Security Basics mailing list archives

Any solution for a virus in the BIOS?


From: "Dev Null" <devj.nullj () gmail com>
Date: Sat, 17 Nov 2007 15:57:10 +0000

Hello ALL

I have come across a computer system with some strange behaviour. Keyboard of
the system gives intermittent problem.

Whenever the system is booted, the three light [NUM, CAPS, SCROLL] of the
keyboard flash and it gets detected [the OS does not give two beeps].  However,
immediately afterwards it does not work. The three LEDs go off and do
not turn on
again. Keyboard seems to be dead.

Only sometimes, it starts working completely.

I took the keyboard off of the serial port it is connected to and
plugged it into a
USB-to-serial port converter [connected to the USB port on the
computer] which is
known to work alright. Keyboard gives the  same problem again.

This behaviour was tested with various functional keyboards.

Obviously it is not the serial port which is a problem nor is the
hardware circuitry.
The USB port works fine with other devices, so again it is not the
circuitry again.
It is the BIOS?

I wanted to update the BIOS over the net. However, I cannot go into
the CMOS setup
so as to switch the system into normal booting rather than intel rapid
boot so that
I can see the BIOS version as the keyboard does not work. Also the windows does
not boot any longer on this system so that I could get this
information from the
"System Information". I tried to boot the system with knoppix, but
again it is not of
help as  the keyboard does not work. It just works only sparingly. May
be once or twice in  twenty or so attempts.


For a clue, the system  is infected with a virus which creates an exe
file in folders.
Exe file is created with the name of the folder in which it is
created. So, an infected
folder FOLDER will have an exe file FOLDER.exe.

Is this something which has infected BIOS?

If so, what should I do so that a keyboard starts working with the
system and I can
perform the BIOS update and perform other maintenance tasks.


Thanks for any help.

--
devj


Current thread: