Neutralization is only sure cure


March 02, 1992|By Muphen Whitney | Muphen Whitney,Special to The Sun

The Michelangelo virus is scheduled to become active on March 6. It is a memory resident virus which infects diskette boot sectors and the partition table on the hard disk.

The virus becomes memory resident when the system is booted with a disk which is infected by the virus, regardless of whether or not the boot is successful. It infects diskette boot sectors as they are accessed and it infects the hard disk partition table when the user accesses a file on the hard disk.

The total system and available free memory, as measured by the DOS CHKDSK command, will typically decrease by 2,048 bytes. Michelangelo can also be detected using any one of a number of virus detection programs, such as the one available from McAfee Associates' bulletin board.

According to virus expert Patricia M. Hoffman of Santa Clara, pTC Calif., "Any release of the McAfee program from 80 onward is effective against Michelangelo. If you use another detection and protection program, make sure it was compiled within the last three months and that it detects and protects against Michelangelo."

"You can set the system date on your computer to avoid March 6," says Ms. Hoffman, "but this is not a permanent solution."

In most cases, the same programs that detect viruses will also neutralize them. This is the only sure cure for a virus. Make sure that you clean your hard disk and every floppy. Mark floppies with a special sticker or code and the date they were cleaned. After you rid your system of the virus, you will need to turn your computer's power off and boot from a virus-free DOS disk.

Until you are sure your system is clean, don't distribute any of your disks to anyone else and don't use disks from other sources. Unlike some other viruses, Michelangelo cannot be spread by downloading from a bulletin board. It can only be transferred from floppies or by booting from an infected disk. Ms. Hoffman cautions to be especially careful if you use any disks from public computers (such as at schools and libraries), if you recently bought a new computer or new software or if your computer has recently been in the shop for maintenance or repair.

Hundreds of computer viruses have been documented by Ms. Hoffman's VSUM Virus Information Summary List. Ms. Hoffman can be reached at (408) 988-3773. Information about McAfee Associates' bulletin board and virus detection program can be

obtained by calling (408) 988-3832.

Baltimore Sun Articles
Please note the green-lined linked article text has been applied commercially without any involvement from our newsroom editors, reporters or any other editorial staff.