AgTalk Home
AgTalk Home
Search Forums | Classifieds (97) | Skins | Language
You are logged in as a guest. ( logon | register )

Anyone ever had a "BIOS" virus?
View previous thread :: View next thread
   Forums List -> Computer TalkMessage format
 
WYDave
Posted 5/23/2009 01:08 (#720846 - in reply to #720554)
Subject: RE: Anyone ever had a "BIOS" virus?


Wyoming

Technically, the attack is called a "BIOS rootkit" and while they're talked about in security circles for a couple years, they're only starting to be seen "in the wild" this year.

The attack is to add modifications to the BIOS code that runs from flash memory on your motherboard when you turn the machine on. The BIOS is what starts running from the very first instructions executed by the CPU. Most flash memory on motherboards is read/write, to allow BIOS upgrades - and therein lies the problem.

A BIOS rootkit can survive re-formatting the hard drive, booting off another drive than your infected drive, you name it, because the BIOS code is running prior to the MBR (master boot record) being read off the disk or CD you're booting.

You might be able to detect it with F-Secure's "Blacklight" program. Might.

You might be able to fix a BIOS rootkit by re-flashing the BIOS or re-setting the BIOS from ROM (if that is a feature on your motherboard). Many motherboards have a hardware jumper setting that disallows the BIOS flash from being written, and this is what I'd recommend people set if they're concerned about getting a BIOS attack. If the flash cannot be written, then the attack in software (most likely in a piece of code either emailed to you or downloaded in your browser) cannot write the BIOS flash memory, which means that your BIOS stays clean.

Without a model # on the PC, I have no idea what the features/issues of the BIOS on your machine are.

Top of the page Bottom of the page


Jump to forum :
Search this forum
Printer friendly version
E-mail a link to this thread

(Delete cookies)