From: Jeff Strickland on
I'm working on a new problem for me. I have a machine from a business where
my kid works that has been infected by so many virii that it's impossible to
determine what's bad.

I have gone into the Setup Menu at boot-time to set the boot priority to CD,
but the bootable CD won't start.

I looked through my inventory and found a machine that will support a SATA
drive, and has a working BIOS, so I'm able to clean the HDD and load Windows
onto it.

What I haven't seen before is a virus that goes into the BIOS.

I think I'll be able to load Windows onto the HDD, then plug the HDD back
into the box and get it to come up, then I can get the latest BIOS from the
'net.



From: Paul on
Jeff Strickland wrote:
> I'm working on a new problem for me. I have a machine from a business where
> my kid works that has been infected by so many virii that it's impossible to
> determine what's bad.
>
> I have gone into the Setup Menu at boot-time to set the boot priority to CD,
> but the bootable CD won't start.
>
> I looked through my inventory and found a machine that will support a SATA
> drive, and has a working BIOS, so I'm able to clean the HDD and load Windows
> onto it.
>
> What I haven't seen before is a virus that goes into the BIOS.
>
> I think I'll be able to load Windows onto the HDD, then plug the HDD back
> into the box and get it to come up, then I can get the latest BIOS from the
> 'net.
>

Try an MSDOS floppy, with a copy of the BIOS flashing tool and a clean
BIOS file on it. Then, slide the floppy write protect tab to the protected
position. You can test the write protect on your working computer, before
plugging the floppy into the infected machine. There are some machines
now, where the BIOS is so big, it won't fit on a floppy. But older machines
should still be small enough.

If you really think the problem is the BIOS itself, you can replace the
BIOS chip with one from badflash.com . They have DIP and 32 PLCC chips and
can program with a BIOS file you supply. That would be a way to reprogram the
thing. Before turning on the machine, with that new chip present, you'd also
clear the CMOS with the jumper (with the power disconnected). Just in case
there is some clever way to load a virus into the CMOS RAM.

There are also boot viruses, so it might actually be stored on the hard drive.
Try unplugging the hard drive, then try your CD again, to see if the CD
still won't boot. Older machines used to include a copy of TCAV
(TREND ChipAway Virus) to detect a boot virus, but I no longer see
that listed as a motherboard feature. Maybe that can be bypassed as
well.

You don't need to load Windows on the HDD in the conventional sense.
You can use your good computer, to create two FAT32 partitions.
The first partition becomes C:. The second partition is a small
one, in which you copy the contents of the Windows installer CD.
I made mine about 2GB in size, and that becomes D:. Boot
from an MSDOS floppy, then change directory to D:\i386 and run the
Windows installer (winnt.exe) from there. Then install into C:. That would at
least give you an option to do an F6 driver install, if you needed
it. That is how my current copy of WinXP ended up on C:. It was done
with a copy of the CD loaded on D:, and booting from an MSDOS
floppy. The order of creation of the partitions is important - I
did them in the wrong order the first time, and WinXP ended up
on D: . I had to do it over again. The reason I was experimenting
with that, was to see if it affected the install speed. It does
go a bit faster, but nowhere near as fast as I was hoping.

Good luck, and report back how good a fight the virus puts up.

Paul
From: Jeff Strickland on

"Paul" <nospam(a)needed.com> wrote in message
news:hsl1mu$bml$1(a)news.eternal-september.org...
> Jeff Strickland wrote:
>> I'm working on a new problem for me. I have a machine from a business
>> where my kid works that has been infected by so many virii that it's
>> impossible to determine what's bad.
>>
>> I have gone into the Setup Menu at boot-time to set the boot priority to
>> CD, but the bootable CD won't start.
>>
>> I looked through my inventory and found a machine that will support a
>> SATA drive, and has a working BIOS, so I'm able to clean the HDD and load
>> Windows onto it.
>>
>> What I haven't seen before is a virus that goes into the BIOS.
>>
>> I think I'll be able to load Windows onto the HDD, then plug the HDD back
>> into the box and get it to come up, then I can get the latest BIOS from
>> the 'net.
>>
>
> Try an MSDOS floppy, with a copy of the BIOS flashing tool and a clean
> BIOS file on it. Then, slide the floppy write protect tab to the protected
> position. You can test the write protect on your working computer, before
> plugging the floppy into the infected machine. There are some machines
> now, where the BIOS is so big, it won't fit on a floppy. But older
> machines
> should still be small enough.
>
> If you really think the problem is the BIOS itself, you can replace the
> BIOS chip with one from badflash.com . They have DIP and 32 PLCC chips and
> can program with a BIOS file you supply. That would be a way to reprogram
> the
> thing. Before turning on the machine, with that new chip present, you'd
> also
> clear the CMOS with the jumper (with the power disconnected). Just in case
> there is some clever way to load a virus into the CMOS RAM.
>
> There are also boot viruses, so it might actually be stored on the hard
> drive.
> Try unplugging the hard drive, then try your CD again, to see if the CD
> still won't boot. Older machines used to include a copy of TCAV
> (TREND ChipAway Virus) to detect a boot virus, but I no longer see
> that listed as a motherboard feature. Maybe that can be bypassed as
> well.
>
> You don't need to load Windows on the HDD in the conventional sense.
> You can use your good computer, to create two FAT32 partitions.
> The first partition becomes C:. The second partition is a small
> one, in which you copy the contents of the Windows installer CD.
> I made mine about 2GB in size, and that becomes D:. Boot
> from an MSDOS floppy, then change directory to D:\i386 and run the
> Windows installer (winnt.exe) from there. Then install into C:. That would
> at
> least give you an option to do an F6 driver install, if you needed
> it. That is how my current copy of WinXP ended up on C:. It was done
> with a copy of the CD loaded on D:, and booting from an MSDOS
> floppy. The order of creation of the partitions is important - I
> did them in the wrong order the first time, and WinXP ended up
> on D: . I had to do it over again. The reason I was experimenting
> with that, was to see if it affected the install speed. It does
> go a bit faster, but nowhere near as fast as I was hoping.
>
> Good luck, and report back how good a fight the virus puts up.
>
> Paul

I'm WAAAAY to dumb to say that the BIOS itself is the problem. I think the
BIOS is but one of so many problems that my ability to count is challenged,
and I can count way more than just fingers and toes.

I have already pulled the HDD and moved it to a box that allows a
Boot-From-CD, and have used a DOD-Level wipe tool to destroy all of the data
on the HDD.

The target machine hasn't got a floppy drive, and the CD will not boot.
given the extensive damage that's been done, I have no idea what the
operational status of the CD is -- maybe it doesn't work.

In any case, I have a donor motherboard that has a good BIOS and will take
the HDD, so I'm on my way to fixing the problems that the target machine
has.

When I get done with the MSoft Updates -- well in excess of 100 at last
count -- then I will visit the Compaq Website for new BIOS.

What I can't quite get my arms around is if the BIOS can keep me from
connecting a newly formatted HDD from getting to the 'net. If the BIOS is so
f---ed up that it won't allow the HDD top boot, then I'm toast. I'll have to
find a way to download the BIOS, then getting it into the motherboard, but
I've never crossed that bridge before.

And, no other bridges count.




From: Paul on
Jeff Strickland wrote:

>
> I'm WAAAAY to dumb to say that the BIOS itself is the problem. I think the
> BIOS is but one of so many problems that my ability to count is challenged,
> and I can count way more than just fingers and toes.
>
> I have already pulled the HDD and moved it to a box that allows a
> Boot-From-CD, and have used a DOD-Level wipe tool to destroy all of the data
> on the HDD.
>
> The target machine hasn't got a floppy drive, and the CD will not boot.
> given the extensive damage that's been done, I have no idea what the
> operational status of the CD is -- maybe it doesn't work.
>
> In any case, I have a donor motherboard that has a good BIOS and will take
> the HDD, so I'm on my way to fixing the problems that the target machine
> has.
>
> When I get done with the MSoft Updates -- well in excess of 100 at last
> count -- then I will visit the Compaq Website for new BIOS.
>
> What I can't quite get my arms around is if the BIOS can keep me from
> connecting a newly formatted HDD from getting to the 'net. If the BIOS is so
> f---ed up that it won't allow the HDD top boot, then I'm toast. I'll have to
> find a way to download the BIOS, then getting it into the motherboard, but
> I've never crossed that bridge before.
>
> And, no other bridges count.
>

I just tested with my USB floppy drive, and the MSDOS floppy
booted from it. So the machine doesn't need a native floppy.
All it needs, is working USB boot code. At least the "dir"
command worked when I tried it.

Paul

From: Jeff Strickland on

"Paul" <nospam(a)needed.com> wrote in message
news:hsl3fi$hjo$1(a)news.eternal-september.org...
> Jeff Strickland wrote:
>
>>
>> I'm WAAAAY to dumb to say that the BIOS itself is the problem. I think
>> the BIOS is but one of so many problems that my ability to count is
>> challenged, and I can count way more than just fingers and toes.
>>
>> I have already pulled the HDD and moved it to a box that allows a
>> Boot-From-CD, and have used a DOD-Level wipe tool to destroy all of the
>> data on the HDD.
>>
>> The target machine hasn't got a floppy drive, and the CD will not boot.
>> given the extensive damage that's been done, I have no idea what the
>> operational status of the CD is -- maybe it doesn't work.
>>
>> In any case, I have a donor motherboard that has a good BIOS and will
>> take the HDD, so I'm on my way to fixing the problems that the target
>> machine has.
>>
>> When I get done with the MSoft Updates -- well in excess of 100 at last
>> count -- then I will visit the Compaq Website for new BIOS.
>>
>> What I can't quite get my arms around is if the BIOS can keep me from
>> connecting a newly formatted HDD from getting to the 'net. If the BIOS is
>> so f---ed up that it won't allow the HDD top boot, then I'm toast. I'll
>> have to find a way to download the BIOS, then getting it into the
>> motherboard, but I've never crossed that bridge before.
>>
>> And, no other bridges count.
>>
>
> I just tested with my USB floppy drive, and the MSDOS floppy
> booted from it. So the machine doesn't need a native floppy.
> All it needs, is working USB boot code. At least the "dir"
> command worked when I tried it.
>
> Paul
>

I'm sorry, but I have no Floppy. I only have a CD, and the Boot Priority is
set to boot from the CD first, but this does not happen.

I've got some serious issues going on here. I have no network, but the NIC
is built into the motherboard.

The CD is not recognized, but I can Eject with a right click. It shows up,
and if empty I am prompted to load a disc. But when the disc is in, it is
not read. I can right-click and chooes Eject, and the tray opens.

I need the drivers for the motherboard, and I probably need to burn the BIOS
in again.

This is a Work in Progress. ;-)