Michelangelo Virus (31-January-1992)
Entry...............: Michelangelo Virus
Alias(es)...........: Nina Turtle Virus (in Taiwan)
Virus Strain........: Stoned Virus Strain
Virus detected when.: Summer 1991
              where.: 
Classification......: System virus (boot, partition table), resident
Length of Virus.....: Fits well into code space of partition table
                      Memory: 2,048 bytes just below end of DOS
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM - PC, XT, AT, upward and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: ---
Direct Detection....: Original partition table or original boot sector
                         can be found in sector 7 of a hard disk
                         and specific sectors of 5.25"/3.5" diskette. 
                      CHKDSK "total memory bytes" shows that available
                         memory is reduced by 2,048 bytes.
Type of infection...: Upon booting from an infected floppy, virus will 
                         make itself memory resident and infect par-
                         tition table. Any INT13 is intercepted there-
                         after. Any floppy A: operation will infect 
                         disk in drive A: provided the motor was off;
                         this reduces excessive infection testing.
Infection Trigger...: Booting from an infected disk will infect a com-
                         puter. Usage of the floppy A: drive (read, 
                         write, or format) can cause an infection of 
                         that medium.
Infection targets:..: Partition table of harddisks and bootsectors 
                         of floppy disks.
Interrupts hooked...: INT 13
Damage..............: Data destruction by overwriting the medium, from 
                         which system was booted from: on harddisks,
                         virus will overwrite sector 1-17 on head 0-3
                         of all tracks; on floppies, virus will over-
                         write sector 1-9 or 1-14 (depending on FAT
                         type) on both heads and all tracks.
Damage Trigger......: Data destruction occurs when system's date 
                         equals March 6 of any year. This is birthdate
                         of Michelangelo Buonarotti, Italian artist,
                         architect and engineer (born March 6, 1475
                         in Caprese, died February 18, 1564 in Rome)
                      Remark: there is *no evidence* in the virus
                         that it's programmer related March 6 to
                         Michelangelo B.; the name probably is the
                         interpretation of the first person to 
                         (possibly partially) analyse this virus.
Similarities........: Virus seems to be an enhanced Stoned virus 
Particularities.....: 1) Virus uses BIOS directly.
                      2) As virus overwrites hard disk sector 7, it
                         may also affect other operating systems which
                         use an infected disk.
--------------------- Agents -----------------------------------------
Countermeasures.....: 
- ditto - successful: Fridrik Skulason's F-PROT and Dr. Solomon's
                         FINDVIRU detect and eradicate this virus.
Standard means......: Boot from a clean disk and move original sector
                         to its proper location (sector 1, head 0,
                         track 0). On systems where an early FDISK (no
                         hidden sectors) was used to low-level format
                         hard disk, FAT copy 1 might be damaged; an 
                         additional copying of FAT 2 onto FAT 1 might
                         then be necessary.
--------------------- Acknowledgement --------------------------------
Location............: Micro-BIT Virus Center, Univ.Karlsruhe, Germany
Classification by...: Christoph Fischer
Documentation by....: Christoph Fischer
Date................: 17-September-1991
Update..............: Padgett Patterson, Orlando/Florida (31-Jan-1992)

.