Article View: alt.sys.mac.newuser-help
Article #146Re: Just wondering about viruses
From: Terje Mathisen
Date: Wed, 05 May 1999 00:00
Date: Wed, 05 May 1999 00:00
46 lines
2809 bytes
2809 bytes
Erik de Castro Lopo wrote: > > David. E. Goble wrote: > > > > Hi All; > > > > I do not understand, how can a software program in RAM destory > > hardware and data in ROM/PROM??? > > --Regards : David. E. Goble > > goble@kin.on.net > > It can do this because the BIOS is stored in EEPROM : Electrically > Erasable Programmable Read Only Memory. This particular virus > erases the BIOS. Even though this is a technically correct answer, I'd still say that any PC which allows _all_ of the BIOS to be erased was designed to fail: IMHO the only proper way to handle this is to logically split the bios in two parts, where the first resides in a permanently write-protected part of the eeprom. amd the second can be modified: The first part contains enough of the startup code to enable booting from a floppy, which can then contain a program to reload a working bios. A more expensive alternative would be to have a true ROM backing the eeprom, and a motherboard switch/strap which enabled the rom version, preferably also allowing reprogramming the eeprom part. The company I work for has 20K+ PC's worldwide (100+ countries), so naturally we couldn't keep the anti-virus sw up to date on all of them, but CIH was limited to hitting 3 machines. Of these three two had a sensible bios, and the third allowed filling the eeprom with all FFs. This PC would also have suffered a permanent crash if we had had a power failure while loading a new (Y2K-compliant) bios update. Terje -- - <Terje.Mathisen@hda.hydro.com> Using self-discipline, see http://www.eiffel.com/discipline "almost all programming can be viewed as an exercise in caching"
Technical Details
Message-ID:
<7gq3a1$jae$1@autumn.news.rcn.net>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<cgw-2904991819270001@10.0.2.15> <redgate-3004990957420001@192.168.1.2> <cgw-0105991140540001@10.0.2.15> <redgate-0205991003500001@192.168.1.2> <7gohtp$84h$6@autumn.news.rcn.net> <7gphhd$ld$15@autumn.news.rcn.net>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10d683,8b3e5c24df691acc X-Google-Attributes: gid10d683,public X-Google-Thread: fe136,3231e0bfad520806 X-Google-Attributes: gidfe136,public X-Google-Thread: 114917,8b3e5c24df691acc X-Google-Attributes: gid114917,public From: Terje Mathisen <Terje.Mathisen@hda.hydro.com> Subject: Re: Just wondering about viruses Date: 1999/05/05 Message-ID: <7gq3a1$jae$1@autumn.news.rcn.net> X-Deja-AN: 474417134 Content-Transfer-Encoding: 7bit Approved: <johnfine@erols.com> References: <cgw-2904991819270001@10.0.2.15> <redgate-3004990957420001@192.168.1.2> <cgw-0105991140540001@10.0.2.15> <redgate-0205991003500001@192.168.1.2> <7gohtp$84h$6@autumn.news.rcn.net> <7gphhd$ld$15@autumn.news.rcn.net> Content-Type: text/plain; charset=us-ascii X-Mozilla-Status: 0801 X-Complaints-To: abuse@rcn.com X-Trace: XVzhwbf01eDbIOj50HFD3PKiF35bDytYjldCo6hxs4I= Organization: Hydro Mime-Version: 1.0 NNTP-Posting-Date: 5 May 1999 18:40:01 GMT Newsgroups: alt.sys.mac.newuser-help,aus.computers.ibm-pc,comp.lang.asm.x86