Where's the virus?

[tbob]

OK, let's see if anyone can figure this one out. It's a long story, but the question is at the bottom.

ABIT KT7
WD 80gb (boot)
WD 120gb
SB Live Drive II
Radeon ATI (TV)
Netgear

System Commander boots to:
XP(primarily), 98SE, DOS

Use the system primarily for video editing. Just using the computer one day, and I hear the hard drive lock up suddenly. The whole system is frozen, no mouse movement. Hard reboot. The same lockup happens a few times more after hard reboots. Usually right at the end of windows fully loading, or 10-60 minutes into use. Also, the DVD+RW drive spins up and down constantly. Takes 20 minutes just to access a file on a CD. Virtually useless. Checked the IDE, HD cables and it seems unrelated. Now when I reboot, the Award BIOS (w/ antivirus system on) warns me that my computer may have a virus and I should check it out. I boot up, scan the whole thing with the Norton AV that was always installed on this computer.

Keep in mind that this computer is not connected to the internet, and I use another computer to download files, burn to a CD, then transport over. So that means the virus definitions aren't 100% up-to-date, but at least within the month. This started happening Sept 2004.

Scan completes, comes up with nothing, so I reboot-and-lockup a few more times. Now each time I reboot, Award tells me that my "boot sector is to be modified". It usually says this while I'm in the System Commander menu. At this point also, the SysCom menu is starting to look really garbled. If I 'press any key to abort', the system reboots and comes up with the same thing... so I press 'Y' to continue and accept the modification. Computer boots fine then locks up again. Every time I boot, "the boot sector is to be modified".

I leave for a month and a half.

I come back, and the computer still boots with the "...modified" warning. I press 'Y'. From that boot on, the whole system works fine again. Everything is totally great for about a week. Then I start getting the "...modified" message on boots. And then finally, we go back to locking up. So I got a new hard drive for christmas, so I put that in (WD80gb w/8mb), and take out the other two hard drives and start to install from the XP pro disc that I had before. But the disc won't even spin up, so I can't start the Windows setup.

Now it gets tricky. I also have a Dell Dimension 8200 computer that I pulled the original 120GB and DVD+RW drive from. So I empty out everything from the Dell and put the same set of cards & hardware that was in the ABIT system into the Dell system. I think I may have once booted from the "w/8mb" hard drive in the dell system by accident before I got the "installation CD" in. I only mention this because I'm wondering if somehow I transferred a virus from BIOS to BIOS.

The Dell reboots itself. Constantly. I can get half way through a windows install a few times, but it just keeps rebooting and rebooting and rebooting seemingly randomly. I try jiggling the IDE and power cables, but that doesn't cause the reboot. I think it could have been a PCI card jiggling, but I didn't test that theory.

My big mistake is that I call Dell tech support. On hold for hours (this is around christmas), and then speaking in broken english to people who can't understand me and I can't understand them. Big waste of time. I ask if I can just send my machine back and have someone else take a look at it, and she says "No, we don't have any technicians that can come to your house." You see what I'm dealing with here.

So I just try putting every thing back into the ABIT machine again, and install windows XP. It works. Totally fine. When I start the windows xp installation, I get the Award "...modified" message once, and press 'Y' once, and it never asks again. I should mention, though that the boot sequence is abnormally long, and the computer is a bit more sluggish than I recall it was on the original hard drive (even with tons of software installed)

So I plug it into the internet (Verizon DSL, which if anyone's a user, they know how idiotic the install software is) to start getting the windows updates. I get through one or two 'waves' of updates. Before long, I notice that my dsl 'activity' light is blinking like crazy, even when my machine's doing 'seemingly' nothing. The computer is really sluggish and any internet access takes forever.

So I install ZoneAlarm and some antivirus software, and find that in this narrow window of time that my computer has been online, seven of my files have become infected with worm/Agobot and worm/Sdbot. One of the infected files, I can't remove.

So I format that hard drive (the WD80gb w/8mb cache), and install windows xp again, this time installing Zonealarm and Antivirus software *before* connecting to the internet. ZA keeps telling me that there are other computers trying to access mine, and since I haven't used this software before, I don't know how normal that is. Anyway, I can't seem to get windows update to work anymore (it won't connect to its server) and I'm wondering if I've got something or if ZA is preventing me from connecting. Something keeps trying to connect to my computer over port 445, so I'm wondering if that's microsoft or not. I think I can handle installing things from here, but the road I took baffles me.

So my real question is: Does anyone know of a virus that could have done the following?
1)infected itself in the boot sector of system commander
2)moved into the BIOS of my ABIT system
3)moved from the BIOS into a brand new hard drive
4)moved from that hard drive into a brand new Dell BIOS

or is this just an elaborate set of coincident hardware failures?

 

[montag451]

I don't think there are BIOS to BIOS viruses around, yet.
There are viruses that might be able to screw with the BIOS, but they can't spread between bioses, only files.

Same goes with bios to hard drive.

what is your hardware setup?
As in RAM, cpu, mobo bios version, voltages of system, temperatures, psu?

if you have a spare vga card you can use, try that.

Try disabling all onboard peripherals ie sound/NIC/USB
Take out all non-essential hardware - only keep boot hdd, ram, cpu, power, vga - nothing else.
See what happens.
Let us know

 

[meltdown75]

at first reading through your story, i was convinced that the trickery of Dell might have had something to do with your problem, perhaps a boot partition or something. HP puts those on, not sure about Dell. either way when i get one in for repair, i usually nuke the crap out of everything if possible.

i can tell you that ZoneAlarm is pretty thorough in that it logs every attempt to contact your computer. Even your ISP pinging you is logged as some sort of security threat. i turn my alerts off, it only goes off when there is a new program trying to access the net.

 

[tbob]

OK, so I'm the fool. I found out that it was a power cable attached to the ABIT KT7 board. Changed the power connection to that new 'WD 80gb w/8' drive, and system seems stable. Still don't know why it didn't work in the dell, though. Almost don't care at this point.

Had to disable Zone Alarm to get windows update beyond a certain point. After that update, though, (somewhere before SP2) WindowsUpdate would work even with ZoneAlarm's firewall on.

Good to know that ZoneAlarm barks at anything that moves. Didn't know why so many computers were coming after me! I've since disabled it and just put up the SP2 firewall. Seems to work fine. Also have taken that computer back off the internet.

Antivir also seems to bark a lot, too. At even a sign of a virus. I had both that and Norton installed, and Antivir would speak up long before Norton would catch on. However, I think Norton's more stable, so I ditched AntiVir.

Good to know my mythical virus doesn't exist. Hope I haven't given anyone any ideas. Thanks!

 

[montag451]

you had 2 antivirus installed????

ah well, at least the problem is now fixed

 

[tbob]

Can you tell me why having two antivirus softwares simultaneously installed is bad?

 

[montag451]

VERY bad.
Can cause memory problems [not in the hardware itself] and cause crashes.
Wow, you have been very lucky.

I would personally uninstall Nortons - it has a big footprint compared to some other progs.
If your antivir is a bit flaky, that might also fix it.
But to be sure, I would uninstall them both [with a reboot imbetween] then reinstall my chosen lovely antivirus prog.

 

[daniel49]

been running norton and avg together for 6 months no propblems???guess I'm lucky.

on the other hand have seen bsod's on other machine and the only new installs there were foxfire and microsoft antispyware software anyone had problems with that?

 

[mechBgon]

1) get a router to take the brunt of the attacks, that's about $40 well spent

2) ZoneAlarm is doing its job. You can tell it not to alert you to everything it blocks, so it doesn't drive you crazy.

3) If you can reach Windows Update but it won't work, then check your system's time and date. Downloading Service Pack 2 in its entirety might be a good idea in the meantime: http://www.microsoft.com/downloads/deta...-4f30-8245-9e368d3cdb5a&displaylang=en

 

[Gentle]

ZoneAlarm is my personal all-time favorite piece of software.

I've been using it for almost 5 years now and it's been great.

Yes, turn off the intrusion notifications.

If you want to, occasionally look in there to see if anything looks strange, but for the most part you can let it do it's job.

But it is vital (now-a-days) to have a firewall active BEFORE you connect the machine to any form of broadband internet for the first time.

Gentle

 

[tbob]

The one thing I would say about ZoneAlarm, though... you can't disable it! Seems like you have to completely uninstall to get it to not run on startup... am I missing something? I just have computers that are periodically connected, then not connected to the internet. Pretty heavy video rendering going on, so I like to minimize background proc. when I'm not online.

 

[montag451]

Originally posted by: Tbob
The one thing I would say about ZoneAlarm, though... you can't disable it! Seems like you have to completely uninstall to get it to not run on startup... am I missing something? I just have computers that are periodically connected, then not connected to the internet. Pretty heavy video rendering going on, so I like to minimize background proc. when I'm not online.

Right click the taskbar ZA icon
Select SHUTDOWN ZoneAlarm

 

[mechBgon]

You can set it to start at system startup or not. Look through all the tabs on the configuration panels, it's in there.