After lengthy efforts to remove multiple malware issues off of 6 laptops, the strange behaviour is an accurate depiction of "badBios", something I never believed true. My current experiences have changed this view.
Can you please help with directions to information so that I can develop an appropriate strategy. Economics prevent scrapping the infected machines.
If the device is truly infected at BIOS level or below then I would be hesitant to say you could ever trust the device again. The normal methods for replacing the firmware involve interaction with said firmware. I.e. how do you know it actually does it? Or that it doesn't patch the infection back in? Meanwhile most traditional malware writers are not going to bother infecting firmware - the economics of the effort required vs payoff aren't worth it. So you have to assume an extremely skilled and motivated party is behind it.
Unless you knew where the machine was infected you would have to re-flash every piece of storage on the device using a method which does not involve the existing firmware. For some parts there will be hardware pins which can be used to write directly to storage. For others you might have to desolder the flash, write it then re-solder it back. Unless you already had the equipment required for this I expect you'd find your economics would take you back to replacing the hardware.
However I find it extremely unlikely these machines are infected at this level. Economics mean malware this sophisticated doesn't make sense for targeting mass infection. And were you the type of party that is likely to be targeted (state actor, large corporate etc.) you would not have questioned the economics of replacing the machines.
I would suggest obtaining known to be clean OS installation media, formatting the entire disk(/s) and reinstalling the OS, fully updating it and installing an appropriate anti-virus product. I would then fully review other software you are considering installing before doing so and not inserting any media which has touched the machines while infected. If files need to be backed up and recovered start recovery to a single machine. Once that is confirmed not to have been infected you can recover to the others. As an added precaution you could use a live-USB with a different operating system to copy the files to the clean machine. You could also run a full virus/malware scan on the backup from that other OS before recovery.
Short of a jtag or other direct means of directly writing to the chip that stores the bios data (without going through bios to do the update), you wouldn't be able to fix it. If the BIOS is compromised, then the update feature through the compromised BIOS is unlikely to remove itself.
That said, this would only help if you could isolate specifically which portion of the hardware is compromised. Any programmable portion of the computer could be compromised and so you might have a very hard time tracking down exactly what is compromised if it is, in fact, a hardware level compromise.
