Ping Pong

aka Italian / Bouncing Ball / Vera Cruz

Ping Pong virus bouncing ball on a DOS screen
discovered
1988-03
origin
Turin, Italy
reported by
Politecnico di Torino
author
unknown
family
Ping Pong
size
512 bytes
platform
DOS boot sector
vector
Floppy boot sectors
payload
boot sector, visual
trigger
memory access in specific intervals

Payload

A small bouncing ball character travels around the screen, ricocheting off the borders, while the system continues to run normally.

In March 1988, the Politecnico di Torino in Turin, Italy noticed something unusual on their computer systems. A small dot bounced around their DOS screens at regular intervals, ricocheting off the invisible borders like a ball in an invisible court. No data corruption. No files encrypted. No ransom note. Just a pixel moving with purpose and rhythm.

This was Ping Pong, also known as Bouncing Ball or the Italian Bouncing Ball. It arrived at the tail end of the first generation of DOS boot sector viruses, but it carried a payload that was fundamentally different from everything that preceded it. While earlier viruses either damaged systems or hid silently, Ping Pong announced itself through pure aesthetics.

The bouncing ball was rendered through DOS interrupts, a direct manipulation of the video memory. The virus calculated trajectory, collision detection, and screen boundaries in 512 bytes of code. It had to be efficient, elegant, and mathematically precise. Every bounce had to read like intentional design rather than random pixel noise. The aesthetic was the message. The message was: someone is here, someone has control, someone is playing with your machine.

This was virus as performance art. The code worked like a Fluxus event translated into machine language. The payload had no destructive purpose. It did not delete files or corrupt boot records. The virus simply existed, proved its presence through visual meditation, and allowed the system to run normally. You could continue working while the ball bounced in the corner of your vision, a reminder that your machine was no longer wholly your own.

Boot sector viruses were already established as a threat category by 1988. But they were weapons. Ping Pong was different. It was graffiti. It was a tag on your hardware.

The timing mattered. This was 1988, the year the Morris Worm brought the nascent internet to its knees through sheer replication and system burden. The virus community was fractionalizing. Some writers saw malware as a tool for disruption and political action. Others saw it as pure code craft, as a domain where technical perfection and artistic expression could merge. Ping Pong lived in that second camp. It was written by someone who understood that the greatest power was not in destroying systems, but in making them do exactly what you wanted them to do, in plain sight, while the owner watched helplessly.

The aesthetic rating reflects what the security community eventually understood: this was one of the most visually recognizable virus payloads in history. Decades later, when people thought about viruses and retro computing, Ping Pong was the image that lived in collective memory. Not because it was dangerous, but because it was beautiful. It proved that malware could be an art form, that the most memorable infection was not the one that deleted everything, but the one that made you look.

The specimen endures because it asks a persistent question about intent. What was the purpose of this virus? Not destruction. Not profit. Not espionage. The only answer is: to exist, to prove the possibility, to be remembered.

Related specimens

Sources

last updated: 2026-04-12 :: curated by the_curator