BIOS Virus?

[frank.zappa77]

Hey guys, I've been fixing a friend's computer and to keep this post organized I'll tell you what problems I found and what I did to troubleshoot it. But if you want to jump to the questions, just look at the last paragraph.

First of all I was sure that my friend's computer had a virus on it - it had changed the desktop background to something saying "please install such and such anti-virus", and access was denied to running any executable files. I could not run command prompt, regedit, or task manager - and this was the admin account.

First thing I did was try to boot into safe mood (again as admin) but same problem. Since he had recovery discs, I decided to help him reformat. I popped in the Windows XP disc (Media Center 2005 if it's important) and it would start to load, but right after it said "Starting Windows" I would get a blue-screen like error. So I copied the error code (0x0000007b) and searched it on Google. I couldn't really find anything of help, just that Microsoft said it might be a boot-sector virus. There was also little information about how there could loose/bad connections so I opened up the case but all the wires were where they should have been.

Now from my understanding Windows XP uses NTLDR on the MBR to boot the OS. My first thoughts were that this could have been a boot-sector virus. Before I did anything, I wiped the entire hard drive (just 1 partition) using a GParted Live CD. I tried again to boot the XP disc, but same problem, same error code. I then thought that I should overwrite the current contents of the MBR using GRUB from my Ubuntu Live CD. I didn't have my alternate CD so couldn't just skip to the GRUB stage so instead I just ended up installing Ubuntu on to his HD - so at least he has a working OS for now (problem is he needs XP for work).

I then tried to use the XP disc again, but got the same error code. Now his computer's a Dell and I downloaded the program to flash his BIOS off their site but I need to use a floppy drive. I'll just be borrowing one from my friend along with an IDE cable and then I guess I'll try flashing his BIOS.

And finally my questions - is it plausible that he could have a BIOS virus? After searching Google, I read that it is possible for this to happen, but none of the articles stated any symptoms of telling. My second question - is there any 3rd party software I could use to wipe out the boot sector - in the case that my troubleshooting using GRUB didn't work? (like a live CD or floppy even?)

Sorry for the wall of text but I just wanted to be precise with the details and my troubleshooting methods. Any help will be appreciated.

Thanks.

[Paul Komski]

Now from my understanding Windows XP uses NTLDR on the MBR to boot the OS.
Not so. The MBR (directly or via a boot manager such as GRUB or BiNG or BootMagic) directs the boot process to a "system partition" - commonly the active partition. That partition's boot sector next directs the boot processes to ntldr (a normal file in the root of that partition), which in conjuction with boot.ini and ntdetect.com loads windows XP (or other NT-based OS) from a "boot partition" as specified by a line in boot.ini.

The normal fix for a corrupt or infected MBR on an NT-based system is to run fixmbr from a WinXP (or equivalent) Recovery Console. This is akin to using fdisk /mbr from a DOS based system but which also rewrites a new disk signature ID.

With boot sector viruses not only the mbr but also all FAT or NTFS boot sectors should be rewritten by issuing fixboot C: fixboot D: etc from the same Recovery Console.

Boot Sector Viruses are extremely rare and very destructive such that a new chip may be needed and not even flashing the BIOS is likely to be effective since the virus is not unlike a bad flash - so I doubt that has been implicated in this case.

Since the system became bootable after installing GRUB it sounds as if the MBR was either corrupt or infected and was simply overwritten by GRUB. Fixmbr would probably have cured things had it been tried.

Formatting wont affect the MBR. One must either use a special utility to rewrite normal code or completely zero the MBR (or the whole drive). DBAN is a good utility for the latter or else use a diagnostic from the maker of the hard drive in question.