-----------------------------------------------------------------------------
 WildList Notes - (c)1995 Joe Wells - c1jwells@watson.ibm - wildlist@aol.com
-----------------------------------------------------------------------------

Virus Name:  Michelangelo

Aliases:     Stoned.Michelangelo, Michaelangelo.

Infects:     MBR on first hard drive. DOS boot sector on floppy disks.

Disk Size:   1 sector.

Location:    MBR or boot sector. Original MBR is stored at cylinder 0, 
             sector 7, head 0. On floppy disks . 

Memory Size: The virus reserves 2k of memory by modifying the available
             memory word at 40:13. On a 640k system the value will be 
             changed from 280h to 27Eh. Chkdsk will report 653312 bytes 
             (638k) of memory free.

Location:    In 2k reserved at top of conventional memory.

Special:     [none]

Effects:     Affected areas on the first hard disk are overwritten with 
             contents of memory at 5000h:0000h at system startup 
             (probably all zeroes). Affected areas are the first 17 
             sectors, of the first 255 tracks, accessed by the first
             four heads.

Trigger:     System bootup on March 6th of any year.

Messages:    [none]

Bugs:        The virus infects all floppies as though they are 360k 
             diskettes.

Origin:      Possibly, Taiwan.

Notes:       I first received a copy of the virus at an antivirus 
             conference in March of 1991. It was given to me by the 
             Australian antivirus product developer, Roger Riordan, 
             maker of Vet. He had discovered it earlier in the year
             and noted that it was a Stoned variant with a warhead (a 
             term Roger is well known to use for virus triggered 
             events). 

             Upon its discovery it was found that it would trigger on the 
             birthday of a certain Australian named Max Telfer. It may 
             well have been dubbed the Max virus or the Telfer virus, but 
             Mr. Telfer pointed out that March 6th was also the birthday 
             of the 16th century artist, Michelangelo. He suggested that 
             name and Roger used it. (Roger, however, spelled it 
             Michaelangelo.) 

             When I received the sample I really didn't give it much 
             thought. One year later, is was (and may still be) the best 
             know virus in the world.

