The Michelangelo virus is an early 1990s computer virus that affects PCs running MS-DOS (and PC-DOS, DR-DOS, etc.) versions 2.xx and higher. Note, however, that although the virus can only execute on PCs running these versions of DOS, it can infect and damage PC hard disks containing other PC operating systems including UNIX, OS/2, and Novell. Thus, booting an infected DOS floppy disk on a PC that has, for example, UNIX on the hard disk would infect the hard disk and would probably prevent the UNIX disk from booting. The virus infects floppy disk boot sectors and hard disk master boot records (MBRs). When the user boots from an infected floppy disk, the virus installs itself in memory and infects the partition table of the first hard disk (if found). Once the virus is installed, it will infect any floppy disk that the user accesses.

Some possible, though not conclusive, symptoms of the Michelangelo virus include a reduction in free/total memory by 2048 bytes, and some floppy disks that become unusable or display "odd" graphic characters during "DIR" commands. Additionally, integrity management products should report that the MBR has been altered.

Note that the Michelangelo virus does not display any messages on the PC screen at any time.

The Michelangelo virus triggers on any March 6, Michelangelo's birthday. On that date, the virus overwrites critical system data, including boot and file allocation table (FAT) records, on the boot disk (floppy or hard), rendering the disk unusable. Recovering user data from a disk damaged by the Michelangelo virus will be very difficult.

Variants and aliases of the Michelangelo virus circulating include:

• Michelangelo.A
• Michelangelo.B
• Michelangelo.C
• Michelangelo.D
• Michelangelo.E
• Michelangelo.S
• MichelangeloII
• Stoned.Michelangelo
• Stoned.Michelangelo.A

More information can be obtained at CERT's website