TROJ_MYBIOS.AB

This malware is a Basic input/output system (BIOS) and Master Boot Record (MBR) infector.

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following files:

• %System%\drivers\bios1.sys - used to flash the BIOS
• %User Temp%\cbrom.exe - legitimate Award Bios Editor
• %User Temp%\hook.rom - contains the malicious boot sector codes.
• %Windows%\flash.dll - used to load the malicious bios.sys
• c:\my.sis - responsible for protecting and hiding the infected boot sector.
• c:\bios.bin - contains the BIOS codes
• %System%\drivers\bios2.sys - copy of bios1.sys

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

NOTES:

This malware is a Basic input/output system (BIOS) and Master Boot Record (MBR) infector.

To load its component files, the malware stops the service "Beep". It replaces the legitimate file beep.sys in the %System%\drivers and %System%\dllcache with its own driver:

• The legitimate file %System%\drivers\beep.sys is renamed to %System%\drivers\beep.sys.bak
• The malicious file %System%\drivers\bios1.sys is renamed to %System%\drivers\beep.sys
• The malicious file %System%\drivers\bios2.sys is renamed to %System%\dllcache\beep.sys

It then starts the service "Beep" again to load its own component. It restores the original files once execution is completed.

It may also use the the file %Windows%\flash.dll to load bios.sys without having to modify the "Beep" service.

This malicious beep.sys/bios.sys is responsible for the I/O communication between user & kernel modes, as well as the undocumented "flashing" method to modify the BIOS.

It checks if the affected system is using Award BIOS and if it does, the malware copies the BIOS into the file c:\bios.bin and checks it if is already infected. If the BIOS is not yet infected, the malware drops the legitimate Award BIOS editor cbrom.exe in %User Temp% and executes the following command:

• cbrom.exe c:\bios.bin /isa hook.rom

The infected BIOS infects the MBR with the contents of hook.room. If infecting the BIOS fails, it directly infects the MBR with the contents of hook.rom.

The infected MBR patches winlogon.exe or wininit.exe depending on what Windows operating system is installed. The patched code .EXE file downloads a file from the following URL:

• http://{BLOCKED}5.info:806/test/91/calc.exe

This is also responsible in loading the file c:\my.sys.

The file is saved as c:\calc.exe.