Can a virus change the BIOS?

Is it possible for a virus to change the BIOS? a while ago i revcieved a virus and in the end had to re format my hard drive, when i installed the O/S etc again i found that the virus was still there. i have been given several reasons for why the virus may still have been there but i am unsure to which one is right!

1)You didnt actually reformat the pc properly and installed the O/S over the top (doubt it!)

2)Hard drives dont fully get cleaned with one format, it needs to be done several times

3)There maybe a bot with my IP taged so that evertime i connect to the internet a bot starts a chain of attacks on my computer

4)My BIOS has been altered!

Quote:

---

Originally posted here by Konshuss
Is it possible for a virus to change the BIOS?

---

yes, it can. but i dont know a virus that put a usefull code on bios. most just destroy it.

Quote:

---

1)You didnt actually reformat the pc properly and installed the O/S over the top (doubt it!)

---

prolly

Quote:

---

2)Hard drives dont fully get cleaned with one format, it needs to be done several times

---

B.S.

Quote:

---

3)There maybe a bot with my IP taged so that evertime i connect to the internet a bot starts a chain of attacks on my computer

---

most prolly. a naked windows xp on internet will be infected in minutes. you cant even have enough time to d/l patches without be infected. ive recently did that test and my new xp got several infections while i was trying to d/l sp2. funny how a regular user can do that (I have all patches on a CD too)

Quote:

---

4)My BIOS has been altered!

---

it can be, but i dont know a virus that install itself on bios. anyone knows?

Only bios altering virus I ever heard of was CHI (I think thats how it was spelt =\ ) which did nothing more than overwrite the bios, in general, the bioses of today have counter measures to prevent this kind of thing, most likely you were infected when you connected to the net, having installed windows ontop of your old one would still have stopped the virus from executing on startup... oh well, best of luck to you.

- Noia

Quote:

---

Only bios altering virus I ever heard of was CHI

---

CIH AKA Chernobyl

I ahve had systems with fuxored BIOS .. but also systems with some code in the CMOS portion that will give merry curry with future installations.. as yet I havent encountered any that will call or install a BOT.. there isn't all that much room to play.. seeing what has happened in the past.. probable...
I agree with Noia.. a repartition and format before the installation of the OS is normally all that is needed, if a suspicion of a CMOS corruption or infection.. Reset the the cmos.. normaly a jumper, a powere up kboard key combination, or just remove the Battery for a period of time.. read your MOBO Manual (D/L from the MObo manufacturer web site)..
or if you have managed to rule out a bad prog in your install or your salvaged Documents.. you could look to Flashing the BIOS.. (you can download from the manufacturer site..you will need to know EXACTLY what your motherboard is..We can't help you)
Warning.. any problems or errors doing this. could lead to a very interesting curiosity you can show your friends (a dead Mobo).. in other words .. eliminate ALL else before attempting this..

What virus was it? If it was an MBR virus a reformat will NOT remove it. It'll still be there.

Quote:

---

Originally posted here by SirDice
What virus was it? If it was an MBR virus a reformat will NOT remove it. It'll still be there.

---

good point.

Quote:

---

Originally posted here by SirDice
What virus was it? If it was an MBR virus a reformat will NOT remove it. It'll still be there.

---

good point sirdice. When told us about "reformat disk" ive implied that he destroyed mbr also. But it doesnt imply. (i use to re-recreate mbr when re install)

You can clean out an MBR virus with the following:

Fdisk /mbr

Hasn't failed me yet

Quote:

---

There maybe a bot with my IP taged so that evertime i connect to the internet a bot starts a chain of attacks on my computer

---

Ahhh haha! Actually you'd be surprised how many XP users end up re-installing everything that came in the earlier days of service pack one then end up infected with sasser or something.

run fdisk and remove the active partition, and then reboot then run fdisk again and reinstall your partitions, reboot and then format your drives. this should take care of any MBR viruses.

What do you think?

Actually, going back to the orginal posted question, there were reports from MessageLabs of several versions of Netsky and Bagle that had code that could be used to alter/destroy your Bios, yet was not enabled (or didnt operate correctly).

Fdisk /MBR works everytime :)

Princesheril: Yeah... I will send a attachment via email you need to open... ok?
Sigh....

I believe that the "Magistr" virus also trashed the BIOS in some instances.

Once you have your problem sorted out I would suggest you check your BIOS and see if it supports MBR protection. If it does I would turn it on.

You sound as if you do not have a firewall? you should get one. The logs should show you if you are getting a bot attack.

If you use cable to connect to the internet, you should consider contacting your ISP and getting your IP address changed.

just a few thoughts

somehow erase ur MBR and recreate it using any tool like fdisk.. Generally the viruses targetting MBR exhibit the behaviour of the system as told by u

I do not have a static IP address so i reckon i should ring my ISP and get it changed but i was thinking that it couldnt be a bot as when i re formated C: and installed the O/S the virus was reckognised again as soon as i installed norton. This is why i think it has to be a virus in the BIOS. Im at college at the moment but as soon as i get home i will try fdisk MBR and see what happens. Also BAGLE rings a bell, i swear that this was one of the virus's that i have deleted ijn the past.

one more thing, i do have a firewall! two of them! :)