1. Computing

A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | Encyclopedia Home
Also see: Hoax Encyclopedia | Repair Center | News Briefs | Glossary | Infected Attachments | Prevention Center

Related Links

F-Secure description
WildList report
Manual Removal Help

Monkey
Aliases: Empire.Monkey, Stoned.Monkey, Empire.Stoned.Monkey

According to reports from F-Secure, Monkey exhibits the following characteristics:

Type: MBR/Boot sector stealth virus
Systems Affected: IBM-compatible PC's
Payload: Prevents booting from floppy disk. Improper removal renders hard drive unbootable.
ITW: Yes
Origin: Edmonton, Canada
Description: The Monkey virus spreads only through floppy disks, infecting the Master Boot Record (MBR) of hard drives and the boot records of floppies. Monkey moves the MBR from the first sector to the third, replacing it with its own code. When booting normally, i.e. from the local hard drive, the virus is activated first and everything will appear normal to the user. However, if booting from a floppy, users will be presented with the message "Invalid drive specification". This occurs due to the moved partition - an action that renders the hard drive inaccessible when booting from floppy.
Users should never use FDISK /MBR or a disk editor to attempt restoration of the drive. Doing so will render the hard disk unbootable. Instead, it is recommended you use antivirus software to effectively remove the infection.
What to look for: "Invalid drive specification" error message when booting from floppy disk.
How to prevent it: Do not leave floppies in the drive. If a floppy happens to be infected with the Monkey virus, it will spread to the hard drive on the next reboot. Consider changing CMOS settings to boot first from the local drive. Check out the Tips for Safety and the Boot Sector/MBR for more information.

©2014 About.com. All rights reserved.