EFI partition, BIOS, other nonvolatile system memory? If it gets root level access it can hide anywhere there are a few KB. Even less than that will do if you're just putting a hook to instruct the computer to re-download the virus if it is detected that it has been removed.

wow... so there's no way to clean it? the only option is to junk the hardware?

Well, even if you cleaned some of the storage areas devindotcom mentions… How would you know you didn't miss any other area?

There are lots of things that use updatable firmware that can read and write data in interesting places. Portability is often an issue, so I guess it boils down to motivations of the writer.

There was an ars article (http://arstechnica.com/security/2013/10/meet-badbios-the-mys...) that was on HN just a few days ago describing all sorts of ways to hide rootkits in nearly any component of your machine with programmable firmware.

If I remember correctly there are rootkits that hide in firmware.