Two samples were sent for analysis, differing in both content and the location of various sections of code. However, they are undoubtedly variants of the same virus, presumably written by the same individual. Monkey has no trigger routine, but can cause serious damage, due to the method of operation. Its name is contained at the end of the code in both samples, hidden by a simple encryption routine. Installation and Operation This virus infects the Master Boot Sector of fixed disks when they are booted from an infected diskette.
Processing begins by initialising the various code parameters needed.
The virus' Int 13h interception routine is then hooked into the system, and a segment address is calculated, relocating the virus code to the top of memory. Next, the MBS of the first fixed drive is read into memory. Should signs of infection be found, the virus identifies where the original MBS is stored, reads it into memory, decrypts it, and returns control to the MBS, enabling booting to continue. Once hooked, the virus intercepts requests to the disk access services. Requests for read access to sector 1 or 2, head 0 on fixed disks or head 1 on floppies are routed through a routine which completes the request and examines the sector to see whether it is infected.