Ping-Pong virus
Encyclopedia
The Ping-Pong virus is a boot sector virus discovered on March 1, 1988 at the University of Turin
in Italy
. It was likely the most common and best known boot sector virus until outnumbered by the Stoned
virus.
bad cluster
(the last one on the disk, used by the virus to store the original boot sector
) to most disk checking programs. Due to being labelled as bad cluster, MS-DOS
will avoid overwriting it. It infects disks on every active drive and will even infect non-bootable partition
s on the hard disk. Upon infection, the virus becomes memory resident.
(the ASCII
bullet character "•") and graphical mode. No serious damage is occurred by the virus except on '286 machines (and also V20, '386 and '486), which would sometimes crash during the ball's appearance on the screen. The cause of this crash is the "MOV
CS,AX" instruction, which only exists on '88 and '86 processors. For this reason, users of machines at risk were advised to save their work and reboot, since this is the only way to temporarily get rid of the virus.
The original Ping Pong virus (Ping-Pong.A) only infects floppy disk
s. Later variants of this virus such as Ping-Pong.B and Ping-Pong.C also infect the hard disk boot sector as well. Whilst the virus is active, one cannot replace the boot sector—it either prevents writing to it or it immediately re-infects it.
Ping-Pong.A is extinct but the hard-disk variants can still appear.
University of Turin
The University of Turin is a university in the city of Turin in the Piedmont region of north-western Italy...
in Italy
Italy
Italy , officially the Italian Republic languages]] under the European Charter for Regional or Minority Languages. In each of these, Italy's official name is as follows:;;;;;;;;), is a unitary parliamentary republic in South-Central Europe. To the north it borders France, Switzerland, Austria and...
. It was likely the most common and best known boot sector virus until outnumbered by the Stoned
Stoned (computer virus)
Stoned is the name of a boot sector computer virus created in 1987.Notable for being an early boot sector virus, it was thought to have been written by a university student in Wellington, New Zealand - and by 1989 it had spread widely in New Zealand and Australia...
virus.
Replication method
Computers could be contaminated by an infected diskette, showing up as a 1 KBKilobyte
The kilobyte is a multiple of the unit byte for digital information. Although the prefix kilo- means 1000, the term kilobyte and symbol KB have historically been used to refer to either 1024 bytes or 1000 bytes, dependent upon context, in the fields of computer science and information...
bad cluster
Cluster (file system)
In computer file systems, a cluster or allocation unit is the unit of disk space allocation for files and directories. To reduce the overhead of managing on-disk data structures, the filesystem does not allocate individual disk sectors, but contiguous groups of sectors, called clusters.On a disk...
(the last one on the disk, used by the virus to store the original boot sector
Boot sector
A boot sector or boot block is a region of a hard disk, floppy disk, optical disc, or other data storage device that contains machine code to be loaded into random-access memory by a computer system's built-in firmware...
) to most disk checking programs. Due to being labelled as bad cluster, MS-DOS
MS-DOS
MS-DOS is an operating system for x86-based personal computers. It was the most commonly used member of the DOS family of operating systems, and was the main operating system for IBM PC compatible personal computers during the 1980s to the mid 1990s, until it was gradually superseded by operating...
will avoid overwriting it. It infects disks on every active drive and will even infect non-bootable partition
Disk partitioning
Disk partitioning is the act of dividing a hard disk drive into multiple logical storage units referred to as partitions, to treat one physical disk drive as if it were multiple disks. Partitions are also termed "slices" for operating systems based on BSD, Solaris or GNU Hurd...
s on the hard disk. Upon infection, the virus becomes memory resident.
Effect
The virus would become active if a disk access is made exactly on the half hour and start to show a small "ball" bouncing around the screen in both text modeText mode
Text mode is a kind of computer display mode in which the content of the screen is internally represented in terms of characters rather than individual pixels. Typically, the screen consists of a uniform rectangular grid of character cells, each of which contains one of the characters of a...
(the ASCII
ASCII
The American Standard Code for Information Interchange is a character-encoding scheme based on the ordering of the English alphabet. ASCII codes represent text in computers, communications equipment, and other devices that use text...
bullet character "•") and graphical mode. No serious damage is occurred by the virus except on '286 machines (and also V20, '386 and '486), which would sometimes crash during the ball's appearance on the screen. The cause of this crash is the "MOV
MOV (x86 instruction)
In the x86 assembly language, the MOV instruction is a mnemonic for the copying of data from one location to another. The x86 assembly language has a number of different move instructions...
CS,AX" instruction, which only exists on '88 and '86 processors. For this reason, users of machines at risk were advised to save their work and reboot, since this is the only way to temporarily get rid of the virus.
The original Ping Pong virus (Ping-Pong.A) only infects floppy disk
Floppy disk
A floppy disk is a disk storage medium composed of a disk of thin and flexible magnetic storage medium, sealed in a rectangular plastic carrier lined with fabric that removes dust particles...
s. Later variants of this virus such as Ping-Pong.B and Ping-Pong.C also infect the hard disk boot sector as well. Whilst the virus is active, one cannot replace the boot sector—it either prevents writing to it or it immediately re-infects it.
Ping-Pong.A is extinct but the hard-disk variants can still appear.