Bios rootkit in the wild (still rare)

RussJK

http://blogs.norman.com/2011/malware-detection-team/mebromi-a-bios-flashing-trojan

We had the Win9x virus CIH in 1998, which had BIOS flashing as part of its destructive payload. CIH did not even try to program anything; it just wrote garbage to BIOS which caused machines to hang when attempting a reboot. Later, there has been research in the area of BIOS injections by a number of researchers, but this has been more or less proof-of-concept code.

Mebromi is a real malware. The dropper file installs the following files:
bios.sys, which is the driver that handles BIOS flash IO.
flash.dll, handles loading and unloading of the bios.sys service
my.sys, a rootkit driver
hook.rom, an uncompressed BIOS ISA module file containing the malicious code
cbrom.exe, a legitimate BIOS combination utility

This one only works on computers with an Award BIOS.

The rootkit adds an extra check on POST to make sure the MBR is still infected, and reinfect it if necessary.

RussJK

Norton have done a good writeup as well:
http://www.symantec.com/connect/blogs/bios-threat-showing-again

GunJack

nice find russ....these people who write such stuff are tw*ts :mad: