Virus Hoax: Ghost.exeName: Ghost
This is a widespread false alarm on a demonstration program. There is no virus or trojan by this name.
GHOST.EXE is a Windows program which displays a graveyard and a set of ghosts in a window. On Friday the 13th, the title of the screen was changed to 'Happy Friday the 13th!' and the ghosts started flying around the Windows desktop. This program was analysed and found harmless.
This kind of hoax is different from the traditional e-mail chain letter hoaxes, such as Good Times, since several innocent programs have received lots of publicity lately as they have been accused of being trojans or viruses.
Naturally, whenever any program is declared clean, there's a risk that somebody will take the file and infect it - since people will now trust it. To overcome this problem, you can verify the files against the 32-bit CRC's of the confirmed clean versions.
The confirmed-clean versions of this program have the following CRCs as displayed by PKUNZIP:
Length Method Size Ratio Date Time CRC-32 Attr Name ------ ------ ----- ----- ---- ---- -------- ---- ---- 28096 DeflatN 14145 50% 30-10-96 13:20 5dce8738 --w- GHOST.EXE 28064 DeflatN 14142 50% 13-11-96 13:45 a6839c30 --w- GHOST2.EXE 28065 DeflatX 14121 50% 11-22-96 12:11 f47d5cbd --w- GHOST3.EXE ------ ------ --- -------[Analysis: Mikko Hypponen, Data Fellows Ltd's F-PROT Pro Support]