BIOS corrupted by Virus?

[cpvh]

Hi All,

I am running on impulse power at the moment (laptop) as the warp drive (Dell Tower) has died.

This happened a couple of hours after someone claiming to be from Microsoft rang and told my wife that they had detected we had a virus on the computer and offered to clean it up. He was sent away wit a flea in his ear (Told in no uncertain terms that he was a scammer). I am now wondering whether the computer in question already had a Key logger and some kind of remote control software installed on it and the death of the system is "revenge" for not signing up to their offer to "clean up the system". It seems a big co-incidence that it died so soon after their being told to go away.

To details........

Dell tower with XP SP3 and Norton 360 which has been on for good few years and replaced some form of NAV that has been on te 'puter since day one (approx 5 years). It has been coming up regularly with messages saying it's fixed this threat, and it's fixed that threat, but asummed that's just it doing it's job.

After my wife had sent the foreign (telephone number) man away, (computer was on at this time we think) she worked on other stuff (not computing) for a couple of hours, then went to the computer to check email. she was reading a PDF sent by our daughter's school when the computer froze. She restarted and got nothing but a blank screen and a fast running fan. It does light up the DVD drive LED a few times. An attempt to power the machine off just results in it trying to boot again.

I had a (brief) look at it last night and discovered the following.........

1. The screen is OK (works on the laptop)

1. Removing RAM results in the machine beeping (Suggests the BIOS and processor are funtioning??)

2. Putting just 2 of the 4 RAM sticks (DIMMS??) into 2 of the four slots (either the black or the white) stops the beeping, but the computer still just sits there with a blank screen and lights up the DVD drive). I haven't yet ad time to try all the sticks in all the slots.

I did wonder about trying to boot from the Dell recovery CD, but if i'm not getting even the Dell splash screen from the BIOS or any kind of hit F whatever to enter the BIOS type message, then I probably wouldn't get very far.

It may be that the HDD isn't spinning, (or perhaps it's doing it quietly (I was sat under the desk trying to do this).

Other thought was that the 'puter is actualy booting fine, and it's the built in VGA that's borked.

Then I thought, could it be that some kind of virus (or something else) had corrupted the BIOS either deliberately or accidentally) If so, it this fixable without having a working BIOS with which to boot to run the BIOS flashing program (If I have one??)???

I had a quick Google, but the articles I found on BIOS viruses all asummed that the computer was still able to boot into Windows

Any thoughts / helpgratefully recieved.

(Though suggestions to switch to linux at the grand old age of 49

99/100ths probably won't be followed up)

TIA

Chris

[Jeff Gaines]

That's a personal choice, but if you can get your hands on a Linux Live CD at least you could try booting to that to see if the PC works.

Do you get a message about 'unable to find system disk'? If so the HD may be borked.

[The Natural Philosopher]

Bios is ROM and relatively uncorruptible.

You MAY have lost some basic parameters in the flash RAM, o[ossibly due to malware. I cant remember the details, but generally if you can disconnect the battery (may be an onboard jumper) that powers this, you should get back to some form of default.

But the fact that the beepery works, suggests that the bios is to some extent functional.

A blank screen suggest perhaps a dead video card.

[Gareth]

I had a similar problem recently (apart from the phonecall) and I took the computer apart, removed all the cards then put the essential ones back then re-installed windows. That was a few months ago and it has been fine since.

I'm not sure what happened but I'm guessing that one of the cards wasn't in properly so removing and replacing it fixed the problem.

If your computer is 5 years old maybe take this as a good opportunity to upgrade?

I doubt it was revenge - if the scammers already had access to your computer then it would be more valuable to them working than dead and they could have much more fun logging your banking passwords and credit card numbers than simply breaking your computer.

[John Williamson]

Count the beeps and the pattern of long and short ones. Most BIOS systems have a code telling you what is stopping the machine from starting.

help.

Once you know this, you're partway to solving the problem.

It's *highly* unlikely that the BIOS has been corrupted by the remote user. It's almost certainly a coincidence.

[Andrew Gabriel]

Not on any computer manufacturered in the last 15+ years. BIOS corruption isn't very common though, and mostly happens during deliberate BIOS updates. Some M/Bs have a jumper to enable BIOS updates, but it's often left enabled.

Yes, and the CPU.

Pull out any add-in cards which are not essential for booting, and re-seat any that are.

[D.M.Chapman]

While it's possible, it's *highly* unlikely IMO. I'd be amazed if it was anything other than a coincidence.

So fairly old? Any idea what motherboard it is?

Good start, some sign of life from the BIOS then :)

No beeping at all in this state?

Are you getting any video signal at all? If it's a monitor that supports power saving does it appear to wake up at all?

Certainly that would be my first guess. Don't suppose you have a gfx card around to try? Probably AGP given it's vintage.

It's possible it's corrupted BIOS, but highly unlikely it's been caused by a virus. Dead BIOS is normally terminal - can't boot it to install new. Some older motherboards used to have two BIOS copies (gigabyte boards IIRC) but I suspect that's not going to help.

Some machines have a jumper that lets you reset the BIOS - if you can find the motherboard model you might be lucky

Given the symptoms you describe, I'd say gfx failure or motherboard chipset death. If it's onboard video (ie, no gfx card) then this could be the same thing.

If you aren't even seeing the BIOS screens, I don't think Linux would help :-)

Darren

[Dave Baker]

If you're not even getting P.O.S.T messages then it's most likely the monitor is simply not being driven. Try another graphics card first.

[John Rumm]

I suspect that is all it is - a coincidence. There is malware out there that will attempt to store itself in spare flash memory (typically motherboard or video card) so that it can survive reboot, and be present right from the start or the boot process. However this is relatively rare. Its also designed to allow the machine to boot with rootkit in place - not knacker it!

Probably...

Does the machine have onboard video or is it a separate card?

Yup chances are you are right...

Unlikely - you would still get a BIOS POST screen. Then a failure to boot with a error indication a disk problem.

Ah, built in... ok answers the question above.

If it were booting, you would expect the normal amount of HDD activity at startup, plus any startup sounds etc to still play.

Lets assume its getting stuck prior to getting as far as the start of the boot process. You have done one of the recommend things in swapping the RAM modules about.

Next I would be inclined to test the power supply. Power the machine on and check you can see all the expected voltages on the main power connector.

that checks out then, if there are any other expansion cards plugged into the motherboard, remove these and try booting again. If that fixes it, add them back one at a time and see if that stops it again - if so you have found your dead card, if not, you probably had a poor connection at a PCI slot which you have fixed by reseating the card.

If that does not work, remove all the drive connections from the mobo as well - so you now have bare mobo and power and nothing else.

If that does not work, then try resetting the CMOS - there ought to be a jumper on the main board to do this.

If that fails, look for a disable internal VGA jumper - see if that gets you a different beep code on startup. If you do, try plugging in graphics card and see if you can now boot with that. If you get no beep code with the internal mobo video disabled, then replace the motherboard[1].

[1] It may sound drastic, but for the cost of them, its not worth spending too much time titting about. Depending on the age of the machine and in particular it being a Dell, this can vary in difficulty. Beware some older dells had non standard PSU connectors and motherboard mounting holes. If yours looks standard in that respect, and the PSU claims to be good for 400W, then get a mobo processor and RAM combo and treat yourself to an upgrade in the process (chances are you won't find a current board for a 5 year old CPU and RAM).

[D.M.Chapman]

load you can get all sorts of random readings.

Another thing to check for is bulging capacitors. We certainly - there are usually some reasonably large caps around the powersupply connection. If any of these look swollen than it maybe the voltages on the board have all gone to pot. Of course, even if you raplce them you might find something else has been cooked - possibly something that's unable to be replaced as it's onboard gfx.

I've had several dells around this vintage and some of them the only way to disable the onboard vga was in the bios :-( Still, better than the bloody Acer x3200. Impossible to disable it completely - I just had to reduce it down to 16MB and ignore it :-(

Worth a look though - motherboard model would be really helpful to know.

Darren

[Sorcerer]

I've read the replies from the others and they've pretty much covered it - but I'll say power supply unit is borked. Easy enough to swap out and test but these symptoms are often the PSU failed.

[John Rumm]

Yup agreed

5 years could just be the tail end of the dodgy cap era, so worth checking certainly.

[tony sayer]

Good idea that just had a mates machine in here for just that very symptom. Changed the caps bit of a pain but..

Power units are the best known of misc screwed up PC faults try if you can swapping with a known good 'un ..

If you want to do a BOIS reset and can't locate the BOIS jumper then take out the CR2032 type battery for a few minutes and then re start, and see if that improved anything..

[cj]

Having read all post and in agreement one thing not mentioned is the processor fan. Have a dell as a backup around same age and if the processor fan is not running the d*"m thing won't post at all. Just a thought. CJ

[Mike Humphrey]

There was a virus that destroyed the BIOS - known as "CIH" or "chernobyl". It was quite a few years back, though, and as far as I know it's not in the wild any more - destroying the host PC isn't a good propagation strategy! Modern viruses are generally stealthy and aim take over the PC rather than destroy it - either to join a botnet or steal your information.

Mike

[Mike Humphrey]

If that's the case, the hard drive light will be flashing as it boots up. If there's no hard drive activity it suggests it's halting before it gets that far.

Mike

[michael adams]

Based on experience with Dell optiplexes.

You already mentioned memory. Which still sounds the most likely option.

One of the plus points with Dell is that they provide copious on-line documentation, for corporate lines anyway.

Go to the support page on the Dell UK site, type in the ID number found on a sticker on the back of the machine, and you can bring up a specification page. This will give the minimum memory requirement for the machine.

Which may only be one stick of RAM, depending on what youv've got. So it may be possible to try out each individual stick (in the slot nearest the CPU) one at a time.

Other things.

There's no need to swap out the hard disc, more especia;ly if you have a DOS floppy to hand. While any non DOS floppy loaded prior to switching on should generate an on-screen error message. Assuming that is, you haven't altered the default loading order. The drive should show signs of activity in any case. In any case the non appearance of the BIOS screen isn't dependant on the HD.

It's not likely to be fat caps - a known problem especially on Dell GX270's.. Bad caps typically give prior indications - freezes etc for months on end prior to total failure.

Its unlilkley to be the PSU given the fan is working and powering up the CD/DVD. In case it is, up until recently Dell PSU's used different wiring to standard PSU's and so generic PSU's are of no use. Both new and S/H Dell PSU''s are availablr on eBay although postage can be a killer. One advantage of buying SH from cannibalised machines is that these are usually UK sourced whereas new are often from the US with higher postage,

The only known virus with the potential to currupt flash BIOS only worked on windows 9X. And tyen only on certain mobos. None have been found on Win NT.

michael adams

...

[cpvh]

Many thanks for all the replys. I haven't been able to do any more with the machine, and probably won't have time to do much till next week. I will try pulling the BIOS battery though. We've now worked out the machine is at least 6 years old, so while I will try a few other things, I may give up and take the upgrade optin quicker then I usually do.

Best regards

Chris

[Lawrence]

Had a similar experience this weekend with my wife's laptop. When I tried to turn it on, the drive gave a quick wirr then it shut itself down with no sign of anything on the screen. My first thought was power supply and I checked everything I could and all seemed ok. My daughter went off to google on her PC and came back a couple of minutes later saying she knew what the problem was, something to do with static charge build up!! She insisted we remove the battery and disconnect the power supply, push the on button for at least 30 seconds, reconnect the battery and try again. It worked. I felt very humble. Lawrence

[John Rumm]

What she effectively did was a full cold boot - i.e. from a true power off starting point - something not always easy with laptops. The "static charge build-up" was just a bit of new age technobable to go with it!