%%File: VIRS0543.TXT
%%Name/Aliases: Michelangelo, Michaelangelo, Mich
%%Platform: PC/MS-DOS
%%Type: Boot sector., 
%%Disk Location: Floppy disk boot sectors., Hard disk partition table.
%%Features: Memory resident; TSR.
%%Damage: Corrupts boot sector
%%Size: Overlays boot sector, no increase, Moves orig. boot sector 
elsewhere, Uses Interrupts INT 13 and INT 1A
%%See Also: 
%%Notes: First identified in the summer of 1991.  This virus is similar 
to the Stoned, but utilizing some different techniques, so it's not 
simply a Stoned variant.  It works for any version of MS DOS.  
Triggers: Bootup from an infected disk will infect.  Usage of floppy a: 
drive (read, write, or format) will cause infection of that medium.  
Payload: on March 6 (Michaelangelo's birthday) this virus will destroy 
data by overwriting the medium the computer was booted from.  Hard disks 
will have sectors 1-17 on heads 0-3 of all tracks, floppies: sectors 1-9 
or 1-14 on both heads and all tracks depending on the FAT type will be 
overwritten.

When Stoned and Michaelangelo both infect a disk, problems occur because 
they both try to hide the partition table in the same place.  March 6th 
(Michaelangelo's birthday) data destruction. 

Upon bootup from an infected floppy the virus will go memory resident 
and infect the partition table.  Any INT13 is intercepted thereafter.  
Any floppy A: operation will infect the disk in drive A: provided the 
motor was off (this cuts excessive infection testing).   

When the virus is resident, CHKDSK will return a "total bytes memory" 
value 2048 less than normal. for a 640k PC normal=655,360; with virus: 
653,312  

Most anti-viral untilities will detect and remove it. Also, boot from a 
clean disk and move the original sector to its proper location (sector 1 
head 0 track 0); on some systems FAT copy 1 might be damaged, so an 
additional copy of FAT 2 ont FAT 1 might be necessary