Article View: alt.sys.mac.newuser-help
Article #148Re: Just wondering about viruses
From: black_phantom
Date: Thu, 06 May 1999 00:00
Date: Thu, 06 May 1999 00:00
45 lines
3294 bytes
3294 bytes
Terje Mathisen <Terje.Mathisen@hda.hydro.com> wrote: > IMHO the only proper way to handle this is to logically split the bios > in two parts, where the first resides in a permanently write-protected > part of the eeprom. amd the second can be modified: > > The first part contains enough of the startup code to enable booting > from a floppy, which can then contain a program to reload a working > bios. AFAIK, that's exactly how BIOS updates are done. Except for that write- protected part should handle booting from both floppy and hard disk: a computer may simply lack FDD. > A more expensive alternative would be to have a true ROM backing the > eeprom, and a motherboard switch/strap which enabled the rom version, > preferably also allowing reprogramming the eeprom part. Then what's an EPROM for? Write-protected ROM cannot contain an updated EPROM backup. For (embedded) systems that don't have neither HDD nor FDD ROM must contain only the basic version that allows loading to RAM the code that updates EPROM - normally through serial connection or LAN. All the rest would be redundant. > The company I work for has 20K+ PC's worldwide (100+ countries), so > naturally we couldn't keep the anti-virus sw up to date on all of them, > but CIH was limited to hitting 3 machines. > > Of these three two had a sensible bios, and the third allowed filling > the eeprom with all FFs. I'd say that the third PC's flash was erased but not programmed (erase sets all contents to FFs). Something prevented virus from programming after it had successfully erased the flash. > This PC would also have suffered a permanent crash if we had had a power > failure while loading a new (Y2K-compliant) bios update. Probably something like this happened to CIH between erasing and programming. -- Sclerosis cannot be healed but can be forgotten -- -----------== Posted via Deja News, The Discussion Network ==---------- http://www.dejanews.com/ Search, Read, Discuss, or Start Your Own
Technical Details
Message-ID:
<7gs4p2$a3o$1@autumn.news.rcn.net>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<cgw-2904991819270001@10.0.2.15> <redgate-3004990957420001@192.168.1.2> <cgw-0105991140540001@10.0.2.15> <redgate-0205991003500001@192.168.1.2> <7gohtp$84h$6@autumn.news.rcn.net> <7gphhd$ld$15@autumn.news.rcn.net> <7gq3a1$jae$1@autumn.news.rcn.net>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10d683,8b3e5c24df691acc X-Google-Attributes: gid10d683,public X-Google-Thread: fe136,3231e0bfad520806 X-Google-Attributes: gidfe136,public X-Google-Thread: 114917,8b3e5c24df691acc X-Google-Attributes: gid114917,public From: black_phantom@my-dejanews.com Subject: Re: Just wondering about viruses Date: 1999/05/06 Message-ID: <7gs4p2$a3o$1@autumn.news.rcn.net> X-Deja-AN: 474727640 Approved: <johnfine@erols.com> References: <cgw-2904991819270001@10.0.2.15> <redgate-3004990957420001@192.168.1.2> <cgw-0105991140540001@10.0.2.15> <redgate-0205991003500001@192.168.1.2> <7gohtp$84h$6@autumn.news.rcn.net> <7gphhd$ld$15@autumn.news.rcn.net> <7gq3a1$jae$1@autumn.news.rcn.net> X-Http-User-Agent: Mozilla/4.0 (compatible; MSIE 4.01; Windows 95) X-Mozilla-Status: 0801 X-Complaints-To: abuse@rcn.com X-Trace: 1qY+9vKFilc7Hj2w4Zj7ckMVoxJSwjo5ia+ky8FyZko= X-Http-Proxy: 1.1 x10.dejanews.com:80 (Squid/1.1.22) for client 192.116.192.187 Organization: Deja News - The Leader in Internet Discussion X-Article-Creation-Date: Thu May 06 10:14:08 1999 GMT NNTP-Posting-Date: 6 May 1999 13:17:22 GMT Newsgroups: alt.sys.mac.newuser-help,aus.computers.ibm-pc,comp.lang.asm.x86