The AMIBIOS Happy Birthday Mystery

Discussion of beta and abandonware topics not fit for the other forums goes here.
Post Reply
MotorolaFLARE
User avatar
Posts: 23
Joined: Sat Sep 01, 2018 1:16 pm
Location: Italy

The AMIBIOS Happy Birthday Mystery

Post by MotorolaFLARE »

Over the years, word has floated around the computer industry that some sort of corruption or errant code present in AMIBIOS in the 1993 – 1994 time frame would force computers to play the "Happy Birthday" song through the computer speaker on boot up. Extant reports generally indicate that this behavior could be interrupted and normal boot operation would resume by hitting one or more keys on the keyboard. Notably, one key component of this legend is that it would happen only once a year on the same date of November 13, which points to some hidden significance.

AMI says that's fake because someone said it used the sound card, but it's possible that it used the onboard beeper speaker,

so 100% fake or not? :$
Image

C'è solo l'Inter, AMALA!

AlphaBeta
User avatar
Donator
Posts: 2137
Joined: Sun Aug 12, 2012 4:33 pm
Location: Czechia

Re: The AMIBIOS Happy Birthday Mystery

Post by AlphaBeta »

I haven't heard of BIOSes playing specifically "Happy Birthday" and the Internet seems pretty vague on that.

However, the Microsoft knowledge base documents a post-1997 Award BIOS feature that plays music through the PC speaker upon detecting a CPU fan or power supply failure under the awkwardly named Q261186: Computer Randomly Plays Classical Music.
AlphaBeta, stop brainwashing me immediately!

Image

JustZisGuy
FTP Access
Posts: 233
Joined: Wed Dec 11, 2013 3:24 am

Re: The AMIBIOS Happy Birthday Mystery

Post by JustZisGuy »

The authoritive article on this seems to be this f-secure document:

https://www.f-secure.com/v-descs/birthday.shtml
Summary

This is not a virus.

There is a a large set of trojanized AMI BIOS chips going around which halt the machine during boot-up on the 13th of November and play 'Happy Birthday' from the PC-speaker until you press a key.

The BIOS version is "M82C498 Evaluation BIOS v1.55", dated 04/04/93.

Do note that it's not a virus - it will not replicate anywhere from an affected machine.

If you have this problem, contact your hardware vendor for a BIOS replacement.
So if you can find a PC with this specific BIOS revision, you should be able to replicate it. Given the name, it sound like this revision should not have been on production computers... but we all know how that goes.

DBlake
User avatar
Donator
Posts: 747
Joined: Tue Aug 05, 2008 8:45 pm
Location: Two lefts and a diagonal sidestep from where you are.

Re: The AMIBIOS Happy Birthday Mystery

Post by DBlake »

I found some additional info on this:
There is a report of the following nature: You are supposed to contact
the chip company to get this resolved.

(Credit for this report goes to Jakub Kaminski, CYBEC.)

[There are trojanized BIOS chips out there]

The sticker on the trojanized BIOS chip says:
AMIBIOS
AMERICAN MEGATRENDS
486DX ISA BIOS (c) 1993
AB 3756612

The next three faulty chips (all with Flash ) had numbers (telephone report):
AB 3756271
AB 3756631
AB 3738981

The one that suppossed to be clean is (telephone report):
AB 3800510

So, it looks that there is at least 17650 trojanized systems around.

The easiest way of identifying the trojan is:
- change date to 13th of November (year doesn't matter)
- reboot PC

After displaying messages simmilar to the ones below, you'll here the tune.

Cache in 2-Bank!
33.06x2 MHz CPU Clock
Intel SL CPU Detected
(stops and plays here)

The significant ASCII strings inside BIOS area:
F000:0060
Date:-04/04/93 (C) 1985-1993,AMI
American Megatrends Inc.,All Rights Reserved...

F000:2DFA
M82C498 Evaluation BIOS v1.55

F000:8150
486 BIOS 5.00-2.1

F000:FF59
(C)1992AMI,404-263-8181

Jimmy Kuo
Norton AntiVirus Research
Also, apparently it was done by a disgruntled employee at AMI.

Post Reply