Michelangelo (computer virus)
Encyclopedia
The Michelangelo virus is a computer virus
first discovered in April 1991 in New Zealand
. The virus was designed to infect DOS
systems, but did not engage the operating system or make any OS calls. Michelangelo, like all boot sector
viruses, basically operated at the BIOS
level. Each year, the virus remained dormant until March 6, the birthday of Renaissance
artist Michelangelo
. There is no reference to the artist in the virus, and it is doubtful that the virus writer intended Michelangelo to be referenced to the virus. Michelangelo is a variant of the already endemic Stoned virus.
On March 6, if the PC is an AT or a PS/2, the virus overwrites the first one hundred sectors of the hard disk
with nulls. The virus assumes a geometry of 256 cylinder
s, 4 head
s, 17 sector
s per track. Although all the user's data would still be on the hard disk, it would be irretrievable for the average user.
On hard disks, the virus moves the original master boot record
to cylinder 0, head 0, sector 7.
On floppy disks, if the disk is 360 KB, the virus moves the original boot sector to cylinder 0, head 1, sector 3.
On other disks, the virus moves the original boot sector to cylinder 0, head 1, sector 14.
Although designed to infect DOS systems, the virus can easily disrupt other operating system
s installed on the system since, like many viruses, the Michelangelo infects the master boot record of a hard drive. Once a system became infected, any floppy disk
inserted into the system (and written to; in 1992 a PC system could not detect that a floppy had been inserted, so the virus could not infect the floppy until some access to the disk is made) becomes immediately infected as well. And because the virus spends most of its time dormant, activating only on March 6, it is conceivable that an infected computer could go for years without detection — as long as it wasn't booted
on that date after being infected.
The virus first came to widespread international attention in January 1992, when it was revealed that a few computer and software manufacturers had accidentally shipped products, for example Intel's LANSpool
print server, infected with the virus. Although the infected machines numbered only in the hundreds, the resulting publicity spiraled into "expert" claims of thousands or even millions of computers infected by Michelangelo. However, on March 6, 1992, only 10,000 to 20,000 cases of data loss were reported.
In subsequent years, users were advised not to run PCs on March 6, waiting until March 7, or else reset the PC date to March 7 at some time on March 5 (to skip March 6). Eventually, the news media lost interest, and the virus was quickly forgotten. Despite the scenario given above, in which an infected computer could evade detection for years, by 1997 no cases were being reported in the wild.
Computer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
first discovered in April 1991 in New Zealand
New Zealand
New Zealand is an island country in the south-western Pacific Ocean comprising two main landmasses and numerous smaller islands. The country is situated some east of Australia across the Tasman Sea, and roughly south of the Pacific island nations of New Caledonia, Fiji, and Tonga...
. The virus was designed to infect DOS
DOS
DOS, short for "Disk Operating System", is an acronym for several closely related operating systems that dominated the IBM PC compatible market between 1981 and 1995, or until about 2000 if one includes the partially DOS-based Microsoft Windows versions 95, 98, and Millennium Edition.Related...
systems, but did not engage the operating system or make any OS calls. Michelangelo, like all boot sector
Boot sector
A boot sector or boot block is a region of a hard disk, floppy disk, optical disc, or other data storage device that contains machine code to be loaded into random-access memory by a computer system's built-in firmware...
viruses, basically operated at the BIOS
BIOS
In IBM PC compatible computers, the basic input/output system , also known as the System BIOS or ROM BIOS , is a de facto standard defining a firmware interface....
level. Each year, the virus remained dormant until March 6, the birthday of Renaissance
Renaissance
The Renaissance was a cultural movement that spanned roughly the 14th to the 17th century, beginning in Italy in the Late Middle Ages and later spreading to the rest of Europe. The term is also used more loosely to refer to the historical era, but since the changes of the Renaissance were not...
artist Michelangelo
Michelangelo
Michelangelo di Lodovico Buonarroti Simoni , commonly known as Michelangelo, was an Italian Renaissance painter, sculptor, architect, poet, and engineer who exerted an unparalleled influence on the development of Western art...
. There is no reference to the artist in the virus, and it is doubtful that the virus writer intended Michelangelo to be referenced to the virus. Michelangelo is a variant of the already endemic Stoned virus.
On March 6, if the PC is an AT or a PS/2, the virus overwrites the first one hundred sectors of the hard disk
Hard disk
A hard disk drive is a non-volatile, random access digital magnetic data storage device. It features rotating rigid platters on a motor-driven spindle within a protective enclosure. Data is magnetically read from and written to the platter by read/write heads that float on a film of air above the...
with nulls. The virus assumes a geometry of 256 cylinder
Cylinder (disk drive)
A disk drive cylinder is a division of data in a disk drive, as used in the CHS addressing mode of a Fixed Block Architecture disk or the cylinder–head–record addressing mode of a CKD disk. The concept is concentric, hollow, cylindrical slices through the physical disks , collecting the respective...
s, 4 head
Disk read-and-write head
Disk read/write heads are the small parts of a disk drive, that move above the disk platter and transform platter's magnetic field into electrical current or vice versa – transform electrical current into magnetic field...
s, 17 sector
Disk sector
In computer disk storage, a sector is a subdivision of a track on a magnetic disk or optical disc. Each sector stores a fixed amount of user data. Traditional formatting of these storage media provides space for 512 bytes or 2048 bytes of user-accessible data per sector...
s per track. Although all the user's data would still be on the hard disk, it would be irretrievable for the average user.
On hard disks, the virus moves the original master boot record
Master boot record
A master boot record is a type of boot sector popularized by the IBM Personal Computer. It consists of a sequence of 512 bytes located at the first sector of a data storage device such as a hard disk...
to cylinder 0, head 0, sector 7.
On floppy disks, if the disk is 360 KB, the virus moves the original boot sector to cylinder 0, head 1, sector 3.
On other disks, the virus moves the original boot sector to cylinder 0, head 1, sector 14.
- This is the last directory of the 1.2 MB disks.
- This is the second-to-last directory of the 1.44 MB disks.
- The directory does not exist on 720 KB disks.
Although designed to infect DOS systems, the virus can easily disrupt other operating system
Operating system
An operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
s installed on the system since, like many viruses, the Michelangelo infects the master boot record of a hard drive. Once a system became infected, any floppy disk
Floppy disk
A floppy disk is a disk storage medium composed of a disk of thin and flexible magnetic storage medium, sealed in a rectangular plastic carrier lined with fabric that removes dust particles...
inserted into the system (and written to; in 1992 a PC system could not detect that a floppy had been inserted, so the virus could not infect the floppy until some access to the disk is made) becomes immediately infected as well. And because the virus spends most of its time dormant, activating only on March 6, it is conceivable that an infected computer could go for years without detection — as long as it wasn't booted
Booting
In computing, booting is a process that begins when a user turns on a computer system and prepares the computer to perform its normal operations. On modern computers, this typically involves loading and starting an operating system. The boot sequence is the initial set of operations that the...
on that date after being infected.
The virus first came to widespread international attention in January 1992, when it was revealed that a few computer and software manufacturers had accidentally shipped products, for example Intel's LANSpool
Intel LANSpool
LANSPool was network printer administration software developed by Intel. The package was designed specifically for the Novell NetWare network operating system. The software allowed users to share printers and faxes and for administrators to modify LAN printing operations...
print server, infected with the virus. Although the infected machines numbered only in the hundreds, the resulting publicity spiraled into "expert" claims of thousands or even millions of computers infected by Michelangelo. However, on March 6, 1992, only 10,000 to 20,000 cases of data loss were reported.
In subsequent years, users were advised not to run PCs on March 6, waiting until March 7, or else reset the PC date to March 7 at some time on March 5 (to skip March 6). Eventually, the news media lost interest, and the virus was quickly forgotten. Despite the scenario given above, in which an infected computer could evade detection for years, by 1997 no cases were being reported in the wild.
External links
- http://www.cert.org/advisories/CA-1992-02.html official advisory (by CERTCertCert or CERT may refer to:* Certificate, an official document* Certiorari, a Latin legal term for a court order requiring judicial review of a case...
) - The Michelangelo madness, a chapter in an IBM research report
- Michelangelo Fiasco: a Historical Timeline at Vmyths
- Dis-assembled Michelangelo source code.
- http://www.f-prot.com/virusinfo/descriptions/michhelangelo.html