The relocation and encryption of the partition table renders two often-used disinfection procedures unusable:
1. The MS-DOS command FDISK /MBR, which is capable of removing most viruses that infect Master Boot Records.
2. Using a disk editor to restore the Master Boot Record back on the zero track.
Although both of these procedures destroy the actual virus code, the computer cannot be booted from the hard disk afterwards.
There are five different ways to remove the Monkey virus:
The original Master Boot Record and partition table can be restored from a backup taken before the infection. Such a backup can be made by using, for example, the MIRROR /PARTN command of MS-DOS 5.
The hard disk can be repartitioned by using the FDISK program, after which the logical disks must be formatted. All data on the hard disk will consequently be lost, however.
The virus code can be overwritten by using FDISK/MBR, and the partition table restored manually. In this case, the partition values of the hard disk must be calculated and inserted in the partition table with the help of a disk editor. The method requires expert knowledge of the disk structure, and its success is doubtful.
It is possible to exploit Monkey's stealth capabilities by taking a copy of the zero track while the virus is active. Since the virus hides the changes it has made, this copy will actually contain the original Master Boot Record. This method is not recommendable, because the diskettes used in the copying may well get infected.
The original zero track can be located, decrypted and moved back to its proper place. As a result, the hard disk is restored to its exact original state. F-Secure anti-virus products use this method to disinfect the Monkey virus.
Note: When disinfecting Monkey with F-PROT after a floppy boot, use the command F-PROT /HARD /DISINF instead of using F-PROT C:, or just run F-PROT in interactive mode and scan 'Hard disk' with disinfection option on. After disinfection, error message 'No hard disk found' is normal: just reboot after the disinfection is done and you should see your hard drive again.