THE HALL OF GREAT GURUS

CLEANING THE VIRUS

To manually clean this virus follow the below steps:
Delete the following files if present:
C:\Windows\kak.htm
C:\Windows\System\*.hta
C:\Windows\Start Menu\Programs\Startup\kak.hta
C:\Windows\Menu Demarrer\Programmers\Demarrage\kak.hta
Rename the following files:
Before renaming the following, ensure that ae.kak is present at

the root of C drive by typing the following at a MS-DOS prompt:
cd\
dir ae.kak
If present type:
del autoexec.bat
ren ae.kak autoexec.bat
The hole within Outlook Express can be fixed by disabling Active

Scripting in Outlook Express preferences or by visiting

Microsoft’s update page for an update to this hole.

RÉSUMÉ Virus

W97M.Melissa.BG (Resumé Worm Virus)
The Resumé Virus was announced to be wild Friday May 26 2000.

While not expected to be as severe as the ILOVEYOU virus it has

already spread more the recent NEWLOVE virus.
The e-mail will contain the subject:
Resume – Janet Simons
Upon opening the e-mail the message body will contain:
To: Director of Sales/Marketing,
Attached is my resume with a list of
references contained within. Please
feel free to call or email me if you
have any further questions regarding
my experience. I am looking forward
to hearing from you.
Sincerely,
Janet Simons.
Included in the document contains resume.doc, explorer.doc or

normal.dot. If any of these files are ran the virus will first

send itself to all users in the computer’s e-mail address book

and copy the following files to the hard disk drive:
C:\Data\Normal.dot
C:\Windows\Start Menu\ Programs\Startup\Explorer.doc
Once these files have been copied successfully onto the computer

it will then release its destructive pay load attempting to

delete all drives A-Z.

NYB Virus

Information about the NYB Virus
SIZE: 512 bytes.
INFECTS: Floppy Boot sectors and Master Boot Records.
WHAT IT DOES: Simple virus which infects diskettes and Master

Boot records. After infected each time booting up the computer

will then load into high memory. Once in high memory the virus

will then have the capability of infecting all non-write

protected diskettes used in the computer. Once the diskette is

infected there is a 1/512 chance that the the virus activates.

When activated the virus will attempt to access a location on

the floppy drive that does not exist causing floppy drive

possibly causing physical damage to the floppy drive. Generally

this only occurs on older floppy disk drives.
METHODS OF CLEANING VIRUS: It is recommended that all viruses be

cleaned utilizing a Virus Protection program. However an

alternate method of cleaning the virus is booting from a clean

write protected boot diskette with fdisk.exe on it. Boot from

the diskette and once at the A:\> type FDISK /MBR
ADDITIONAL INFORMATION: The FDISK /MBR command by default is a

non-destructive command. It is not recommended you run this

command if you have one of the following:
Any type of advanced security program.
Boot manager such as partition magic.
You believe your computer is infected with the Monkey B virus.

If infected with the Monkey B virus it is a possibility that the

hard disk drive information could be lost.

STONED EMPIRE MONKEY VIRUS
ABOUT STONED EMPIRE MONKEY VIRUS

The Monkey virus was first discovered in Edmonton, Canada, in

the year 1991. The virus spread quickly to USA, Australia and UK

and is now one of the most common boot sector viruses.
As the name indicates, Monkey is a distant relative of Stoned.

Its technical properties make it quite a remarkable virus,

however the virus infects the Master Boot Records of hard disks

and the DOS boot records of diskettes, just like Stoned. Monkey

spreads only through diskettes.
Monkey does not let the original partition table remain in its

proper place in the Master Boot Record, as Stoned does. Instead

it moves the whole Master Boot Record to the hard disk’s third

sector, and replaces it with its own code. The hard disk is

inaccessible after a diskette boot, since the operating system

cannot find valid partition data in the Master Boot Record -

attempts to use the hard disk result in the DOS error message

"Invalid drive specification”.
When the computer is booted from the hard disk, the virus is

executed first, and the hard disk can thereafter be used

normally. The virus is not, therefore, easily noticeable, unless

the computer is booted from a diskette.
The fact that Monkey encrypts the Master Boot Record besides

relocating it on the disk makes the virus still more difficult

to remove. The changes to the Master Boot Record cannot be

detected while the virus is active, since it reroutes the

BIOS-level disk calls through its own code. Upon inspection, the

hard disk seems to be in its original shape.

DETECTING THE VIRUS

It is difficult to spot the virus, since it does not activate in

any way. A one-kilobyte reduction in DOS memory is the only

obvious sign of its presence. The memory can be checked MS-

DOS’s CHKDSK and MEM programs. However, even if MEM reports that

the computer has 639 kilobytes of basic memory instead of the

more common 640 kilobytes, it does not necessarily mean that the

computer is infected. In many computers, the BIOS allocates one

kilobyte of basic memory for its own use.
The Monkey virus is quite compatible with different diskette

types. It carries a table containing data for the most common

diskettes. Using this table, the virus is able to move a

diskette’s original boot record and a part of its own code to a

safe area on the diskette. Monkey does not recognize 2.88

megabyte ED diskettes, however, and partly overwrites their File

Allocation Tables. Some revisions are can be spotted by running

fdisk and displaying the partition information if you see % # or

any other strange characters as the partition , label, etc its a

good possibility that you may have the virus, to check this you

can run FDISK

INFORMATION ABOUT REMOVAL

The relocation and encryption of the partition table render two

often-used methods of removing a MBR Virus unviable. One of

these is the MS-DOS command FDISK /MBR, capable of removing most

viruses that infect Master Boot Records. The other is using a

disk editor to restore the Master Boot Record back on the zero

track. Although both of these procedures destroy the actual

virus code, the computer cannot be booted from the hard disk

afterwards.

There are six different ways to remove the Monkey virus:
1.   Purchase a Virus protection utility and have it clean

the Virus, while not all virus protection programs are capable

of removing this virus generally additional add-ons can be

installed allowing the virus protection utility to remove the

virus.
2.   The original Master Boot Record and partition table can

be restored from a backup taken before the infection. Such a

backup can be made by using, for example, the MIRROR /PARTN

command of MS-DOS
3.   The hard disk can be repartitioned by using the FDISK

program, after which the logical disks must be formatted. All

data on the hard disk will consequently be lost, however.
4.   The virus code can be overwritten by using FDISK /MBR,

and the partition table restored manually. In this case, the

partition values of the hard disk must be calculated and

inserted in the partition table with the help of a disk editor.

The method requires expert knowledge of the disk structure, and

its success is doubtful. Usually this causes the current

partitions to double causing more havoc.
5.   It is possible to exploit Monkey’s stealth capabilities

by taking a copy of the zero track while the virus is active.

Since the virus hides the changes it has made, this copy will

actually contain the original Master Boot Record. This method is

not recommendable, because the diskettes used in the copying may

well get infected.
6.   The original zero track can be located, decrypted and

moved back to its proper place. As a result, the hard disk is

restored to its exact original state. Some virus scanners have

this capability, and can successfully remove the virus.