Virus that can survive a reformat ?

rrrh1 · Dec 14, 2007

Virus that can survive a reformat ?

I remember a discussion on a forum about a proof of concept virus that used either the "host protected area (HPA)" or "device configuration overlay (DCO) area of the hard disk drive to survive a reformat.

Does anyone here know of such an animal ?

rrrh1(arch1)

;-)

rrrh1 · Dec 15, 2007

Use
HPA can be used by various booting and diagnostic utilities, normally in conjunction with the BIOS. An example of this implementation is the Phoenix FirstBIOS, which utilizes BEER (Boot Engineering Extension Record) and PARTIES (Protected Area Run-Time Interface Extension Services).
Computer manufacturers may use the area to contain a preloaded OS for install and recovery purposes (instead of providing DVD or CD media).
HPA is also used by various theft recovery and monitoring service vendors. For example the laptop security firm Computrace use the HPA to load software that reports to their servers whenever the machine is booted on a network. HPA is useful to them because even when a stolen laptop has its hard drive formatted the HPA remains untouched.
HPA can also be used to store data that is deemed illegal and is thus of interest to government and police computer forensics teams.
Some vendor-specific external drive enclosures (Maxtor) are known to use HPA to limit the capacity of unknown replacement hard drives installed into the enclosure. When this occurs, the drive may appear to be limited in size (e.g. 128GB), which can look like a BIOS or Dynamic Drive Overlay (DDO) problem. In this case, one must use software utilities (see below) that use READ NATIVE MAX ADDRESS and SET MAX ADDRESS to change the drive's reported size back to its native size, and avoid using the external enclosure again with the affected drive.
Some rootkits hide in the HPA to avoid being detected by anti-rootkit and antivirus software.
Dell notebooks hide Dell Media Direct utility in HPA. IBM and LG notebooks hide system restore software in HPA.
Click to expand...

The above from http://en.wikipedia.org/wiki/Host_Protected_Area

Uses

* HPA can be used by various booting and diagnostic utilities, normally in conjunction with the BIOS. An example of this implementation is the Phoenix FirstBIOS, which utilizes BEER (Boot Engineering Extension Record) and PARTIES (Protected Area Run-Time Interface Extension Services).

* Computer manufacturers may use the area to contain a preloaded OS for install and recovery purposes (instead of providing DVD or CD media).

* HPA is also used by various theft recovery and monitoring service vendors. For example the laptop security firm Computrace use the HPA to load software that reports to their servers whenever the machine is booted on a network. HPA is useful to them because even when a stolen laptop has it's hard drive formatted the HPA remains untouched.

* HPA can also be used to store data that is deemed illegal and is thus of interest to governement and police computer forensics teams.
Click to expand...

The above from http://www.forensicexams.org/content/view/1510/242/

The theory was similar to computrace(tm) that when the computer was reconnected to the internet it would reinstall the virus / malware.

I am still looking foe the origional article...

rrrh1(arch1)

:-(

Log in or Sign up

Virus that can survive a reformat ?

rrrh1 Registered Member

rrrh1 Registered Member

Log in or Sign up

Virus that can survive a reformat ?

rrrh1 Registered Member

rrrh1 Registered Member

Useful Searches