0:43 AMMORE ABOUT COMPUTER VIRUSES
CLEANING THE VIRUS
To manually clean this virus follow the below steps:
the root of C drive by typing the following at a MS-DOS prompt:
Scripting in Outlook Express preferences or by visiting
Microsoft’s update page for an update to this hole.
W97M.Melissa.BG (Resumé Worm Virus)
While not expected to be as severe as the ILOVEYOU virus it has
already spread more the recent NEWLOVE virus.
normal.dot. If any of these files are ran the virus will first
send itself to all users in the computer’s e-mail address book
and copy the following files to the hard disk drive:
it will then release its destructive pay load attempting to
delete all drives A-Z.
Information about the NYB Virus
Boot records. After infected each time booting up the computer
will then load into high memory. Once in high memory the virus
will then have the capability of infecting all non-write
protected diskettes used in the computer. Once the diskette is
infected there is a 1/512 chance that the the virus activates.
When activated the virus will attempt to access a location on
the floppy drive that does not exist causing floppy drive
possibly causing physical damage to the floppy drive. Generally
this only occurs on older floppy disk drives.
cleaned utilizing a Virus Protection program. However an
alternate method of cleaning the virus is booting from a clean
write protected boot diskette with fdisk.exe on it. Boot from
the diskette and once at the A:\> type FDISK /MBR
non-destructive command. It is not recommended you run this
command if you have one of the following:
If infected with the Monkey B virus it is a possibility that the
hard disk drive information could be lost.
STONED EMPIRE MONKEY VIRUS
The Monkey virus was first discovered in Edmonton, Canada, in
the year 1991. The virus spread quickly to USA, Australia and UK
and is now one of the most common boot sector viruses.
Its technical properties make it quite a remarkable virus,
however the virus infects the Master Boot Records of hard disks
and the DOS boot records of diskettes, just like Stoned. Monkey
spreads only through diskettes.
proper place in the Master Boot Record, as Stoned does. Instead
it moves the whole Master Boot Record to the hard disk’s third
sector, and replaces it with its own code. The hard disk is
inaccessible after a diskette boot, since the operating system
cannot find valid partition data in the Master Boot Record -
attempts to use the hard disk result in the DOS error message
"Invalid drive specification”.
executed first, and the hard disk can thereafter be used
normally. The virus is not, therefore, easily noticeable, unless
the computer is booted from a diskette.
relocating it on the disk makes the virus still more difficult
to remove. The changes to the Master Boot Record cannot be
detected while the virus is active, since it reroutes the
BIOS-level disk calls through its own code. Upon inspection, the
hard disk seems to be in its original shape.
DETECTING THE VIRUS
It is difficult to spot the virus, since it does not activate in
any way. A one-kilobyte reduction in DOS memory is the only
obvious sign of its presence. The memory can be checked MS-
DOS’s CHKDSK and MEM programs. However, even if MEM reports that
the computer has 639 kilobytes of basic memory instead of the
more common 640 kilobytes, it does not necessarily mean that the
computer is infected. In many computers, the BIOS allocates one
kilobyte of basic memory for its own use.
types. It carries a table containing data for the most common
diskettes. Using this table, the virus is able to move a
diskette’s original boot record and a part of its own code to a
safe area on the diskette. Monkey does not recognize 2.88
megabyte ED diskettes, however, and partly overwrites their File
Allocation Tables. Some revisions are can be spotted by running
fdisk and displaying the partition information if you see % # or
any other strange characters as the partition , label, etc its a
good possibility that you may have the virus, to check this you
can run FDISK
INFORMATION ABOUT REMOVAL
The relocation and encryption of the partition table render two
often-used methods of removing a MBR Virus unviable. One of
these is the MS-DOS command FDISK /MBR, capable of removing most
viruses that infect Master Boot Records. The other is using a
disk editor to restore the Master Boot Record back on the zero
track. Although both of these procedures destroy the actual
virus code, the computer cannot be booted from the hard disk
There are six different ways to remove the Monkey virus:
the Virus, while not all virus protection programs are capable
of removing this virus generally additional add-ons can be
installed allowing the virus protection utility to remove the
be restored from a backup taken before the infection. Such a
backup can be made by using, for example, the MIRROR /PARTN
command of MS-DOS
program, after which the logical disks must be formatted. All
data on the hard disk will consequently be lost, however.
and the partition table restored manually. In this case, the
partition values of the hard disk must be calculated and
inserted in the partition table with the help of a disk editor.
The method requires expert knowledge of the disk structure, and
its success is doubtful. Usually this causes the current
partitions to double causing more havoc.
by taking a copy of the zero track while the virus is active.
Since the virus hides the changes it has made, this copy will
actually contain the original Master Boot Record. This method is
not recommendable, because the diskettes used in the copying may
well get infected.
moved back to its proper place. As a result, the hard disk is
restored to its exact original state. Some virus scanners have
this capability, and can successfully remove the virus.
|Total comments: 0|