When a computer is booted from an infected floppy diskette, Monkey infects the master boot record on the computer's hard drive. Upon infection, Monkey encrypts the master boot record and moves it to sector 3 on the hard drive. The next time the computer is booted, the virus becomes memory resident and infects all the floppy diskettes accessed thereafter. To avoid detection when accessed, the virus reveals a decrypted image of the master boot record. This feature makes the most often-used disinfection methods unworkable.
Infection occurs whenever a file is opened or closed.
This virus contains no deliberately destructive code, but one of its variants attempts to delete files. This virus has many variants, none of which are known to carry destructive code. If infecting a floppy diskette, Ripper copies both its virus code and the original boot sector to the last two sectors on the diskette. If infecting a hard drive, Ripper copies itself to cylinder 0, head 0, sector 8 and then copies the original partition table to cylinder 0, head 0, sector 9. When the virus is accessed, it returns an image of the original boot sector to avoid detection.