fake cmos enter code or all data will be erased issue

[mac_shinobi]

Got a Lenovo T400 today, I think the issue is either

 

1. The MBR on the hard drive

2. The CMOS has been altered

 

Everytime you boot without the hard drive you don't seem to get the message but as soon as you have the hard drive in you get a message something to the effect of

 

Important, if you do not enter the correct code all data will be erased / wiped, to get a valid code please send payment to

 

Enter Code

 

Most of the text is in yellow / red and I know is fake

 

Can't get into safe mode or any where near windows so please dont suggest safe mode etc

 

Tried to boot the laptop using an XP SP 3 disc and it gets to the part where it states to press any key to boot / install xp.....

 

so I press any key on the keyboard and then the screen goes blank / black, normally it loads the xp setup with a blue background etc but none of this happens.

 

I got the bios updater from Lenovos website and that booted fine and updated the bios but the virus or whatever it is , still resides in the cmos / bios.

 

I did do a quick format on the drive in question ( hard drive that is ) but its still the same so I am guessing this did not touch the MBR of said drive.

 

Any suggestions on how to clear the cmos safely and get rid of this extra code that is malware / trojan / virus ( should not be there )

 

I will try and clear the MBR through an active disk or by having it attached externally on my machine and getting to the recovery console on my machine and doing it that way and see if that helps

 

Anything else I can do or try ??

[eddyc]

Sounds like it maybe a rootkit virus. Could you try using the ultimate boot cd and adding the latest combofix onto the disk and running that? Combofix has saved me formating machines so many times and seems to be great at rootkit removal.

ComboFix Download

[morganw]

You could try boot a Linux live cd and installing it, it would replace the MBR with an alternate boot loader so if that installs and boots then you know it's something malicious that was in your MBR. If you cannot install it then that would suggest something more serious, i.e. somehow it's got into BIOS but I wouldn't have thought that is likely, particularly if you can re-flash it with no problems.

[SYNACK]

It does sound like a hard drive isolated thing, try it with a different drive to make sure. If it still shows up with a different hard drive installed then it may have compromised the firmware, that is a back to factory repair if a BIOS upgrade does not fix it. There are things that can infect the firmware of the keyboard and so even a BIOS upgrade will not cook them but this is unlikely given the lack of error when you boot with no drive.

 

I would do a low level format of the HD in question and maybe a boot and nuke wipe an see if the problem persists. If it does try booting with the keyboard detached and using a usb keyboard. The other unlikely scenario is that the hard drive firmware has been compromised, if so it may be worth looking for any HD firmware updates that are avalible in order to reflash the HDs firmware.

 

I have never personally encountered any viruses that have compromised the system that thoroughly but they do exist at least in highly targeted proof of concept attacks.

[Arthur]

First of all download MBRCheck from here and run it on the laptop. This will tell you if the MBR has been modified (green = / red = ). To double-check you can also use GMER.

 

http://i.min.us/im8VBY.png

 

If it is a MBR rootkit (Mebroot, Torpig/Sinowal etc.), all you need to do is simply recreate the MBR via the recovery console or the command prompt on a Windows Vista/7 install disc (see below for the commands to use). Symantec also have a removal tool for Mebroot here which rewrites the MBR.

 

Just to be sure there aren't any other nasty's lurking on the HDD I would scan it using a bootable anti-virus disc (AntiVir, Kaspersky etc.).

 

For XP run fixmbr and with Vista/7 run bootrec.exe /fixmbr. With the latter OSs you can also completely rebuild the BCD but this probably isn't necessary...

 

RebuildBCD.cmd

bcdedit /export C:\BCD_Backup
c:
cd boot
attrib bcd -s -h -r
ren c:\boot\bcd bcd.old
bootrec /RebuildBcd

 

As a last resort you can wipe the HDD using DBAN or HDDErase, but 99% of the time recreating the MBR will kill the rootkit.

 

BIOS-level rootkits are extremely rare and it's unlikely to be the HDD or keyboard firmware either.