot sector by placing a viral code on it. The Ghostball virus is activated whenever an infected file is executed. Then, the virus actively searches the directory for other uninfected COM files to infect. The Ghostball virus can be removed by deleting all infected COM files.

The symptoms of a Ghostball virus attack on a computer include an increase in the size of infected files by 2,351 bytes. The symptoms are similar to those produced by the Ping Pong virus, which includes random file corruption and the Ping Pong virus’s infamous bouncing ball effect. Ghostball-infected files may also display the following content:

GhostBalls, Product of Iceland Copyright © 1989, 4418 and 5F10 MSDOS 3.2”.


Related Terms

Margaret Rouse
Technology Expert

Margaret is an award-winning technical writer and teacher known for her ability to explain complex technical subjects to a non-technical business audience. Over the past twenty years, her IT definitions have been published by Que in an encyclopedia of technology terms and cited in articles by the New York Times, Time Magazine, USA Today, ZDNet, PC Magazine, and Discovery Magazine. She joined Techopedia in 2011. Margaret's idea of a fun day is helping IT and business professionals learn to speak each other’s highly specialized languages.