Two researchers from Core have developed "methods for infecting the BIOS with persistent code that will survive reboots and reflashing attempts" An article on it:

http://threatpost.com/blogs/researchers-unveil-persistent-bios-attack-methods

and the slides from the presentation:

http://i.zdnet.com/blogs/core_bios.pdf

Man I would have liked to have seen this talk. If anyone knows of video of it, please ping me.

Interestingly enough i had a client recently with a MBR virus. Funny how the old becomes the new again!

timmedin,

I'm with you on that.  The rootkit will control what the OS sees.  More correctly, a properly coded rootkit will control what the OS sees.  The BIOS rootkit must exist in a relatively small space on the BIOS (remember we still need to bootstrap the system from there too).  This means it doesn't have that much code to be able to cover all the bases.  I'd be interested to do some testing on one of these to see what it misses.  I'm not naive enough to believe that simple documented API calls will work to discover it, but I'm betting some (most) of the undocumented Windows API calls won't be hooked appropriately and hence you'll be able to detect the rootkit with specialized kernel mode code (possibly loaded in as a driver).