I had an interesting situation. I have some AT mainboards and 3 ATX mainboards, as I have space I decided to get some casings and make computers, especially that I have all other components. I found 3 cheap ATX casings from early 2000s to put Athlon and Pentium II into, and decided to buy them. When I asked about other old computer stuff, the seller replied that he has an old Duron mainboard, but it HAS A VIRUS, so he can give it to me. I agreed of course, as I am just curious how there can be a virus in the mainboard. The seller told me that the virus "puts icons in favorites and changes startup page".
Here's what I found:
The mainboard is ECS K7VZA mainboard with Duron 600MHz (first model). The BIOS, Award-Phoenix 6.00PGN, a very early version from March 2000, is very buggy and tends to do some stupid tricks when two DIMMs of different sizes are present - like flipping one specific bit of the memory during read. I installed a RiVA TNT2 graphics board, a Realtek network card (sound card with SB emulation was present onboard) and installed it in casing. Put a blank drive and made Win98, no network cable attached.
Right after the first Windows 98 boot, something happened. Six files popped into the system: 3 ICO files in Windows directory and a bookmark, as well as desktop icon. Additionally, IE start page got changed to some unknown address (now it's a link farm), but update to IE6 changed it back.
I decided to analyze the thing. Dumped the BIOS, installed a fresh update, reinstalled system, no virus.
The legendary BadBIOS?
Well, I analyzed the BIOS having some fun with my Willem programmer and a few flash chips. In most Award BIOSes there is a module called ROS. ROS starts by supplying the nice graphical layer at boot, and later it manages all things which are done during computer operation, like suspending by SMI or sometimes battery/temperature warning. It also sometimes manages boot block protection routines, installed in a separate module. And the "virus" looks like to be installed in there - replacing ROS with its the newer version from update seems to fix the problem. The virus is quite robust code, it has to generally inject the start page, icons and links and that's all. It gives up if there is a specific CPL control panel file installed in system, there is no modem or there is no network at all (?information from DMI?). The link contains "BID" and "CID" parameters looking like they're dynamic, maybe from BIOS to BIOS, maybe from version to version, I don't know, I have only one and it has these constant.
But who made it? I decided to look at the domain. Who registered it first? Award-Phoenix.
When I entered there with Wayback Machine, I found the typical malware ad-filled screen, but with Phoenix logo! It looks like they indeed had the adware distributed in BIOS in early 2000s!