<div dir="ltr"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">If the BIOS wasn't locked down, there is also the possibility that someone actually flashed the BIOS with a different version.</blockquote>
<div class="gmail_extra">A comment on the above: You don't need access to the BIOS to be able to flash a new one. You can flash even a password protected BIOS. You simply boot to a media that contains the BIOS you intend to flash and the OS/program used to perform the actual flash.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">On patron computer, it's always important to do the following in your BIOS before the first patron ever touches it:</div><div class="gmail_extra">* Set your BIOS administrative password.</div>
<div class="gmail_extra">* Set the boot order to boot from the hard drive first or to boot ONLY from the hard drive.</div><div class="gmail_extra">* Disable the ability to boot from removable media.</div><div class="gmail_extra">
<br></div><div class="gmail_extra">Those basic steps help to protect your patron computers at the "hardware" level.</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br clear="all"><div>______________________________<br>
<b>Chad Neeper</b><br><font size="1">Senior Systems Engineer</font><br><br><b>Level 9 Networks</b><br><font size="1">740-548-8070 (voice)<br>866-214-6607 (fax)</font><br><br><font size="1"><i>Full LAN/WAN consulting services -- Specialized in libraries and schools</i></font><br>
</div>
<br><br><div class="gmail_quote">On Wed, Nov 20, 2013 at 10:29 AM, Ken Butler <span dir="ltr"><<a href="mailto:hcotech@holmeslib.org" target="_blank">hcotech@holmeslib.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr">If the settings that password protect the hard drive are in the BIOS, I would try removing the CMOS battery for a period of time - say half an hour or more, and also pressing the power button while it is unplugged to clear out any residual power in the system. Once it has been drained and the battery removed for half an hour or more, try putting the battery back in and see what you get. Removing power from the BIOS for a decent period of time SHOULD revert all settings to default.<div>
<br></div><div>If the BIOS wasn't locked down, there is also the possibility that someone actually flashed the BIOS with a different version. If what I mentioned above doesn't work, I'm not sure what you could do other than talking to your computer manufacturer to see if there are any back doors in the BIOS that you can use, or if there is a way to flash the BIOS with the standard version for that computer.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote"><div><div class="h5">On Wed, Nov 20, 2013 at 10:16 AM, Mike Hensel <span dir="ltr"><<a href="mailto:henselmi@oplin.org" target="_blank">henselmi@oplin.org</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div class="h5"><div lang="EN-US" link="#0563C1" vlink="#954F72">
<div><p class="MsoNormal"><span style="color:rgb(31,73,125)">Ron:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)">I cleared the CMOS jumpers on the motherboard which allows me to at least get to the Bios but once I’m there I cannot change or turnoff the HD password because I don’t know it – it has been set by the individuals that locked up the machines – at least that’s my guess. I tried my admin passwords but they don’t seem to work.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)">I read online that Dell may have a backdoor password so I may give them a call. <u></u><u></u></span></p>
<div><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><div><p class="MsoNormal"><span style="color:rgb(31,73,125)">Mike Hensel<u></u><u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)">Director, MLIS<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">London Public Library<u></u><u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)">20 E. First Street<u></u><u></u></span></p><p class="MsoNormal">
<span style="color:rgb(31,73,125)">London, OH 43140<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><a href="http://www.mylondonlibrary.org" target="_blank"><span style="color:rgb(5,99,193)">www.mylondonlibrary.org</span></a><u></u><u></u></span></p><p class="MsoNormal">
<span style="color:rgb(31,73,125)"><a href="tel:740-852-9543" value="+17408529543" target="_blank">740-852-9543</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Mobile <a href="tel:614-325-1429" value="+16143251429" target="_blank">614-325-1429</a><u></u><u></u></span></p></div><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
</div><div><div style="border-style:solid none none;border-top-color:rgb(225,225,225);border-top-width:1pt;padding:3pt 0in 0in"><p class="MsoNormal"><b>From:</b> Ron Woods [mailto:<a href="mailto:woodsro@oplin.org" target="_blank">woodsro@oplin.org</a>] <br>
<b>Sent:</b> Wednesday, November 20, 2013 10:09 AM<br><b>To:</b> 'Mike Hensel'; <a href="mailto:oplintech@oplin.org" target="_blank">oplintech@oplin.org</a><br><b>Subject:</b> RE: [OPLINTECH] Potential Computer Vandalism<u></u><u></u></p>
</div></div><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><span style="color:rgb(31,73,125)">Hi,<u></u><u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal">
<span style="color:rgb(31,73,125)">is this a boot password that’s stored in the BIOS? Or some kind of encryption on the hard drive?<u></u><u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Does clearing the CMOS jumper on the motherboard remove the password? I wouldn’t think you have to replace the hard drive to clear a BIOS boot password, all that should be required is clearing the CMOS jumper pins on the motherboard…unless were talking about some kind of hard drive boot encryption set with a password? <u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)">Ron Woods<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Computer Services Manager<u></u><u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)">St. Clairsville Public Library<u></u><u></u></span></p><p class="MsoNormal">
<span style="color:rgb(31,73,125)"><a href="tel:%28740%29-695-2062" value="+17406952062" target="_blank">(740)-695-2062</a><u></u><u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)"><a href="http://www.stclibrary.org" target="_blank">http://www.stclibrary.org</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div><div style="border-style:solid none none;border-top-color:rgb(181,196,223);border-top-width:1pt;padding:3pt 0in 0in"><p class="MsoNormal"><b><span style="font-size:10pt;font-family:Tahoma,sans-serif">From:</span></b><span style="font-size:10pt;font-family:Tahoma,sans-serif"> <a href="mailto:oplintech-bounces@lists.oplin.org" target="_blank">oplintech-bounces@lists.oplin.org</a> [<a href="mailto:oplintech-bounces@lists.oplin.org" target="_blank">mailto:oplintech-bounces@lists.oplin.org</a>] <b>On Behalf Of </b>Mike Hensel<br>
<b>Sent:</b> Wednesday, November 20, 2013 9:21 AM<br><b>To:</b> <a href="mailto:oplintech@lists.oplin.org" target="_blank">oplintech@lists.oplin.org</a><br><b>Subject:</b> [OPLINTECH] Potential Computer Vandalism<u></u><u></u></span></p>
</div></div><div><div><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">OPLINTech Libraries:<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">I’ve got a situation where one of my patron computers last week booted up with a Security Manager Screen that basically needed a password to boot from the hard drive. We run DeepFreeze on all of the computers. I eventually had to get another hard drive sent from Dell. Last night 5 more computers displayed the same message. We lock the computers down with policies as well. I have not seen any virus alerts pop up in Symantec. We run Symantec Endpoint. I don’t believe we had the bios locked down so the only thing I can think of is someone logged into the bios and setup an password on access to the HD which is leaving our machines dead. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Has anyone run across this scenario and is there any easy fixes besides getting a new hard drive and rebuilding the machine. I’m trying to determine if it was a local hack (patron at each machine) or virus.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Any help would be appreciated.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Mike Hensel<u></u><u></u></p><p class="MsoNormal">
Director, MLIS<u></u><u></u></p>
<p class="MsoNormal">London Public Library<u></u><u></u></p><p class="MsoNormal">20 E. First Street<u></u><u></u></p><p class="MsoNormal">London, OH 43140<u></u><u></u></p><p class="MsoNormal"><a href="http://www.mylondonlibrary.org" target="_blank">www.mylondonlibrary.org</a><u></u><u></u></p>
<p class="MsoNormal"><a href="tel:740-852-9543" value="+17408529543" target="_blank">740-852-9543</a><u></u><u></u></p><p class="MsoNormal">Mobile <a href="tel:614-325-1429" value="+16143251429" target="_blank">614-325-1429</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p></div></div></div></div><br></div></div>_______________________________________________<br>
OPLINTECH mailing list<br>
<a href="mailto:OPLINTECH@lists.oplin.org" target="_blank">OPLINTECH@lists.oplin.org</a><br>
<a href="http://lists.oplin.org/mailman/listinfo/oplintech" target="_blank">http://lists.oplin.org/mailman/listinfo/oplintech</a><br>
Search: <a href="http://oplin.org/techsearch" target="_blank">http://oplin.org/techsearch</a><br>
<br></blockquote></div><span class=""><font color="#888888"><br><br clear="all"><div><br></div>-- <br><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">Ken Butler<br><a href="mailto:hcotech@holmeslib.org" target="_blank">hcotech@holmeslib.org</a><br>
Head of Information Technology</span><div><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">Holmes County District Public Library<br>3102 Glen Drive<br>Millersburg, OH 44654<br>PH: <a href="tel:330-674-5972%20ext%20224" value="+13306745972" target="_blank">330-674-5972 ext 224</a></span></div>
</font></span></div>
<br>_______________________________________________<br>
OPLINTECH mailing list<br>
<a href="mailto:OPLINTECH@lists.oplin.org">OPLINTECH@lists.oplin.org</a><br>
<a href="http://lists.oplin.org/mailman/listinfo/oplintech" target="_blank">http://lists.oplin.org/mailman/listinfo/oplintech</a><br>
Search: <a href="http://oplin.org/techsearch" target="_blank">http://oplin.org/techsearch</a><br>
<br></blockquote></div><br></div></div>