Questions on CMOS flashing vs. bios upgrades

**granto** · February 27th, 2006, 11:05 PM

I have a laptop that I suspect has a virus in the CMOS that keeps writing to the MBR every time I boot up. Why I came to this conclusion is a long story, if you're really curious I can tell you but I'd like to rule this out first....

Anyways, I want to totally flash the CMOS. Kill it completely.

My question: Do BIOS upgrading utilities accomplish this? Is there a difference between using these utilities and actually flashing (i.e. using the flash jumper setting or removing the battery?) How about from a virus point of view? It seems to me that it is flashed. Worst of all, it's my aunt's compaq and I can't tell what the software does.

I also want to know the best route to a clean XP install that will avoid any virus transmission to the MBR. My plan of action: FDISK the hell out of everything, reboot, flash BIOS, and clean install XP.

**geoscomp** · February 28th, 2006, 10:32 AM

Originally Posted by granto

I have a laptop that I suspect has a virus in the CMOS that keeps writing to the MBR every time I boot up. Why I came to this conclusion is a long story, if you're really curious I can tell you but I'd like to rule this out first....

I'm really interested...why don't you think it is a mbr virus (which is relatively common) instead of a cmos virus (which isn't)?

**Ferrit** · February 28th, 2006, 12:41 PM

Ok flashing as you say by the jumper or removeing the battery doesn nothing except reset the bios/cmos back to factory specs.
Updating the bios/cmos by a file upgrades so that it usually corrects errors or gives better support for larger drives as an example.
Now as to a virus in the mbr. Its possible but unlikely and its usually fixed by preforming a zero fill on the harddrive using a utility provided by the harddrive
manufacturer.
Something to note is that alot of laptops either have the bios on the harddrive in a hidden partition or at the very least a hidden partition with the restore files in it.
Zero fill would remove that so you might want to think about that.
Little more information as to why you think you have a mbr virus might help.

**granto** · February 28th, 2006, 04:11 PM

alright, really I have no idea where the virus is.

Every time I try to clean install XP, I get a different error, mostly just freezes or I get the blue screen saying I'm missing a variety of different files.. but it varies. This is after putting in a new HDD. BIOS Hard Drive Check runs fine. And I've tried 2 separate XP disks.

So I thought there was a CMOS virus, I dont' know, I mean I knew it was in the MBR but I thought that my formatting with the XP install would clear the MBR so my next thought was CMOS. Can fdisk clear the MBR or must I zero fill? Please help me with the zero fill. And, what is a good indication of a CMOS virus vs. a MBR virus. Once I zero fill, how do I recover the MBR? When I clean install XP, it always leaves 8mb of "unpartitioned space," which I wonder is the MBR or what? Thanks for the help everyone. g

**BOB IROC** · February 28th, 2006, 04:39 PM

There may be no virus at all. I would run a diagnostic on your RAM. You could have a bad memory chip. I think this is the one I have used in the past http://www.majorgeeks.com/MemTest_d350.html.

**geoscomp** · February 28th, 2006, 05:29 PM

Thats what I was thinking too..also, go into the bios and set failsafe dafaults if you have that option.

**granto** · February 28th, 2006, 06:40 PM

Another thing. I have an NTFS formatted c: drive (from the last of many xp install attempts). If I put in a boot disk (i.e. dos 6.22 disk from bootdisk.com) and type in c: I get the message "the system cannot find the specified drive" So fdisk here is impossible from here.

When I go into the recovery console and type fixmbr, and reboot to the bootdisk, I get the same error message when typing c:. Listing all partitions in fdisk doesn't show my c:. I've seen some things where this is an indication of an MBR virus, but it seems like it might be in my cmos since it keeps up after typing fixmbr which is essentially like typing fdisk /mbr. So help me with the zero fill, since I gather that mixmbr doesn't tackle all of the mbr. Thanks g

**granto** · February 28th, 2006, 06:42 PM

Yes but won't a MBR virus hang in the memory also? For that reason I wonder if it would be helpful. Is there a way to flush the RAM? After fixmbr I went directly to xp install. If it doesn't work (I'm sure it won't).. I'll try the memtest.

**granto** · February 28th, 2006, 07:10 PM

Holy mother of god, not to get anyone excited but I think it might go through with the install. It's setting up right now.

**granto** · February 28th, 2006, 07:36 PM

Yeah I've got a knack for speaking too soon... It crashed during setup. But, trying again, it crashed in the same way. In fact, why I think it's an MBR virus and not memory is that every time I reinstall the error is different but reproducible upon rebooting... like it's corrupting a specific sector of the HDD. Discuss, I'll keep working. Oh, does anyone know about clearing CMOS by removing power sources and holding down the power button?

**shamus** · February 28th, 2006, 08:05 PM

So this is after a FDISK /MBR then a total delete of all partitions with FDISK and a FORMAT?

**street1** · February 28th, 2006, 08:06 PM

1: It sounds to me like you have bad sectors on your {maybe failing }hard drive.
2: You may have a bad install disk or cd-rom.

**granto** · February 28th, 2006, 08:36 PM

The hard drive is brand new and it's the same problems as on an old one. A BIOS utility says it's fine. The laptop itself is only around a year old. The disk is good, but I've tried others just in case.

It was after a fixboot, fixmbr, format c:, xp install. Right now I can't get into C:, even with a bootdisk.. gonna try the ultimate boot cd right now. So fdisk is out of the question, even the memtest and the zap are (dammit). Now (and this varies with installs) I can't get to the basic recovery console stuff because it wants an admin passwd???? Though that is the case after yet another one.

**granto** · February 28th, 2006, 09:39 PM

HA! Very true. It's a compaq presario 2500. It's my aunts (what a horrible company)

**geoscomp** · February 28th, 2006, 10:24 PM

In fact, why I think it's an MBR virus and not memory is that every time I reinstall the error is different but reproducible upon rebooting.

This is exactly the type of thing that bad memory will produce..the original information is corrupted, but the things written to the hard drive remain the same. RAM by it's nature is flushed every time the computer is shut down..it cannot hold data with no power, and a cmos virus would have made the machine impossible to boot anyway. Have you tried the memory test proposed?

If I put in a boot disk (i.e. dos 6.22 disk from bootdisk.com) and type in c: I get the message "the system cannot find the specified drive" So fdisk here is impossible from here.

DOS only recognizes FAT and FAT32 partitions, not NTFS..if instead of doing that you boot from a standard windows 98 bootdisk, and type in fdisk, it will show up as a non dos partition.