Macro Virus Table - Defense Technical Information Center

PC
Damage: Corrupts boot
sector
Interferes with a running
application.
Corrupts a program or overlay
files.
MS-DOS/PC-DOS Computer Viruses
Interferes with a running application.
Corrupts a program or overlay files.
Size: 2351 See Also:
Notes: Variant of Vienna that puts a patched copy of the Ping Pong virus in the boot of drive A.
It may infect floppy and hard disk boot sectors, sources differ on this.
It contains the following text strings:
GhostBalls, Product of Iceland
Copyright (c) 1989, 4418 and 5F19 Bouncing ball on screen. COM files:
"seconds" field of the timestamp changed to 62, as in the original Vienna virus. Infected files end
in a block of 512 zero bytes. The string "GhostBalls, Product of Iceland" in the virus.
Name: Ginger
Aliases: Ginger, Peanut, Gingerbread man, Rainbow Type: Multipartite.
Disk Location: EXE application.
COM application.
MBR Hard disk master boot record-partition
table.
Features: Corrupts hard disk partition table
Damage: Corrupts hard disk
partition table
Size: See Also:
Notes: This is a family of stealth multipartite fast infecting viruses originating from Australia.
There are at least five variants, sizes ranging from 2 to 3 kB.
One of the variants generates an endless loop to the partition table, making PC crash when it tries
to boot from a clean floppy which has MS-DOS v4.0 - 7.0. To overcome this, use PC-DOS 7.0,
MS-DOS 3.3x or a non-DOS boot floppy.
Note: Rainbow is also an alias for the WordMacro/Colors virus.
Name: Girafe
Aliases: Girafe, Trident, TPE Type:
Disk Location: Features:
Damage: Size: See Also: TPE
Notes: Contains the internal string "[ MK / Trident]"
v6-123: TPE.1_0.Girafe Disables Ctrl-Break checking.
Name: Gliss
Aliases: Gliss Type: Program.
Disk Location: COM application. Features: Unknown, not analyzed yet.
Damage: Unknown, not
analyzed yet.
Size: 1247 See Also:
Notes: Demonstration virus that announces its infections of programs.
196 CIAC Computer Virus Information Update May 21, 1998