Win32:Pup-gen (Pup)

[Pondus]

When You use the recovery, there usually is an option......do you want to format.......option

Bios has nothing to to with the recovery partition/disk.    It is stored on a flash chip on the motherboard


Bios    http://en.wikipedia.org/wiki/BIOS

[qim]

Thanks Pondus

I understand now.

qim

[Pondus]

Some interesting read about Bios malware


http://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/

http://www.howtogeek.com/forum/topic/bios-malware

http://www.symantec.com/connect/blogs/bios-threat-showing-again

[qim]

Hello Pondus

Thanks for the links. Is there any way of checking if my Bios and memory are clean?

qim

[Pondus]

Well You can follow essexboys guide and attach the logs so he can have a look
http://forum.avast.com/index.php?topic=53253.0

[qim]

Hello Pondus, here they go (sorry, but I could not find a save option for ainsi format):

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.01.31.03

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
Camilo :: YOUR-CD66F796A2 [administrator]

31-01-2012 7:49:18
mbam-log-2012-01-31 (07-49-18).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 235799
Time elapsed: 43 minute(s), 19 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 3
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKCR\scrfile\shell\open\command| (Broken.OpenCommand) -> Bad: ("C:\Program Files\Internet Explorer\Iexplore.exe" %1) Good: ("%1" /S) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[SafeSurf]

Thank you qim for providing your logs.  They came through fine and readable.  I am going to contact our malware removal expert named Essexboy to assist you further.  He does not come on the forum until late UK time zone (after 18:00 / 8 PM).

In the meantime, do not use this machine or sync it with anything and remove it from a network if it is on one.  If you have another machine to go on the forum that would be ideal, if not, then use this one.

Let me know if you have any questions.  Essexboy will be giving you further instructions to follow to resolve your problem.

NOTE:  Essexboy has been notified.

[Pondus]

Hello Pondus, here they go (sorry, but I could not find a save option for ainsi format):

Since the log`s are readable you did.....if not they would look like chinese   

[essexboy]

They look clean ..  And to be honest a BIOS virus is more of a mind exercise  than an actual reality

What are the major problems you are experiencing

[qim]

Well, as I mentioned at the beginning I had a dying computer that somehow got revived, but only after some fatal errors after reinstalling the recovery disc. One possibility was that the Bios was infected and Pondus suggested you had a look at the logs.

In fact, the computer works well now under SP2. Another possibility is that Toshiba never managed to get a good  graphics driver for the SP3.

I cannot understand why the Recovery disc started off with blue screens pointing to the graphics driver. When it finally started MS came up with various boxes mentioning grave errors and asking to let hme know,  Then, everything started to work well. I can send you the info from the Event Viewer if that is any help.

qim

[essexboy]

It may be that windows reverted to native video drivers rather than using the one with the installation disc

[qim]

Thanks Essexboy

I thought that when you reinstall Windows with Toshiba's recovery disc you end up with a computer/system as when you first bought it. As it did not have any errors originally, but had them when I reinstalled, I assume that either there is a fault with the hardware; or that that same hardware was modified since I bought it (Bios/memory and I don't know what else). Is that more or less what the situation is? And how can I know that those changes, if they took place, are not the result of a virus? Were you able to see in the logs references to the Bios or the memory?

Thank you very much.

qim

[essexboy]

The logs do not look into the BIOS you need specialist tools to do that ..  And I have never had a need to use them

As for the memory I look at the programmes/services start points and go from there

But I could see no apparent malware there