The Michelangelo Virus of 1992: Panic, Hype and a Date on the Calendar

On the morning of 6 March 1992, computer users around the world sat down at their desks wondering whether their hard disks would still work. For weeks, newspapers and television stations had warned of a virus called Michelangelo that would strike on that date and erase data. Millions of machines, some predictions said, were at risk. The day came and went, and the damage was real but far smaller than the forecasts.

What Michelangelo was

Michelangelo was a boot sector virus, a relative of an older virus known as Stoned. Like others of its kind, it spread through floppy disks. If you started a computer with an infected disk in the drive, the virus placed itself in the machine's memory and then infected any other floppy that was used afterwards. It also infected the hard disk's boot area.

Its name came from its trigger date. 6 March is the birthday of the Renaissance artist Michelangelo, born in 1475. The virus did nothing visible until that day each year. On the trigger date, an infected machine that was started would overwrite parts of the hard disk with garbage, which made the data on it hard or impossible to recover.

How the warning spread

The virus was first noticed in 1991 in several places. In early 1992, antivirus companies and journalists began to warn of the approaching date. One of the most widely repeated forecasts was that millions of computers could be affected, a number widely linked in coverage to John McAfee, the founder of McAfee Associates, who was a frequent commentator on the virus. Many other commentators and several vendors also joined in.

It made a perfect media story: a countdown, a villain with an artistic name, and a clear day when something might happen. Offices bought antivirus software, ran scans and warned staff. Some companies set the system clock to a different date, so that the machine would not see 6 March, which was a workable precaution for this specific virus. Some users switched off their machines for the day.

What actually happened

On and after 6 March, there were reports of lost data in various countries, mostly from home users and small organisations, but the numbers were far lower than the warnings had suggested. Later analyses described the scare as exaggerated. The accurate count of infected machines is hard to establish, and figures quoted vary, so it is best to say simply that the damage was a small fraction of what had been predicted.

That did not mean the exercise was wasted. Many organisations discovered that their backups were out of date or non-existent. Many learned that they had no idea what software was installed on their computers. The scare pushed antivirus tools into the mainstream, and it is often cited as the moment when the average office worker first heard the term computer virus.

The affected machines were mostly older PCs running DOS, and the cure was not complicated. Antivirus tools could remove the virus from the boot sector, and in many cases users could repair an infected disk's boot record with standard DOS tools. Those who had a recent backup lost little. Those who did not had to face the possibility that their documents were gone, which is why the episode is remembered so often in discussions of backup discipline.

The role of the trigger date

Michelangelo was an example of what is called a logic bomb or time bomb: code that waits for a condition, such as a date, before doing harm. The delay is part of the design. A virus that waits can spread quietly before anyone notices it. It is only on the trigger date that the damage becomes visible, and by then it may be on many machines.

Lessons the security industry drew

• Early warnings should be accurate. Exaggerated predictions damage trust when they do not come true.
• Clear communication helps. Specific advice, such as how to detect the virus, was more useful than general alarm.
• Prevention beats cure. Scanning, clean boot disks and write-protected floppies reduced infections.

Newspapers also helped in a more practical way than they sometimes get credit for. The coverage reached people who had never thought about their disks, and many of them made a first backup that week. In that sense the scare did some good, even though it did so by overstating the case.

Hype and real risk

The Michelangelo episode shows both sides of how security news works. Fear sells newspapers and software. At the same time, the underlying risk was real, and organisations that did nothing and were unlucky lost everything on their machines. The sensible response is neither panic nor dismissal. It is to prepare for the realistic case in a way that costs little.

The lesson for site owners today

The most useful lesson is about backups. A destructive event, whether a virus, a failed update, a hacked plugin or a deleted database, is much less of a disaster if you have a recent copy of your data that you have actually tested. Keep backups of your files and databases, store at least one copy away from the server, and try restoring from time to time so that you know it works.

• Back up before every major update.
• Keep several generations, not just the latest copy.
• Test a restore at least once.

If your site runs on WordPress, WordPress hosting is built around keeping it updated.

Making it easier

Plesk includes backup tools that you can schedule and download. Our shared hosting and WordPress hosting plans use it, and our knowledgebase explains how to set up and verify your backups.