Virus

Empire.Monkey.B

Analysis

  • Viral body is 512 bytes
  • Virus infects MBR and floppy boot records upon boot, and remains memory resident
  • If infected floppy is in pc upon boot, virus code may be transferred to system MBR and become memory resident at next system boot
  • Unless a floppy is write-protected, it becomes infected when accessed from an infected pc
  • Before infecting the MBR of the local host, this virus saves an encrypted copy of the MBR to the 3rd sector of the hard drive