From news.dal.ca!sunqbc.risq.qc.ca!newspeer.monmouth.com!chippy.visi.com!news-out.visi.com!calwebnntp!news.syd.fl.net.au!nobody Sat Aug 15 11:48:16 1998 Newsgroups: alt.comp.virus From: royc@fl.com.au (Roy Chambers) Subject: Virus in the system BIOS ????? X-Newsreader: News Xpress 2.01 Date: Sat, 08 Aug 1998 12:42:16 GMT NNTP-Posting-Host: a5-p25.syd.fl.net.au Message-ID: <35cc565b.0@news.syd.fl.net.au> X-Trace: 8 Aug 1998 23:44:59 -1000, a5-p25.syd.fl.net.au Organization: First Link Internet Services, Sydney, Australia Lines: 16 Path: news.dal.ca!sunqbc.risq.qc.ca!newspeer.monmouth.com!chippy.visi.com!news-out.visi.com!calwebnntp!news.syd.fl.net.au!nobody Xref: news.dal.ca alt.comp.virus:89876 Hi, I am not sure if this is really a virus problem, but I have encountered a computer that mysteriously plays happy birthday on system boot-up on a particular day of the year. An obvious first thought is a virus. But the drive scans as clean and the computer still plays happy birthday even with the hard drive removed.... I suspect something in the BIOS. Does anyone have any clues on this. I am stumped and have never encountered anything like this before. Thanks in advance Roy (da 'appy 'acker) From news.dal.ca!sunqbc.risq.qc.ca!news-peer-east.sprintlink.net!news.sprintlink.net!rill.news.pipex.net!pipex!bore.news.pipex.net!pipex!not-for-mail Sat Aug 15 11:48:23 1998 Path: news.dal.ca!sunqbc.risq.qc.ca!news-peer-east.sprintlink.net!news.sprintlink.net!rill.news.pipex.net!pipex!bore.news.pipex.net!pipex!not-for-mail From: "Gareth" Newsgroups: alt.comp.virus Subject: Re: Virus in the system BIOS ????? Date: Sat, 8 Aug 1998 18:48:12 +0100 Organization: UUNET UK server (post doesn't reflect views of UUNET UK) Lines: 9 Message-ID: <6qi33a$1db$1@plug.news.pipex.net> References: <35cc565b.0@news.syd.fl.net.au> NNTP-Posting-Host: userb594.uk.uudial.com X-Newsreader: Microsoft Outlook Express 4.72.3110.5 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Xref: news.dal.ca alt.comp.virus:89905 I did read somewhere, I can't remember where, that some old BIOSes do in fact play music on boot up! What I read could be wrong - it could indeed be a virus but if Dr Solomons (or AVP) says it isn't then it certainly isn't (unless it's a new virus.) Gareth. From news.dal.ca!sunqbc.risq.qc.ca!news3.bellglobal.com!news1.bellglobal.com!dragon.sk.sympatico.ca!news Sat Aug 15 11:48:30 1998 Path: news.dal.ca!sunqbc.risq.qc.ca!news3.bellglobal.com!news1.bellglobal.com!dragon.sk.sympatico.ca!news From: cstubbs@my-dejanews.com (Chris Stubbs) Newsgroups: alt.comp.virus Subject: Re: Virus in the system BIOS ????? Date: Sun, 09 Aug 1998 03:54:05 GMT Organization: SaskTel - Sympatico Lines: 12 Message-ID: <35cd1ba6.26202030@news.sk.sympatico.ca> References: <35cc565b.0@news.syd.fl.net.au> <6qi33a$1db$1@plug.news.pipex.net> NNTP-Posting-Host: arado47.sk.sympatico.ca X-Newsreader: Forte Free Agent 1.11/32.235 Xref: news.dal.ca alt.comp.virus:89971 "Gareth" wrote: >I did read somewhere, I can't remember where, that some old BIOSes do in >fact play music on boot up! What I read could be wrong - it could indeed be >a virus but if Dr Solomons (or AVP) says it isn't then it certainly isn't >(unless it's a new virus.) You're right; it's not a virus. Some BIOSes were modified at the factory to play music a boot up. -- Chris Stubbs (c.stubbs AT sk.sympatico.ca) From news.dal.ca!sunqbc.risq.qc.ca!newsfeed.nacamar.de!nntp.news.xara.net!xara.net!btnet-peer!btnet!uknet!elrond.sophos.com!not-for-mail Sat Aug 15 11:48:37 1998 Path: news.dal.ca!sunqbc.risq.qc.ca!newsfeed.nacamar.de!nntp.news.xara.net!xara.net!btnet-peer!btnet!uknet!elrond.sophos.com!not-for-mail From: nick@virusbtn.com (Nick FitzGerald) Newsgroups: alt.comp.virus Subject: Re: Virus in the system BIOS ????? Date: 10 Aug 1998 15:20:53 GMT Organization: Virus Bulletin Ltd. Lines: 22 Message-ID: <6qn34l$s1f$5@elrond.sophos.com> References: <35cc565b.0@news.syd.fl.net.au> NNTP-Posting-Host: toronto.virusbtn.com Mime-Version: 1.0 Content-Type: Text/Plain; charset=US-ASCII X-Newsreader: WinVN 0.99.9 (Released Version) (x86 32bit) Xref: news.dal.ca alt.comp.virus:90245 In article <35cc565b.0@news.syd.fl.net.au>, royc@fl.com.au says... >I am not sure if this is really a virus problem, but I have encountered a >computer that mysteriously plays happy birthday on system boot-up on a >particular day of the year. *Which* particular day? If I am remembering correctly, 17 (or 27?) November? AMI shipped a few thousand Trojanized BIOSes about three years ago where a disgruntled (?) recently-ex-employee had placed a trigger that on his birthday (?) the machine just went into a loop playing Happy Birthday. The only fix was to replace the BIOS. Sorry, didn't keep the details at the time... -- Nick FitzGerald Editor, Virus Bulletin