🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.sys.mac.newuser-help
Article #148

Re: Just wondering about viruses

#148
From: black_phantom
Date: Thu, 06 May 1999 00:00
45 lines
3294 bytes
  Terje Mathisen <Terje.Mathisen@hda.hydro.com> wrote:
> IMHO the only proper way to handle this is to logically split the bios
> in two parts, where the first resides in a permanently write-protected
> part of the eeprom. amd the second can be modified:
>
> The first part contains enough of the startup code to enable booting
> from a floppy, which can then contain a program to reload a working
> bios.

  AFAIK, that's exactly how BIOS updates are done. Except for that write-
protected part should handle booting from both floppy and hard disk: a
computer may simply lack FDD.

> A more expensive alternative would be to have a true ROM backing the
> eeprom, and a motherboard switch/strap which enabled the rom version,
> preferably also allowing reprogramming the eeprom part.

   Then what's an EPROM for? Write-protected ROM cannot contain an updated
EPROM backup. For (embedded) systems that don't have neither HDD nor FDD ROM
must contain only the basic version that allows loading to RAM the code that
updates EPROM - normally through serial connection or LAN. All the rest would
be redundant.

> The company I work for has 20K+ PC's worldwide (100+ countries), so
> naturally we couldn't keep the anti-virus sw up to date on all of them,
> but CIH was limited to hitting 3 machines.
>
> Of these three two had a sensible bios, and the third allowed filling
> the eeprom with all FFs.

   I'd say that the third PC's flash was erased but not programmed (erase sets
all contents to FFs). Something prevented virus from programming after it had
successfully erased the flash.

> This PC would also have suffered a permanent crash if we had had a power
> failure while loading a new (Y2K-compliant) bios update.

  Probably something like this happened to CIH between erasing and
programming.


-- Sclerosis cannot be healed but can be forgotten --

-----------== Posted via Deja News, The Discussion Network ==----------
http://www.dejanews.com/       Search, Read, Discuss, or Start Your Own    
Technical Details
Message-ID: <7gs4p2$a3o$1@autumn.news.rcn.net>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <cgw-2904991819270001@10.0.2.15> <redgate-3004990957420001@192.168.1.2> <cgw-0105991140540001@10.0.2.15> <redgate-0205991003500001@192.168.1.2> <7gohtp$84h$6@autumn.news.rcn.net> <7gphhd$ld$15@autumn.news.rcn.net> <7gq3a1$jae$1@autumn.news.rcn.net>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10d683,8b3e5c24df691acc
X-Google-Attributes: gid10d683,public
X-Google-Thread: fe136,3231e0bfad520806
X-Google-Attributes: gidfe136,public
X-Google-Thread: 114917,8b3e5c24df691acc
X-Google-Attributes: gid114917,public
From: black_phantom@my-dejanews.com
Subject: Re: Just wondering about viruses
Date: 1999/05/06
Message-ID: <7gs4p2$a3o$1@autumn.news.rcn.net>
X-Deja-AN: 474727640
Approved: <johnfine@erols.com>
References: <cgw-2904991819270001@10.0.2.15> <redgate-3004990957420001@192.168.1.2> <cgw-0105991140540001@10.0.2.15> <redgate-0205991003500001@192.168.1.2> <7gohtp$84h$6@autumn.news.rcn.net> <7gphhd$ld$15@autumn.news.rcn.net> <7gq3a1$jae$1@autumn.news.rcn.net>
X-Http-User-Agent: Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)
X-Mozilla-Status: 0801
X-Complaints-To: abuse@rcn.com
X-Trace: 1qY+9vKFilc7Hj2w4Zj7ckMVoxJSwjo5ia+ky8FyZko=
X-Http-Proxy: 1.1 x10.dejanews.com:80 (Squid/1.1.22) for client 192.116.192.187
Organization: Deja News - The Leader in Internet Discussion
X-Article-Creation-Date: Thu May 06 10:14:08 1999 GMT
NNTP-Posting-Date: 6 May 1999 13:17:22 GMT
Newsgroups: alt.sys.mac.newuser-help,aus.computers.ibm-pc,comp.lang.asm.x86