Is there a antivirus software which can scan the BIOS/UEFI image ROM?
Most antivirus programs can only scan the files on disk.
It should run on Linux, Windows or an USB boot stick.
4
-
Could you please elaborate whether you're looking to scan a ROM file before flashing it or planning to scan the BIOS/UEFI ROM of a running system? The latter might not possible in the general sense. For example, an infected system may prevent the OS from reading the ROM or return fake un-infected contents.– aitapCommented Jan 23, 2023 at 13:06
-
I want to scan an infected system. If the antivirus uses the memory bus to get the ROM it might not be possible for the virus to return fake contents.– zomegaCommented Jan 23, 2023 at 15:44
-
An infected system could trap memory access by entering system management mode outside the control of the operating system. An infected Intel Management Engine or AMD Platform Security Processor image could do that as well. Given how hard it is to infect a BIOS/UEFI, I'm going to wager that such infections are rare and use all the available tricks to escape detection, making it unlikely that such an antivirus exists.– aitapCommented Jan 24, 2023 at 12:20
-
@aitap Maybe some escape detection. But not all. A normal virus (which is not in the BIOS) can also avoid detection.– zomegaCommented Jan 24, 2023 at 13:02
Add a comment
|
1 Answer
This is a partial answer in the sense that even though ESET antivirus offers some UEFI scanning functionality, it does so only for Windows installations and detections can not be removed (a UEFI reflash is recommended). See also this. All consumer-oriented ESET AV products include this functionality.
Finally, even though ESET offers a Rescue (boot) CD, it offers no UEFI scan capability.
