The Mudcat Café TM
Thread #14491   Message #124708
Posted By: j0_77
16-Oct-99 - 09:03 PM
Thread Name: BIOS Virus nasty but it can be squished!
Subject: BIOS Virus nasty but it can be squished!
This one assumes you will press the reboot key OR ctl alt Del when lock up occurs, assumes the user does not keep track of BIOS settings and assumes you are not familiar with your BOOT UP screen. It does not expect you to TURN OFF THE POWER when you lock up. It does not expect you will reset the BIOS if it has been altered.

There is now a variant of the Cernobyl idiot virus that sneaks into a PC. The route is ---any website java script-->your computer's memory--->any cache / tmp folder---> creates a folder or tmp file to create/unpack---->causes lockup.

Which makes you reboot, whereon it tries to write to BIOS or garble BIOS where you've a flash type BIOS--->
It failed on my system down since the memory changes locked BIOS. Again clearly it was written by a complete idiot! Could a done better meself hehe.

Noticable changes 1

Boot up memory check reports look odd = You used have 16 meg now you see 8 meg

- it will try to grab a hunk of memory -assuming the victim presses ctl alt del - If you turn off the power for a long time OR remove and reseat the memory chips= kills it. If it continually reloads, boot to startup disk in the A drive and search for new files folders on YUP the C drive. DELETE EM. If it still persists you'll need a techie to fdisk the MBR. Also may need the C drive have a sys command off the A drive.
:0)

2

Hard Drive specs are changed !! That is not something you'd pay any attention to - for some reason this idiot script tries to set all BIOS settings to default. You'll have to reset each page ESPECIALLY your Hard Drive. If not the system may report 'invalid system disk'

Since it appears it requires the services of System BIOS cached to RAM it HAS to reset that value in BIOS. Clearly Video ram can easily be mistaken for System so twill also reset that too.

Reset to 'Disable' or adopt that as default = in windows95/8 sytems it makes no difference which you choose. Disable is preferred since it forces these type viri to make a victim reboot twice - A SURE SIGN something aint quite right.

:0)