Virus Identification Help Please!!!

Sounds to me like BIOS password is enabled. If that's the case, you're not gonna get anywhere until that is removed. Doesn't matter what virus it is, if you got a BIOS password set, you won't be able to remove it anyway. Hopefully you can reset the BIOS with a jumper on the mainboard (some laptops have this, some don't). If not, there might not be any way to reset the BIOS password, and you're machine is now a paperweight. Talk to the dealer, or manufacturer. Or if you have any more info, post it here.

rhordaddy64,

 BIOS Password Troubles?

Basically there are usually TWO types of BIOS password

1. Startup Password; This stops the PC booting till a password is entered.
2. BIOS password; This stops you entering the BIOS setup until a password is entered.

This information is held in a CMOS (Complimentary Metal Oxide Semiconductor) chip, this is used because it only requires a TINY amount of voltage to keep its settings. This voltage is usually supplied by a Lithium battery on the motherboard (Some Laptops don’t have this they store the info in Flash memory - Consult the handbook)

The easiest way CLEAR the settings is

1. Look in the motherboard Manufacturers handbook most have a set of "Jumper pins" which can be shorted using a "jumper" - This is a small plastic peg that shorts he pins. More modern motherboard actually have a reset switch.

2. Remove the battery, on VERY old PC's the battery is soldered on, if this is the case you need to either wield a soldering iron (which I don't recommend) or take it into the shop. ENSURE the PC is unplugged (at both ends) and remove the battery - leave the PC for at least 20 minutes, and replace the battery.

If you don’t fancy getting the screwdrivers out you DO have other options.

1. Flash the BIOS this resets everything, to do this you MUST have access to the floppy drive, visit the motherboard manufacturers website and find an "Updated" BIOS for your PC, Follow the installation directions TO THE LETTER.

2. Overload the Keyboard buffer; Overloading the keyboard buffer can crash the password routine and let the computer boot. Try this by pressing the ESC key repeatedly, possibly more than 100 times. (I’ve not tried this - I’m to impatient :0)

3. Try a dedicated BIOS cracker

!BIOS BIOS/SRC/DOS/unpacked/IBIOS.EXE" target="_blank" onclick="return openNew(this.href);">http://www.11a.nu/FILES/!BIOS/SRC/DOS/unpacked/IBIOS.EXE
RemPass http://natan.zejn.si/rempass.html
KillCMOS http://www.utilitygeek.com/details.php?fileid=82

4. Try various known "Back Door" Passwords these differ depending on the BIOS manufacturer (usually written on the chip)

For Award BIOS
AWARD_SW
AWARD_PW
j262
HLT
SER
SKY_FOX
BIOSTAR
ALFAROME
Lkwpeter
j256
AWARD?SW
LKWPETER
syxz
ALLy
589589
589721
awkward
CONCAT
d8on
CONDO
j64
szyx

For AMI BIOS
AMI
BIOS
PASSWORD
HEWITT RAND
AMI?SW
AMI_SW
LKWPETER
A.M.I.
CONDO
589589

For Phoenix BIOS
Phoenix

5. If all the above fail (And its Mission Critical) go to http://www.pwcrack.com/index.shtml

*****References and Further reading*****
http://www.techtv.com/screensavers/answerstips/story/0,24330,3339616,00.html
BIOS_hack.htm" target="_blank" onclick="return openNew(this.href);">http://www.labmice.net/articles/BIOS_hack.htm (MORE Back Door Passwords Here :0)

Sony Vaio http://www.experts-exchange.com/Operating_Systems/Q_20935953.html
IBM Thinkpad http://www.ja.axxs.net/unlock/

*******************************

the above taken gratefully from http://www.experts-exchange.com/Security/Q_21406957.html?query=lost+bios+password&clearTAFilter=true

Here are some additional links that help with the Bios password:

 http://www.elfqrin.com/docs/biospw.html
 http://www.pwcrack.com/bios.shtml
 http://www.freelabs.com/~whitis/security/backdoor.html
 
Also try this:

 "Most Toshiba laptops and some desktop systems will bypass the BIOS password if the left shift key is held down during boot"

 This quote is from: http://www.uktsupport.co.uk/reference/biosp.htm

 

A few thoughts:

It may not necessarily be a BIOS password, but a HDD password. Since ATA-3, it has been possible to prevent a HDD from performing any read/write operations without entering the appropriate password. This adds an extra layer of security to the data stored because simply removing the drive and putting it in another machine will still not allow you to read or write on the drive. I have not seen any viruses taking advantage of this feature yet, but there have been murmerings in the industry that it is inevitable.

Two suggestions:

1> Totally unrelated but worth checking - Remove any attached USB devices which the machine may be mistakenly trying to boot off and seeing incorrectly.

2> Try booting off a CD - either XP installation recovery cd or a forensics boot disk like Mini-PE. If you can actually boot, then you know you don't have a BIOS problem. The tools on the forensics disk will help you access the data on the hard-disk if it's not protected by the above mentioned ATA security. If you can't read from the disk, then password removal and recovery from the disk is a difficult task.

If it is a BIOS password problem, then maybe flashing the BIOS is doable, but I think you'd need the password anyway before you could do that (it's been a loooong time since I've had to deal with such an issue...)

Good luck