Are there viruses that have managed to hide themselves somewhere other than on the hard drive? Like CPU cache or on the motherboard?

Is it even possible? Say I get a virus, so I get rid of the HDD and install a new one. Could the virus still be on my PC?

  • 30
    Floppy disks -- I remember having to deal with viruses on floppies on my Amiga, and that didn't even have a hard drive. Same applies to any other removable media like USB sticks that can auto-run code when inserted into the computer. Even read-only media like CD-ROMs might have been shipped with viruses on them. – Simba Apr 21 '16 at 11:33
  • 9
    A bit more abstract, but I had a virus inside a virtual Windows machine once, with access to my real harddisk. Not directly what you're asking for, hence a comment. – phresnel Apr 21 '16 at 11:41
  • 2
    I had years ago a virus on my mainboard (at least I'm assuming so, since I couldn't explain it with anything else). it was like 2008 and my computer behaved strange. alot randomly files where wirtten all over my folders. And 1 or 2 reboots later something prevented to boot from that HDD. I also was not able to reinstall windows on that HDD. So I bought a new HDD unplugged the old one and installed windows. Installed drivers (didn't even connect internet so far) rebooted..... Same files where written on the factory new HDD. 1 more reboot and I couldn't use it anymore aswell. I bought a new PC. – Zaibis Apr 21 '16 at 15:34
  • 2
    Someone should write a virus for a Mercury delay line – Sam Apr 21 '16 at 15:35
  • 2
    Somewhat related: security.stackexchange.com/q/111156/91904 – Marc.2377 Apr 21 '16 at 18:59

11 Answers 11

up vote 201 down vote accepted

Plenty of places:

Modern hardware has a wide range of persistent data stores, usually used for firmware. It's far too expensive to ship a complex device like a GPU or network card and put the firmware on a mask ROM where it can't be updated, then have a fault cause mass recalls. As such you need two things: a writeable location for that firmware, and a way to put the new firmware in place. This means the operating system software must be able to write to where the firmware is stored in the hardware (usually EEPROMs).

A good example of this is the state of modern BIOS/UEFI update utilities. You can take a UEFI image and an executable running on your OS (e.g. Windows), click a button, and your UEFI updates. Simple! If you reverse engineer how these work (which I have done a few times) it's mostly a case of a kernel-mode driver being loaded which takes page data from the given UEFI image and talks directly to the UEFI chip using the out instruction, sending the correct commands to unlock the flash and start the update process.

There are some protections, of course. Most BIOS / UEFI images won't load unless they're signed by the vendor. Of course, an advanced enough attacker might just steal the signing key from the vendor, but that's going into conspiracy theories and godlike threat actors, which just aren't realistic to fight in almost any scenario. Management engines like IME are meant to have certain protections which prevent their memory sections from being accessed even by ring0 code, but research has shown that there are many mistakes out there, and lots of weaknesses.

So, everything is screwed, right? Well, yes and no. It's possible to put rootkits in hardware, but it's also incredibly difficult. Each individual computer has such a variance in hardware and firmware versions that it's impossible to build a generic rootkit for most things. You can't just get a generic Asus BIOS and flash it to any board; you'll kill it. You'd need to create a rootkit for each separate board type, sometimes down to the correct revision range. It's also an area of security that involves a huge amount of cross-domain knowledge, way down deep to the hardware and low-level operational aspects of modern computing platforms, alongside strong security and cryptographic knowledge, so not many people are capable.

Are you likely to be targeted? No.

Are you likely to get infected with a BIOS/UEFI/SMM/GPU/NIC-resident rootkit? No.

The complexities and variances involved are just too great for the average user to ever realistically have to worry about it. Even from an economic perspective, these things take an inordinate amount of skill and effort and money to build, so burning them on consumer malware is idiotic. These kinds of threats are so targeted that they only ever really belong in the nation-state threat model.

  • 36
    Don't forget the most simple case: a flash drive. If an USB stick caused the infection, it will happily infect the new HDD again. – Bergi Apr 21 '16 at 11:56
  • 24
    @Bergi I took the question to exclude traditional mass storage media entirely, but yes, that is true. You can also include smartphones in that category. – Polynomial Apr 21 '16 at 12:03
  • 7
    It realy depends on what "you" represents.Low-level user like you and me ? Of course, no. High-level journalist reporting on controversial subjects? The answer is a bit more sophiscated. Beeing careful never hurt somebody ... – Mxsky Apr 21 '16 at 14:24
  • 3
    Note that malware like the one that infected the Iranian nuclear power stations was also later discovered to infect German powerplants and laptops of ordinary people. That's the thing with malware designed to infect secure installations: by definition it has to try as hard as it possibly can. Such malware, since it was designed to target specific hardware (in this case equipment manufactured by Siemens), is unlikely to do damage to your PC. But just because you weren't deliberately targeted does not mean that your PC won't be potentially infected. – slebetman Apr 22 '16 at 3:43
  • 3
    @ViktorToth Yes, but that's somewhat irrelevant when we're talking about risk modeling. It's not as much obscurity as it is limiting the applicability of malware to a very small ecosystem, making it not worth the effort to an attacker unless it's intended to be targeted. Attack economics is an important part of the threat model. – Polynomial Apr 22 '16 at 15:09

The short answer to your question is yes.

Here are some places where a virus could hide:

  • On the firmware of your keyboard, mouse, webcam, speakers, etc. Basically anything you connect to your computer that has a writable firmware.
  • On your hard drive firmware. Sort of on your hard drive, but still survives a reformatting. The NSA are likely suspects for that one.
  • In your BIOS or UEFI.
  • In ye olden days, boot sectors of floppy disks. This was standard among early viruses, since at the time floppy disks were often used as primary storage. Same goes for USB sticks now.

A virus could potentially target anything where there is writable data that gets treated as executable code. On a computer, that is basically anywhere. For it to survive a restart, though, it would have to be some kind of persistent storage. So the CPU cache might not be the best place to hide.

Most viruses don't do this, though, and just live on the HDD. This is because virus writers are (rationally) lazy. Why go for the complicated options when there is plenty of low hanging fruit?

  • 16
    Ah yes, I forgot the hard disk firmware from my answer. Travis Goodspeed did an interesting talk on this a while back, producing an anti-forensics disk. The idea was that normal OS read/write and ATA command patterns are pretty unique, but write-blockers, forensics software, and cloners (e.g. dd) send totally different patterns making it easy to spot when a disk is being forensically analysed. The disk then wipes itself with a repeated pattern of the lyrics to Rick Astley's Never Gonna Give You Up. – Polynomial Apr 21 '16 at 13:28
  • 3
    @Polynomial Does that count as a Rickroll? – JAB Apr 21 '16 at 17:53
  • 1
    anything with firmware, indeed. including printers – prusswan Apr 23 '16 at 12:43
  • 2
    @forest - there was a proven attack on Mac keyboard firmware a while back, think it got written up on Hackaday. No reason to think they're unique though. These days everything has a micro in it because it's just cheaper than building functionality in hardware, and very capable (and hence usefully infectable) micros are so cheap now. – John U Apr 25 '16 at 10:36
  • 1

One of most common but unchecked places is... a peripherial with "embedded driver disk", like lots of 3G/4G USB sticks. They have — technically — a hub inside, and a Generic Storage + the device itself on it. Upgrading its firmware usually upgrades a disk image mounted to the generic storage part. It's read-only from PC in regular use, but it's easily remapped as a CD-ROM with autoplay. The one I've experienced myself in 2006-2008 was a 4G stick for a local cell provider. It contained CD-ROM like storage out-of-the-box from local sale point, autoplay and torjan included =) Next firmware patch — and a storage is remapped back to HDD and no virus on board.

  • 3
    I would have thought "autorun" would be permanently disabled by now – Xen2050 Apr 22 '16 at 7:45
  • 3
    @Xen2050 Fasten your seatbelt : when I was upgrading from Windows 7 to 10, in win7 autorun was disabled. In win10 it was enabled again by installer at the same time it has migrated all the settings I had – Alexey Vesnin Apr 22 '16 at 14:23

The main problem for any kind of storage is that the system must be willing to execute the malware. During the boot of the operating system this means it has to be somewhere as an executable, DLL, driver or similar on the hard disk. It does not need to be fully there, i.e. it can be a small loadable stuff and the rest might reside somewhere else (even in the network).

But malware can also be loaded before the OS executes. The loading of the OS is controlled by the BIOS or UEFI so if the malware is already contained in this stage it is outside the control of the OS. For one example see Hacking Team's malware uses a UEFI rootkit to survive operating system reinstalls.

Apart from that you have firmware on the network card, the graphic card, the hard disk etc and these often can be replaced. Thus some malware might hide there too and change the behavior of the system, see How the NSA’s Firmware Hacking Works and Why It’s So Unsettling.

There were a few things that came to mind when I read the question that extend beyond the scope of the example given. There are other places that a virus can be stored besides on a hard drive or even on a computer. A couple of those places would be bacteria (specifically E. coli) and your DNA.

According to some research performed cerca 2010 that proved that E. coli could not only store data (or a virus) but also offer bioencryption.

More recently, scientists have discovered that they can store up to 700TB of data in 1 gram of your DNA. The advantage would be that it's a long term storage if properly stored.

So, as the tech industry moves closer to integrating technology and our biology, they may have to look further than just our hard drive, BIOS, memory, GPU, etc.

  • Here are a couple more links that may be of interest. extremetech.com/extreme/… io9.gizmodo.com/5699767/… – Josh Apr 21 '16 at 22:25
  • Oh snap, didn't think of that. – Joseph A. Apr 21 '16 at 22:25
  • 3
    Interesting, but for now it's not really a viable place to store a computer virus that would re-infect a new OS (thankfully, would hate to have to physically clean a motherboard as well as install a "clean OS") – Xen2050 Apr 22 '16 at 7:41
  • 1
    And if you store the computer virus in an actual virus, we all become carriers for it! – fluffy Apr 23 '16 at 1:42

In addition to an excellent Polynomial's answer, there are some more options:

  • another device on the network, obviously (e.g. another computer infecting samba shares, router adding exploit to its web page, ...)
  • USB device (e.g. flash disk) secretly changing to a keyboard and typing/downloading the malware to the host computer

Not sure whether any other part of computer was used by virus,but long back came across BADBIOS

What does bad bios do?

Radio (SDR) program code, even with all wireless hardware removed.


It is said to infect the firmware on USB sticks.

It is said to use TTF (font) files, apparently in large numbers, as a vector when spreading.

Apart from the above its not only virus which attacks a machine there were many types of rootkits available like PCI rootkit

In Summary the virus can be resided at bios or at any source but it requires some point of execution which lacks at hardware.

Edit after question :

As per question ,yes there were chances of virus which could transfer to ur new hdd,for instance consider rootkits like jellyfish ,but notably this cases were rare for normal end users

  • 1
    "It is said to spread itself to new victim computers using the speakers on an infected device to talk to the microphone on an uninfected one." , wait what? Through soundwaves? – ivan_bilan Apr 21 '16 at 9:22
  • @ivan_bilan one thing should be noted over here,this were the possiblities which was derived theoretically and proven methods describe how it can be done,but this kind of rootkits,virus,spywares were very uncommon and rare among endusers,so no need to worry about that blog.erratasec.com/2013/10/… have a look over here there is in much detailed answer – BlueBerry - Vignesh4303 Apr 21 '16 at 9:24
  • 3
    The sophos article you linked to suggests that badBIOS may be a hoax, as it has only ever affected Dragos Ruiu, the guy who reported it, No one has replicated his findings. – browly Apr 21 '16 at 15:32
  • @ivan_bilan jocm.us/uploadfile/2013/1125/20131125103803901.pdf – JAB Apr 21 '16 at 17:54
  • That's an awful lot of "It is said" requiring a myriad of highly advanced features converging on a single person only. Has any of this ever been verified? I'm very sceptical and am leaning towards believing this was simply a weird hoax or imaginary episode. Reading other threads suggests this is old hat and I'm not alone in this interpretation of it all. – underscore_d Apr 24 '16 at 15:55

The answer is YES, they can hide in many other places, not only into your HDD, but also into other storage devices you have connected to your PC.

  • In early days, I use to have lot of issue with CD/DVD "Autorun" option in my Microsoft Windows. Virus were so capable to automatically create "Autorun.inf" into burning media and use to run and infect automatically into fresh PC when I insert affected ROM into reader.

  • Virus use to infect USB flash drive automatically, and spread by themselves if the flash drive is inserted into uninfected system.

These are two major areas, where your primary focus have to be.

If you have managed to remove Virus from your HDD, don't forget to check Windows Registry at these locations: (believe me I have disabled many Virus files being executed, by removing unknown entries from below locations);

Run "regedit" to open Windows Registry Editor, and navigate to check below two locations for suspicious registry entries !!

HKEY_CURRENT_USER : Software : Microsoft : Windows : CurrentVersion : Run

HKEY_LOCAL_MACHINE : SOFTWARE : Microsoft : Windows : CurrentVersion : Run

  • 1
    I think that if the hard drive was removed, then the OS (and any registry entries) would be gone with it. – schroeder Apr 21 '16 at 18:53

In case you are using a custom CPU working as an harvard architecture based design, a virus can inject the ROM that the instruction codes are stored in but it is a very very hard process to change a ROM value that way . Still it is an injection

On a piece of paper, which is then typed in at the keyboard (or OCRed?).

The most obvious is the EICAR test virus signature:

"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR"
"-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"

If you join the two strings together and save it as an executable file (a ".com" file on MSDOS or 32-bit Windows platforms) then any self-respecting anti-virus program is supposed to treat it in the same manner as if it were a virus. Note that this is specifically enter-able with characters that can be generated from a plain vanilla "keyboard".

  • 1
    What is obvious about EICAR as an example? All malware is code that needs to be compiled or interpreted. I am completely confused as to why EICAR is an example. Is it just because it's short enough for the average person to type? – schroeder Apr 22 '16 at 17:40
  • 1
    I am also not sure if being printed out counts as "hiding" as per the question. – schroeder Apr 22 '16 at 17:41
  • That is not a virus. It is just a test string for AV programs. There's no way for that file to reproduce, be executed, or do anything that virus or malware do. – Neil Smithline Apr 28 '16 at 16:18

The CPU cache it is resetted every time you reboot your PC. Also you can write only on Hard Disk, or any removable peripherals

  • But can it be reconfigured not to reset through some BIOS hack? – ivan_bilan Apr 21 '16 at 9:10
  • The CPU cache it's not managed by BIOS. BIOS it's just a basic I/O system – Cricco95 Apr 21 '16 at 9:12
  • CPU cache is just fast RAM. It can't persist after power cycling the CPU. – user1751825 Apr 21 '16 at 9:15
  • 4
    The BIOS is certainly writeable by the OS, particularly in UEFI. How do you think userland update tools work? – Polynomial Apr 21 '16 at 9:25
  • 1
    Although your answer produced an interesting comment chat, afaik it is not an answer to the original question. – peterh Apr 26 '16 at 15:03

protected by Community Apr 27 '16 at 7:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.