Live Chat & Podcast at 1:00PM Eastern on Sunday!
There's no such thing as a stupid question, but they're the easiest to answer.
JoinTour
Login
Search
General Security
Tag Cloud
access acer asus bios bsod computer crash desktop drive driver drivers error ethernet excel freeze gaming hard drive hardware hdmi internet laptop malware memory missing monitor motherboard network printer problem ram random registry router slow software sound trojan ubuntu 11.10 uninstall usb video virus vista wifi windows windows 7 windows 7 32 bit windows 7 64 bit windows xp wireless
Search
Search for:
Tech Support Guy Forums > Security & Malware Removal > General Security >
Can a virus survive Fdisk+format?

Reply  
Thread Tools
foler59's Avatar
Member with 45 posts.
 
Join Date: Jan 2008
Experience: Intermediate
11-Apr-2008, 07:21 AM #1
Can a virus survive Fdisk+format?
OK, I know there have been quite many discussions on this matter, but I've not been able to draw a definite conclusion. Is it possible (=has this been demonstrated) that a virus can survive fdisk+format? That is, if I clear my CMOS, my windows XP installation CD (authentic and clean) and select to delete my partition, then format, will there be ANY chance that a virus could have survived that?

Thanks
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
11-Apr-2008, 10:37 AM #2
Only if your BIOS has been compromised. Download the following PDF document here for more information (928+KB). The document is a slide presentation by John Heasman, Implementing and Detecting An ACPI BIOS Rootkit, a speaker at the Black Hat USA 2006 conference.

I would not, however, advise you to look up your MB BIOS at the MB Mfg web site for the latest version to burn. Instead, you might email the Mfg about whether there is a utility that can verify that your BIOS has not been compromised. If it works, don't fix it is the philosophy because more folks than you can imagine try to update their BIOS and end up needing to get a new BIOS chip installed at their local PC shops, i.e. the procedure is usually easy to muck up if you do not follow precisely the Mfg instructions to the T on updating the BIOS.

-- Tom
__________________
The independence created by philosophical insight is - in my opinion - the mark of distinction
between a mere artisan or specialist and a real seeker after truth. - Einstein 1944
Imagination is more important than knowledge. - Einstein

Last edited by lotuseclat79; 11-Apr-2008 at 10:46 AM..
foler59's Avatar
Member with 45 posts.
 
Join Date: Jan 2008
Experience: Intermediate
19-May-2008, 06:47 AM #3
Flashing the newest BIOS version will kill the virus is it's installed there?

What other locations besides the BIOS could a virus be installed? Could it be installed in the software of a router? Or in the printer?
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
19-May-2008, 09:43 AM #4
Hi orestis34,

If malware of any kind is installed in the BIOS, then flashing the BIOS with any authorized version will expunge the malware - if the flash is done properly which most users manage to munge up when they try do do it.

Malware could effectively be hidden in other devices that use their own BIOS to boot up like a video card, router, or yes even a printer.

The key, as always, is, as I said before, to contact the mfgr to see if they have any method to validate and verify that the BIOS is untampered.

-- Tom
__________________
The independence created by philosophical insight is - in my opinion - the mark of distinction
between a mere artisan or specialist and a real seeker after truth. - Einstein 1944
Imagination is more important than knowledge. - Einstein
mrss's Avatar
Registered User with 722 posts.
 
Join Date: Jun 2007
19-May-2008, 10:19 AM #5
You can always reset your router to factory defaults - every one I've owned has a reset pin - to clear the login/password and any bogus DNS gateway entrees.
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
20-May-2008, 10:20 AM #6
And, with respect to all routers, after installing it, change the default admin password!

A web page of the default admin passwords of routers has been published on the Internet, and not changing the admin password of a newly installed router is a well-known malware attack vector vulnerability for anyone whom has not changed their's!

-- Tom
__________________
The independence created by philosophical insight is - in my opinion - the mark of distinction
between a mere artisan or specialist and a real seeker after truth. - Einstein 1944
Imagination is more important than knowledge. - Einstein
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
20-May-2008, 06:59 PM #7
Here's what can happen if you do not change your router's default admin password upon installing it - you could get PhlashDanced, also Link.

Note: the first link's title is erroneous, as the damage is not permanent, i.e. the chip will not boot, until the firmware is replaced either by reflashing it with valid firmware or replacing the chip. Either way, the chip may need to be removed to effect the change, unless you are lucky and can flahs it over a network (local).

-- Tom
__________________
The independence created by philosophical insight is - in my opinion - the mark of distinction
between a mere artisan or specialist and a real seeker after truth. - Einstein 1944
Imagination is more important than knowledge. - Einstein
foler59's Avatar
Member with 45 posts.
 
Join Date: Jan 2008
Experience: Intermediate
27-May-2008, 03:49 AM #8
Phlashdanced? WTF! Although the article is somewhat interesting, the guy must be a bit ridiculous...

What is mfgr? I tried to find a site or something, but couldn't, do you have a link?
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
27-May-2008, 11:07 AM #9
Hi orestis34,

"mfgr" is a well-known abbreviation for - manufacturer!

-- Tom
Newuser12345215's Avatar
Computer Specs
Member with 89 posts.
 
Join Date: Feb 2007
Experience: Intermediate
28-May-2008, 11:32 AM #10
Are there viruses that can alter your BIOS/CMOS settings and/or potentially cause your computer to fry or be destroyed?
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
28-May-2008, 05:58 PM #11
Hi Newuser12345215,

A fried computer is likely one that overheats which can destroy components on the Motherboard - so, yes, there are, but they may be targeted techniques, rather than in the wild. Read post #2.

-- Tom
foler59's Avatar
Member with 45 posts.
 
Join Date: Jan 2008
Experience: Intermediate
25-Jun-2008, 12:04 PM #12
OK, apart from the extreme cases (that a virus may store itself in some weird component's memory like the printer or the router), the main 3 places where it can store itself on a normal PC are the HDD, the RAM and the BIOS cmos memory?
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
26-Jun-2008, 12:10 PM #13
Also, in Video BIOS - if the video chip has a separate bios.

When the system is powered down, RAM, at least most out there rather than the newer kind that survives power-off, loses memory state - so, HDD, PC bios, and video chip bios.

-- Tom
Reply

THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
WELCOME TO TECH SUPPORT GUY! Are you looking for the solution to your computer problem? Join our site today to ask your question -- for free! Our site is run completely by volunteers who want to help you solve your computer problems. See our Welcome Guide to get started.
Thread Tools



Facebook Facebook Twitter Twitter TechGuy.tv TechGuy.tv Mobile TSG Mobile
You Are Using:
Server ID
Advertisements do not imply our endorsement of that product or service.
All times are GMT -4. The time now is 03:43 AM.
Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved.

Powered by Cermak Technologies, Inc.