Virus in RAM????

[eko976]

Hi
I recently repaired a friend's computer. He found a virus in his computer and tried to reinstall windows because it wasn't working right anymore. He could not install windows. He got always blue screen messages like :check for virus and...
0x00000007B differrent address each time.
with diffrenet address.

I began to take parts out from my computer and put one at a time in his computer(Floppy, CD ROM, Harddrive)
I took out all PC cards except video card.
After I changed the memory the message went away.
Windows was installed.

Now, I took same memory into my computer and I got same message. So I was thinking now I am sure that was the problem. I put again my memory and put everything together and imagine
I got error in my computer, the same error what he got before.

And his computer is working now also with his original memory!!!

I know it isa crazy question:
Can a virus remain in RAM memory even the power is switched off or in motherboard?????

[glc]

The CMOS (bios chip) could be infected. Can you tell us what the name of this virus is? The ram can't hold anything when power is removed, but switching hard drives can definitely spread the infection.

[eko976]

I don't know the name.
I formatted hard drive before I attempted to install Windows, but still did not work.
Does virus go away when I format hard drive?
ANd how can clean the cmos?

[glc]

Formatting may not be enough - you may have to zero fill the drive and repartition it.

If the cmos is infected, you may be out of luck - a bios clear and flash might fix it but you may have to get a new bios chip. This is why I asked you what the name of the virus is - then I could look it up and tell you if it's a cmos infector.

[eko976]

I don't know the name because once I got virus everything stopped and I just got these messages

What does mean to zero fill the drive???

[morriswindgate]

Zero fill is a utility the overwites everything on the hard drive. including the MBR sectors, with a series of 1s and 0s. Nothing at all exists on the drive after this.
You then FDISK and Format the drive like normal.
Like GLC stated some virus infections, including a trojan that was around recently, can pack a payload which can re-write the CMOS. In that case you will need a replacement chip or a new board.
As a lesson, this is the type of stuff going around on P2P file sharing programs like Kazaa. And if you plan to use these programs it is important to have an up to date anti-virus program and to manually scan all downloaded files prior to listening to them.

[eko976]

Is this utility free and if yes where I can download it?

[morriswindgate]

Just do a google search for Wipe or Zero fill.

[mike breck]

I would also test all the Ram to eliminate that from the troubleshooting.

http://www.simmtester.com/

[glc]

You can download utilities from the hard drive manufacturer that will diagnose the drive for any problems and most of them include a zero fill utility. It may be called "write zeros", "wipe drive", "recertify drive", or something like that.

[eko976]

thanks friends I will try today to do so