Re: MyDoom bios infection

[Ben Nelson <lists () venom600 org>]

Frank Knobbe wrote:
> On Thu, 2004-01-29 at 03:14, Ferris, Robin wrote:
>
> > > It was also unknown that the virus infects the BIOS of the computer it
> > > infects by injecting a 624bytes backdoor written in FORTH which will open
> > > port tcp when Mydoom will be executed AFTER febuary 12.
>
>
> Although code in BIOS could interact with your network card, it would
> require the correct driver routines for your particular card. Does the
> virus come with network card drivers for a variety of cards? No? Then
> BIOS code won't open a TCP port.
>
> Regards,
> Frank
It would need a TCP stack too, would it not?

--Ben

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html