Author Topic: New Virus - Computer Bios Resets Automatically (Read 55299 times)

Rick · « **on:** May 21, 2015, 02:30:26 am »

Once computer goes into sleep mode, it wont restart, a hard reset, resets the bios too

happened twice already.

MSFT didn't catch the event

Only thing new, a new problem...
Where did it come from?
( http://xfactact.com/ )

replaced the battery; sometimes it still won't come out of sleep mode without a hard reset, at least the bios don't reset anymore.
but why MSFT dont alarm me or catch the event?

Ideas?

Samson · « **Reply #1 on:** May 21, 2015, 04:51:28 am »

Virus? Sounds like a dying CMOS battery.

Shane · « **Reply #2 on:** May 21, 2015, 11:28:01 am »

It is a couple of things actually.

When a system doesnt come out of sleep mode it is normally driver related, updating all the drivers normally fixes it. Of course the bios also has the sleep settings it supports as well and a dead cmos battery might affect it as well, not sure if it does or not though.

As for the bios resetting, the cmos battery on the board is used to let the bios remember its settings, if the battery is bad and you pull the power then all the settings clear. So if that is happening then you will want a new cmos battery, thankfully they are cheap. Otherwise every time the system is without power the bios is going to reset.

Shane

Rick · « **Reply #3 on:** May 21, 2015, 09:51:43 pm »

Quote from: Shane on May 21, 2015, 11:28:01 am

It is a couple of things actually.

When a system doesnt come out of sleep mode it is normally driver related, updating all the drivers normally fixes it. Of course the bios also has the sleep settings it supports as well and a dead cmos battery might affect it as well, not sure if it does or not though.
Will look at replacing the battery, but; we have a backup power supply attached, system generally never off... coming out of sleep mode should have nothing to do with a dead CMOS battery...

As for the bios resetting, the cmos battery on the board is used to let the bios remember its settings, if the battery is bad and you pull the power then all the settings clear. So if that is happening then you will want a new cmos battery, thankfully they are cheap. Otherwise every time the system is without power the bios is going to reset.
system generally never off... coming out of sleep mode should have nothing to do with a dead CMOS battery...

* I Disabled the sleep Suspension Mode...
* I think, it virus related as it should not affect the CMOS as the system is always ON...
* we saw this with win98 version or whenever MSFT had a new system coming out!

But, I will run out to buy a new CMOS battery, hmm? Or wait, should I go out to buy a new mother board, hmmm?
** perhaps a new more powerful mother board with the new dual WIFI chip that allows us to be monitored no has found yet...

Shane

Boggin · « **Reply #4 on:** May 22, 2015, 04:34:00 am »

How old is your machine as CMOS li-ion batteries are expected to last about 5yrs but before you go rushing out to buy a CR2032, you should check to see what is fitted in your machine as some have their own holders which plug into the motherboard rather than just slotting the coin shaped battery in.

As for xfactact.com - VirusTotal.com doesn't have anything definitive on it - saw it had already been checked yesterday - was that you Rick ?

Have you downloaded anything recently where you could have picked up a PuP ?

AdwCleaner and Junkware Removal Tool are programs specifically designed for rooting out such programs, so letting those have a look at your system could be worthwhile.

The JRT link is lower down the AdwCleaner page. http://www.bleepingcomputer.com/download/adwcleaner/

Julian · « **Reply #5 on:** June 05, 2015, 06:25:31 pm »

(hmmmm) if you open command prompt with admin privileges type in this command "powercfg -a"
I want to see what supported sleep states you have. Plus if you have a dead battery the bios power management settings may set to default.

Rick · « **Reply #6 on:** June 05, 2015, 08:04:44 pm »

Quote from: Sundavor on June 05, 2015, 06:25:31 pm

(hmmmm) if you open command prompt with admin privileges type in this command "powercfg -a"
I want to see what supported sleep states you have. Plus if you have a dead battery the bios power management settings may set to default.

Already new battery.
See file attached;

Julian · « **Reply #7 on:** June 05, 2015, 08:22:42 pm »

in your bios under the power management do you have it set for s1 and s3? I usually only use s3. Try setting it to s3 only in the bios and start your computer up and put it in sleep mode and hit the space bar after it goes to sleep to see if it turns back on. and let me know the results.
Edit:
sorry forgot to put that in for you.
this will show all the devices on your system that support waking it up on S3 sleep state
powercfg /devicequery wake_from_s3_supported

this will show all the devices on your system that support waking it up on S1 sleep state
powercfg /devicequery wake_from_s1_supported

Rick · « **Reply #8 on:** June 07, 2015, 08:07:10 am »

Quote from: Rick on May 21, 2015, 02:30:26 am

Once computer goes into sleep mode, it wont restart, a hard reset, resets the bios too

happened twice already.

MSFT didn't catch the event

Only thing new, a new problem...
Where did it come from?
( http://xfactact.com/ )

replaced the battery; sometimes it still won't come out of sleep mode without a hard reset, at least the bios don't reset anymore.
but why MSFT dont alarm me or catch the event?

Ideas?

Well, it just happened again, no doubt it a virus...

Rick · « **Reply #9 on:** June 07, 2015, 08:11:49 am »

Quote from: Sundavor on June 05, 2015, 08:22:42 pm

in your bios under the power management do you have it set for s1 and s3? I usually only use s3. Try setting it to s3 only in the bios and start your computer up and put it in sleep mode and hit the space bar after it goes to sleep to see if it turns back on. and let me know the results.
Edit:
sorry forgot to put that in for you.
this will show all the devices on your system that support waking it up on S3 sleep state
powercfg /devicequery wake_from_s3_supported

this will show all the devices on your system that support waking it up on S1 sleep state
powercfg /devicequery wake_from_s1_supported

thank you for your replies;
however, been using this system 4 years or more already, have Plug N play setup in bios. I suspect, its a new virus that is related to resetting system bios so it is easier to hack into systems...

Rick · « **Reply #10 on:** June 07, 2015, 08:27:04 am »

Quote from: Rick on June 07, 2015, 08:11:49 am

Quote from: Sundavor on June 05, 2015, 08:22:42 pm
in your bios under the power management do you have it set for s1 and s3? I usually only use s3. Try setting it to s3 only in the bios and start your computer up and put it in sleep mode and hit the space bar after it goes to sleep to see if it turns back on. and let me know the results.
Edit:
sorry forgot to put that in for you.
this will show all the devices on your system that support waking it up on S3 sleep state
powercfg /devicequery wake_from_s3_supported

this will show all the devices on your system that support waking it up on S1 sleep state
powercfg /devicequery wake_from_s1_supported

thank you for your replies;
however, been using this system 4 years or more already, have Plug N play setup in bios. I suspect, its a new virus that is related to resetting system bios so it is easier to hack into systems...

Please refer to event log when it started.

Rick · « **Reply #11 on:** June 07, 2015, 08:41:22 am »

Quote from: Rick on June 07, 2015, 08:27:04 am

Quote from: Rick on June 07, 2015, 08:11:49 am
Quote from: Sundavor on June 05, 2015, 08:22:42 pm
in your bios under the power management do you have it set for s1 and s3? I usually only use s3. Try setting it to s3 only in the bios and start your computer up and put it in sleep mode and hit the space bar after it goes to sleep to see if it turns back on. and let me know the results.
Edit:
sorry forgot to put that in for you.
this will show all the devices on your system that support waking it up on S3 sleep state
powercfg /devicequery wake_from_s3_supported

this will show all the devices on your system that support waking it up on S1 sleep state
powercfg /devicequery wake_from_s1_supported

thank you for your replies;
however, been using this system 4 years or more already, have Plug N play setup in bios. I suspect, its a new virus that is related to resetting system bios so it is easier to hack into systems...

Images attached;
Please refer to event log as to when it started.
Please refer to your command quote;

Samson · « **Reply #12 on:** June 07, 2015, 11:12:34 am »

Quote from: Rick on June 07, 2015, 08:11:49 am

thank you for your replies;
however, been using this system 4 years or more already, have Plug N play setup in bios. I suspect, its a new virus that is related to resetting system bios so it is easier to hack into systems...

Huh? According to your ammended first post, now that you have replaced the CMOS battery, the BIOS is "not resetting anymore".

Quote from: Rick on May 21, 2015, 02:30:26 am

replaced the battery; sometimes it still won't come out of sleep mode without a hard reset, at least the bios don't reset anymore.
but why MSFT dont alarm me or catch the event?

Ideas?

Kernel power events suggest either a driver problem or a failing PSU.

Julian · « **Reply #13 on:** June 07, 2015, 01:58:35 pm »

I agree with Samson. Maybe drivers or a dying cpu.
Here is a useful program I use for drivers http://m.download.cnet.com/Driver-Booster-2/3000-18513_4-75992725.html
And hw monitor
http://www.cpuid.com/softwares/hwmonitor.html
Edit: hw monitor for watching power levels but an actual meter is better

http://m.newegg.com/Product/index?itemnumber=N82E16899261023

Rick · « **Reply #14 on:** June 08, 2015, 12:46:43 pm »

Quote from: Samson on June 07, 2015, 11:12:34 am

Quote from: Rick on June 07, 2015, 08:11:49 am
thank you for your replies;
however, been using this system 4 years or more already, have Plug N play setup in bios. I suspect, its a new virus that is related to resetting system bios so it is easier to hack into systems...

Huh? According to your ammended first post, now that you have replaced the CMOS battery, the BIOS is "not resetting anymore".
It happened again, better to say, it happened again
Quote from: Rick on May 21, 2015, 02:30:26 am

replaced the battery; sometimes it still won't come out of sleep mode without a hard reset, at least the bios don't reset anymore.
but why MSFT dont alarm me or catch the event?

Ideas?

Kernel power events suggest either a driver problem or a failing PSU.

Rick · « **Reply #15 on:** June 08, 2015, 12:54:16 pm »

Quote from: Sundavor on June 07, 2015, 01:58:35 pm

I agree with Samson. Maybe drivers or a dying cpu.
Here is a useful program I use for drivers http://m.download.cnet.com/Driver-Booster-2/3000-18513_4-75992725.html
And hw monitor
http://www.cpuid.com/softwares/hwmonitor.html
Edit: hw monitor for watching power levels but an actual meter is better http://m.newegg.com/Product/index?itemnumber=N82E16899261023

bought a new PSU last year, added a power supply last year too.

Julian · « **Reply #16 on:** June 09, 2015, 12:22:47 am »

my last post I typed a typo not cpu meant psu....

Rick · « **Reply #17 on:** June 09, 2015, 05:08:25 am »

Quote from: Rick on June 07, 2015, 08:41:22 am

Quote from: Rick on June 07, 2015, 08:27:04 am
Quote from: Rick on June 07, 2015, 08:11:49 am
Quote from: Sundavor on June 05, 2015, 08:22:42 pm
in your bios under the power management do you have it set for s1 and s3? I usually only use s3. Try setting it to s3 only in the bios and start your computer up and put it in sleep mode and hit the space bar after it goes to sleep to see if it turns back on. and let me know the results.
Edit:
sorry forgot to put that in for you.
this will show all the devices on your system that support waking it up on S3 sleep state
powercfg /devicequery wake_from_s3_supported

this will show all the devices on your system that support waking it up on S1 sleep state
powercfg /devicequery wake_from_s1_supported

thank you for your replies;
however, been using this system 4 years or more already, have Plug N play setup in bios. I suspect, its a new virus that is related to resetting system bios so it is easier to hack into systems...

Images attached;
Please refer to event log as to when it started.
Please refer to your command quote;

Have left the HP Laserjet 3050 printer off; no problems lately...
Note; had checked in the device section, there is nothing related to power options. ?

Rick · « **Reply #18 on:** June 10, 2015, 08:23:31 am »

Quote from: Sundavor on June 09, 2015, 12:22:47 am

my last post I typed a typo not cpu meant psu....

is there some way can run a program to determine the right power supply should has?

Samson · « **Reply #19 on:** June 10, 2015, 09:04:40 am »

Quote from: Rick on June 10, 2015, 08:23:31 am

is there some way can run a program to determine the right power supply should has?

http://bfy.tw/Gj0

jraju · « **Reply #20 on:** June 10, 2015, 11:00:13 pm »

Hi, Samson, if i click the link a new search engine probably a browser hijacker site is redirecting google

Samson · « **Reply #21 on:** June 11, 2015, 03:55:41 am »

Quote from: jraju on June 10, 2015, 11:00:13 pm

Hi, Samson, if i click the link a new search engine probably a browser hijacker site is redirecting google

No it is n't. It is "Let Me Google That For You". I was trying to let Rick know that Google is your friend

jraju · « **Reply #22 on:** June 11, 2015, 04:10:11 am »

Hi, I do not know about it. Is it different from google search engine. Normally, if you use other engines, the search results would only be few, as Google regular is the best engine.

Samson · « **Reply #23 on:** June 11, 2015, 05:00:57 am »

Quote from: jraju on June 11, 2015, 04:10:11 am

Hi, I do not know about it. Is it different from google search engine. Normally, if you use other engines, the search results would only be few, as Google regular is the best engine.

It is using Google, but doing the search for those too lazy or incapable of doing it themselves

jraju · « **Reply #24 on:** June 11, 2015, 05:35:25 am »

I would advise you choosing these kind of search engines. They will spam and would be a nuisance PUP to get rid of . Did not you hear babylon tool, mysearch engine, which forcibly dent to your registry and it would be difficult to get rid off totally. In registry, you have to find atleast 49 items to kill the processes. That too , it will be found in different names. Pl beware of suspicious search engines. Pl use only google . It has capacity to find anything. Google has also has voice search engines.