17 Feb 1992 | Print  |

DOS Michelangelo Virus Alert!

by Adam C. Engst

This one's a nasty bugger. The Michelangelo virus is a variant of the Stoned virus that infects the boot sector of disks. Unlike Stoned, on a certain date , March 6th (of any year), Michelangelo destroys data on the startup disk. Why am I telling you about this? First of all, lots of you probably have to work with DOS machines in some form or fashion, and it will make your job a lot harder if you have to recover from a trashed hard disk after Michelangelo gets through with it. Second, any Mac user running Insignia's SoftPC or the Mac286 or Mac386 emulators cards from Orange Micro is at risk as well. It's not quite clear if the virus just overwrites the FAT (file allocation table) and the boot sector or if it actually erases all data on all volumes, but if your SoftPC hard disk is infected and you have the E: drive set to a Mac folder, it's possible that the virus could damage your Macintosh files as well.

The Michelangelo virus is one of the most virulent in that it has spread incredibly quickly and has even been shipped with commercial software such as DaVinci eMail 2.0 and on preformatted PC hard disks such as those in Leading Edge PCs. The virus scare has died down a bit on the Mac side, but it's still worth noting that the networks are perhaps one of the safer places to get software since files on well-run servers are usually checked at least briefly before posting. In addition, the networks are the best places to get the latest versions of virus protection software. The upshot of all this is that if you're at all worried about possibly having infected your DOS machine or SoftPC hard disk with Michelangelo, do yourself a favor and check it. You've got plenty of time before the March 6th destruction date to get a virus detection and removal package from the nets.

Several good packages that will find and remove the Michelangelo virus include Fridrik Skulason's F-PROT shareware package (2.02) or the SCAN85 and CLEAN85 shareware programs from McAfee Associates. These programs should be available from most good sites carrying DOS software. Internet folks might look on wuarchive.wustl.edu, but be prepared to search for a bit - there's a ton of software there.

If you suspect your machine has this virus but do not have an updated version of a virus scanner, running the CHKDSK program will report a "total bytes memory" value 2048 bytes less than expected. For example, a PC with 640K of memory will normally return a value of 655,360 bytes, with Michelangelo that value would be 653,312. Unfortunately, having less "total bytes memory" does not necessarily mean your machine is infected, since some memory resident programs can affect this value as well.

If your run out of time to check for Michelangelo, but do want to protect your data, you might try changing the date on your PC's clock. Set the date for March 7th, and then after March 6th, reset the date to make it correct. Do not just do this and ignore the fact that you may have a virus though, since Michelangelo spreads constantly, and you could infect many other people through your negligence.

Contact a local DOS guru if you need help with this stuff, but don't just laugh it off unless you think losing all your data is generally funny.

Information from:
Mark H. Anbinder -- mha@baka.ithaca.ny.us
Tom Young -- xmu@cornellc.cit.cornell.edu

-

Top Articles in this Section

• Apple Lists Top iTunes Downloads of 2008 (03 Dec 08)
• The Simpsons Takes Aim at Apple (02 Dec 08)
• Apple TV 2.3 Adds AirTunes, Volume Control (21 Nov 08)

Fetch Softworks: Fetch 5.3 makes FTP and SFTP easy!
Upload, download, mirror, and manage your Web site. Dozens of
new features to make file transfers easier and more reliable.
Get your free trial version at <http://fetchsoftworks.com/>!