Ask a computer security expert.

[ignoramus]

Can malware set the BIOS password? A friend has been the subject of some cyber-bullying (confirmed) but now she's literally paranoid about everything to the point of being on anti-psychotic medication and has claimed that  her smartphone was hacked remotely, even ipods and smart TVs, and was probably being hacked by the government. I cleaned her laptop of all the Malware and a week later she complained that it was all black when she switches it on. She took it to the shop and they said that the hard disk needed to be recovered. I finally got my hands on it and found that the BIOS password had been set. That was a surprise I can tell you.

I'm a computer scientist myself but not an expert in IT security. I know that she's wrong about being hacked but I just need to confirm for sure that Malware can't set the Bios password. Although technically possible I'm assuming that considering how many different specialised BIOSes and motherboards there are out there it's not actually done in practise. Although it's UEFI rather than old style BIOS and I don't know much about that except it was a real pain installing a dual boot Linux Win 7 on my new desktop with two hard disks because of it.

I'm going to replace the CMOS battery to reset the password. It's a relatively new Toshiba with Win 8 on it (eyuch!). I'm assuming that something just messed up. I once had a desktop do that so I couldn't read the hard disk because of a BIOS setting that changed for no known reason.

Also, how does a factory reset work on an Android smart phone that hasn't been rooted or anything? She said that she had been 'hacked', did a factory reset and it didn't help because it was still acting weird (sorry, I can't get any useful details out of her). I'm assuming that there is some ROM in the phone that can't be over-written so a factory reset should always get rid of any Malware.

I know that she is paranoid but I need to be fully confident of the facts before I explain why what she believes is not possible.

Again, not a guru, just netadmin looking after 250 users.
anything's possible but unlikely.
Run hijackthis and then malwarebytes.
If the notebook has been compromised, it should find something at work.

Also check google for others with a similar problem.
Fixing all computer issues is a simple process of elimination.
Years ago, Toshiba were one of the first "laptops" with gui access to the firmware, including bios pwd.