Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!ux1.cso.uiuc.edu!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: frisk@RHI.HI.IS (Fridrik Skulason) Newsgroups: comp.virus Subject: A new virus from Iceland (PC) Message-ID: <0008.8910271923.AA15849@ge.sei.cmu.edu> Date: 27 Oct 89 17:08:16 GMT Sender: Virus Discussion List Lines: 27 Approved: krvw@sei.cmu.edu New virus - first report...... I have just obtained a copy of a new virus, which seems to be of Icelandic origin, at least a text string inside the virus contains the message "Ghostballs, Product of Iceland" The virus is a combination of the Vienna virus and the Ping-Pong virus. It infects .COM files, just like "Vienna", but at the same time it tries to place a copy of Ping-Pong on the boot sector in drive A: This copy of Ping-Pong has, however, been heavily patched. Actually it can not be called a virus, since it does not replicate - large parts of the code have been replaced with NOP instructions. The "Vienna" part seems to have been only slightly modified, but I have not yet had time to disassemble it. Infected files grow by 2351 bytes. This virus was discovered when a person I had given an utility to remove the Ping-Pong virus called back to complain that it did not work, the virus would simply reappear on all diskettes, even if he booted from a "clean" diskette. The reason was that most of his .COM files on the hard disk had been infected. One final note - the patched Ping-Pong virus seems based on the '286 variant reported recently.