MBR AND MONKEY VIRUS

Master Boot Record, MBR is also sometimes referred to as the master boot block and is the first sector of the computer hard disk drive used to determine what partition a computer will boot. The MBR tells the computer where to find and how to load the operating system. It also tells the computer how the hard drive is organized and provides information about the drive's partitions.
The master boot record is located on the first sector of the hard drive; it's the first program the computer runs after performing a memory check and looking for a bootable disk (if set in CMOS). The MBR is also susceptible to boot sector viruses that can corrupt or delete the MBR, which can leave the hard drive unusable and prevent the computer from booting up. A well-known MBR virus is the Stone Empire Monkey Virus.

MBR virus
A type of computer virus that modifies and/or infects the Master Boot Record, generally causing the computer to lose CD-ROM support and/or cause Microsoft Windows to run in compatibility mode.

VIRUS INFORMATION
Information about the Stoned Empire Monkey Virus
The Monkey virus was first discovered in Edmonton, Canada, in the year 1991. The virus spread quickly to USA, Australia and UK and is now one of the most common boot sector viruses.
As the name indicates, Monkey is a distant relative of Stoned. Its technical properties make it quite a remarkable virus, however the virus infects the Master Boot Records of hard disks and the DOS boot records of diskettes, just like Stoned. Monkey spreads only through diskettes.
Monkey does not let the original partition table remain in its proper place in the Master Boot Record, as Stoned does. Instead it moves the whole Master Boot Record to the hard disk's third sector, and replaces it with its own code. The hard disk is inaccessible after a diskette boot, since the operating system cannot find valid partition data in the Master Boot Record - attempts to use the hard disk result in the DOS error message Invalid drive specification.
When the computer is booted from the hard disk, the virus is executed first, and the hard disk can thereafter be used normally. The virus is not, therefore, easily noticeable, unless the computer is booted from a diskette.
The fact that Monkey encrypts the Master Boot Record besides relocating it on the disk makes the virus still more difficult to remove. The changes to the Master Boot Record cannot be detected while the virus is active, since it reroutes the BIOS-level disk calls through its own code. Upon inspection, the hard disk seems to be in its original shape.
Detecting the virus
It is difficult to spot the virus, since it does not activate in any way. A one-kilobyte reduction in DOS memory is the only obvious sign of its presence. The memory can be checked MS- DOS's CHKDSK and MEM programs. However, even if MEM reports that the computer has 639 kilobytes of basic memory instead of the more common 640 kilobytes, it does not necessarily mean that the computer is infected. In many computers, the BIOS allocates one kilobyte of basic memory for its own use.
The Monkey virus is quite compatible with different diskette types. It carries a table containing data for the most common diskettes. Using this table, the virus is able to move a diskette's original boot record and a part of its own code to a safe area on the diskette. Monkey does not recognize 2.88 megabyte ED diskettes; however, and partly overwrites their File Allocation Tables. Some revisions can be spotted by running fdisk and displaying the partition information; if you see % # or any other strange characters as the partition, label, etc, it's a good possibility that you may have the virus.
Information about removal
The relocation and encryption of the partition table render two often-used methods of removing a MBR Virus unviable. One of these is the MS-DOS command FDISK /MBR, capable of removing most viruses that infect Master Boot Records. The other is using a disk editor to restore the Master Boot Record back on the zero track. Although both of these procedures destroy the actual virus code, the computer cannot be booted from the hard disk afterwards.
There are six different ways to remove the Monkey virus:
1. Purchase a Virus protection utility and have it clean the Virus. While not all virus protection programs are capable of removing this virus, generally additional add-ons can be installed allowing the virus protection utility to remove the virus.
2. The original Master Boot Record and partition table can be restored from a backup taken before the infection. Such a backup can be made by using, for example, the MIRROR /PARTN command of MS-DOS
3. The hard disk can be repartitioned by using the FDISK program, after which the logical disks must be formatted. All data on the hard disk will consequently be lost, however.
4. The virus code can be overwritten by using FDISK /MBR, and the partition table restored manually. In this case, the partition values of the hard disk must be calculated and inserted in the partition table with the help of a disk editor. The method requires expert knowledge of the disk structure, and its success is doubtful. Usually, this causes the current partitions to double, causing more havoc.
5. It is possible to exploit Monkey's stealth capabilities by taking a copy of the zero track while the virus is active. Since the virus hides the changes it has made, this copy will actually contain the original Master Boot Record. This method is not recommended, because the diskettes used in the copying may well get infected.
6. The original zero track can be located, decrypted and moved back to its proper place. As a result, the hard disk is restored to its exact original state. Some virus scanners have this capability, and can successfully remove the virus.

Microsoft DOS fixmbr command
Quick links
About fixmbr
Availability
Syntax
Examples
About fixmbr
The fixmbr command is a recovery console command that creates a new boot record. Availability
The fixmbr command is a recovery console command that is available in the below Microsoft operating systems.
Windows 2000
Windows XP

Index

Category:
MS-DOS

Companies:
Microsoft

Related Pages:

Resolved

Were you able to locate the answer to your questions?
• Yes
• No


Syntax
Repairs the master boot record of the boot disk. The fixmbr command is only available when you are using the Recovery Console

fixmbr [device_name]
device_name The device (drive) on which you want to write a new master boot record. The name can be obtained from the output of the map command.

Examples
fixmbr \Device\HardDisk0
In the above example the boot record would be re-written for the first disk drive.


Microsoft DOS map command
Quick links
About map
Availability
Syntax
Examples
About map
The map command is a recovery console command that displays the physical device name of a drive letter. Availability
The map command is a recovery console command that is available in the below Microsoft operating systems.
Windows 2000
Windows XP

Index

Category:
MS-DOS

Companies:
Microsoft

Related Pages:

Resolved

Were you able to locate the answer to your questions?
• Yes
• No


Syntax
Displays a mapping of drive letters to physical device names. This information is useful when you run the fixboot and fixmbr commands. The map command is only available when you are using the Recovery Console
map [arc]
arc Instructs the map command to display Advanced RISC Computing (ARC) device names instead of device names.
Examples
map
Displays all of the device names.