New BIOS Virus Withstands HDD Wipes

Page 2 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Toggle sidebar Toggle sidebar
Status
Not open for further replies.
[citation][nom]Shadow703793[/nom]This goes to show that they should really have not made BIOS flashable from OS. lol.[/citation]
I agree. But this is what happens when people get lazy and don't want to spend 2 minutes away from their eyecandy-filled OS.
 
Man i remember the days when mcafee and norton were all hyped up on these and made special note of them in thier products back in the day.This comes as no surprise really, some cracks for OS's and some programs actually add stuff to your BIOS to full authentification programs, now its just making what was old new again.
 
Just have a motherboard with built in double bios where one there are two bios chips, one has the bios that is used while the other has a workable version of the bios that came with the computer. If the Bios chip is corrupted then the other chip flashes the other through a one way link. Problem solved
 
You can pretty much always short a jumper to restore the original BIOS... never seen a MB without this sort of feature.

judeh101, the virus will run when the disk is mounted by the OS... you might be able to mount it in non-windows OS though... like bootitng which would probably fix it.

 
When the virus infects the bios, what's stopping it from setting all the voltages to max and frying all your components before you have any time to react??

scary
 
[citation][nom]coopchennick[/nom]When the virus infects the bios, what's stopping it from setting all the voltages to max and frying all your components before you have any time to react??scary[/citation]
I think you'd need to know the stucture of the BIOS you are infecting to do this. Since they are all varied in some way it would require a big effort to do.
 
Most mobo's have built in bios protection, just has to be set to enabled in bios settings. turn off to update bios, enable after update, all done.
 
Anybody remind the CIH virus aka Chernobyl? It was quite evil when it screwed motherboards. There is suppose to have a bios flash write protection on most pc models, I think it would be a good idea to enable it.
 
God predator you fossle , lol. think I still got a board that I was meaning to TRY to fix that was toasted , dang think it was an Asus P5A-B cant remember though.
 
Reminds me of the government flashing cell phone bios so they can listen in when your cell phone is turned off.

I seached the PDF for the MOBOS I'm using and didn't see a hardware lock feature for the BIOS.

The last time I flashed a bios with a floppy it was a big hassle because I needed the old style bootable floppy which Windows changed the formate at some point and the new style would not work.

I wonder if unix system like SUN Solaris, Linux or Apple have any added security against this besides that they aren't Microsoft products.

Be real, be sober.
 
rofl predator, CIH was the only virus I ever got.. off a 1996-1997 CD from a friend who was a computer wholesaler, it was pretty obvious as it thrashed the harddrive infecting all the windows files. I never knew how I got it though until I gave a CD to another friend a few years later... it was planted in a crappy racing game. When I looked inside the exe's to find it it said "CIH by TiT" I think.
 
Solaris, Linux and any unix based system is safe, as you would need to be root to access such low level functions and you are never suppose to be logged on root. On mac? Who would target a OS with so few users... and as OSX has some unix bases, I think its protected too due to its architecture. On Windows, if you have 95, 98 or Me you are always logged as an admin so it would be possible to do anything you want. If you have 2000 or xp, you are probably logged in account with admin rights, as we are all so lazy, so no protection, but in Vista, if you let UAC on, you are protected as it will warn you something is going on.

To flash a BIOS, you need a driver or a access to kernel or the possibility to dynamically load a driver to perform interuptions and other commands which must be run on ring 0. Commands vary depending of the bios so there is no universal way to screw a bios, luckily.
 
imagine that type of virus, with bios tweaking capability, and overclocks your processor without knowing it, and fries your motherboard!
 
interesting! Expect a new generation on viruses from hackers within 3-5 years from now. Security will be forced to another difficulty level!
 
hey, can someone help a right brained, artist type? someone has been stalking me and they recently hacked my computer. (lil older IBM thinkpad laptop) what showed up inside my "evidence" folder i made in "my docs" were two files. one was a 47 page html/php with their name referenced on it, so they wanted me to know who did this. the other one was a little window that was BIOS looking or something. it was a black screen with blue code on it. i freaked and dumped both in the trash, then thought oh i better save them for evidence and when i got them out of the trash, the blue code on the little window was gone.

shit. does this sound like a BIOS virus? i'm partially disabled and had to quit my last job, so i'm broke right now & can't afford repairs. (and kinda scared, but trying not to be) is there a way to test or find out if that's what this is?

any thoughts or feedback appreciated. i'll check back here later.

thanks.
 
wow Right Brain, just curious what are u on disability for...or out of work for that matter...i got Lyme Disease, just wonderin if its the same :)
 
It's actually not a virus. It's a program that loads itself into the bios and installs a hidden partition that can;t be formatted. It won't even let you to set up your chs in manual mode in the bios. I've flashed the bios and changed the the jumper on my board to lock the bios but it still comes back. I haven't pulled the ram yet. only thing i found to get it off the hd is a convert all to 0"s format but that does nothing to get it off the bios or ram.
 
Password protecting the chip is a god start...

... but...
... an attacker could simply attempt to flash BIOS at every boot...
... or...
... attach to the flasher process and do the nasty stuff when the legit flashing is done...
... because if you look at the flashing software provided by say insyde, you'll find it remarkably easy to tinker with.

I prefer the hard-wired approach because I like messing with switches... and it will restrict the problem to people with screwdrivers, who (one could assume) should be a bit more aware about what the hell they're up to.
 
bios virus,
Resently my computer started rebooting untill it was only bios option that would load. Formatted and ran auto restore, as soon as windows stared installing - a reboot. then hard drive stopped spinning.
Bought new hd, formatted and ran auto restore, same problem.
Booted into win 98 and formatted. 98 began to install, then reboot.
New drive and same bios. Some where I read about taking every thing in bios off of auto setting. I did this and when 98 stopped on the next try I had a virus warning for the first time.
I can't make a floppy virus checker because this notebook I'm using has no floppy dr.
Hopefulley my bios is on a removable chip. Not going to turn the computer on untill I have installed a new chip.

Any comments/

joe-95
 
yes i got bios virus on my old compaq pentium 2 but the virus cant infect the bios is canot be flashed so i use my old pc for deep internet surfing like porn and etc.
 
I have the bot and it has infected three MBs and four HDs. The HDs cannot be erased with anything I have tried (HDDerase,Dban,WD,Acronis) and more. it installs a fat12 partition on a drive that can't be erased and will move itself around on the drive depending on how it is formatted, I called western digital & they will replace a drive that is still in warrenty. It also infects the bios so that any new drive will also be infected, I haven't been able to fix this problem--HELP
 
Status
Not open for further replies.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom