<div dir="ltr">We had a BIOS virus here a few years ago. It rendered the system useless. Well, unless you LIKE pop-ups and such. I was told by a few virus scanning companies that BIOS viruses are so rare that they are considered nonexistent. Really? Either they exist rarely, or not at all. Anyway, our ultimate solution, in this case, was a new motherboard. The BIOS virus disabled all bootable media except the original HD so re-flashing the BIOS was out. We think it was "installed" as part of some video utility or a website pop-up<div>
<br></div><div> Not exactly on point, but I thought worth mentioning.<br><p><img alt="v-card QR scan code" src="http://norweld.org/Images/vcard_qrcode.png" style="width: 100px; min-height: 100px; margin: 5px; float: left;"><br>
<b>Bill Hardison</b><br>Computer Services Coordinator<br>Northwest Regional Library System (NORWELD)<br>
<a href="tel:419-352-2903" value="+14193522903" target="_blank">419-352-2903</a><span dir="ltr"></span><br><b>Yahoo IM - TechnobraryGeek</b><i><br><br>You rush a miracle man, you get rotten miracles.</i><br>Miracle Max: The Princess Bride (1987)</p>
<div></div><div></div><div></div><div></div>
<div style="padding:0px;margin-left:0px;margin-top:0px;overflow:hidden;word-wrap:break-word;font-size:10px;line-height:13px"><em>This message and any response to it may constitute a public record and thus<br>may be publicly available to anyone who requests it.</em></div>
</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Nov 20, 2013 at 10:29 AM, Chad Neeper <span dir="ltr"><<a href="mailto:cneeper@level9networks.com" target="_blank">cneeper@level9networks.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">If the BIOS in your computers has the ability to set a hard drive password....and someone has done it, then your hard drive is probably now rendered useless without that password. As a matter of course, I ALWAYS ensure that the BIOS/CMOS passwords are set so patrons can't get in there and wreak havoc!<div>
<br></div><div>I've gone a round or two trying to find a way to wipe a password from an otherwise perfectly good hard drive. It's particularly difficult and I ultimately gave up.</div><div><br></div><div>The password stays with the hard drive, so even if you remove the drive and connect it to another computer, the drive will identify itself to the host operating system, but that's all the further it will go. The password is stored on one of the hard drive platters. So to remove the password, you have to do a low-level access of the disk and know EXACTLY which bytes to locate and interpret or overwrite. It'll be different for each model hard drive.</div>
<div><br></div><div>I don't know of any malware that will enable a HD password, although I suppose it's probably possible. Most of the malware that encrypts does so at the file level, leaving your OS intact. They're trying to extort money from you, so it's usually just the data files that get encrypted. Your situation definitely sounds more like a pesky patron setting the HD password, just like you suspect.</div>
<div><br></div><div>I think your only option here is to ensure that all of your patron computers now have their BIOS passwords enabled, replace the locked hard drives, and locate your pesky patron if possible and invite him/her into a dark alley.</div>
<div><br></div><div>Good luck!</div><div><br></div></div><div class="gmail_extra"><br clear="all"><div>______________________________<br><b>Chad Neeper</b><br><font size="1">Senior Systems Engineer</font><br><br><b>Level 9 Networks</b><br>
<font size="1"><a href="tel:740-548-8070" value="+17405488070" target="_blank">740-548-8070</a> (voice)<br><a href="tel:866-214-6607" value="+18662146607" target="_blank">866-214-6607</a> (fax)</font><br><br><font size="1"><i>Full LAN/WAN consulting services -- Specialized in libraries and schools</i></font><br>
</div>
<br><br><div class="gmail_quote"><div><div class="h5">On Wed, Nov 20, 2013 at 9:20 AM, Mike Hensel <span dir="ltr"><<a href="mailto:henselmi@oplin.org" target="_blank">henselmi@oplin.org</a>></span> wrote:<br></div>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div lang="EN-US" link="#0563C1" vlink="#954F72"><div><p class="MsoNormal">OPLINTech Libraries:<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">I’ve got a situation where one of my patron computers last week booted up with a Security Manager Screen that basically needed a password to boot from the hard drive. We run DeepFreeze on all of the computers. I eventually had to get another hard drive sent from Dell. Last night 5 more computers displayed the same message. We lock the computers down with policies as well. I have not seen any virus alerts pop up in Symantec. We run Symantec Endpoint. I don’t believe we had the bios locked down so the only thing I can think of is someone logged into the bios and setup an password on access to the HD which is leaving our machines dead. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Has anyone run across this scenario and is there any easy fixes besides getting a new hard drive and rebuilding the machine. I’m trying to determine if it was a local hack (patron at each machine) or virus.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Any help would be appreciated.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Mike Hensel<u></u><u></u></p><p class="MsoNormal">
Director, MLIS<u></u><u></u></p>
<p class="MsoNormal">London Public Library<u></u><u></u></p><p class="MsoNormal">20 E. First Street<u></u><u></u></p><p class="MsoNormal">London, OH 43140<u></u><u></u></p><p class="MsoNormal"><a href="http://www.mylondonlibrary.org" target="_blank">www.mylondonlibrary.org</a><u></u><u></u></p>
<p class="MsoNormal"><a href="tel:740-852-9543" value="+17408529543" target="_blank">740-852-9543</a><u></u><u></u></p><p class="MsoNormal">Mobile <a href="tel:614-325-1429" value="+16143251429" target="_blank">614-325-1429</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p></div></div><br></div></div><div class="im">_______________________________________________<br>
OPLINTECH mailing list<br>
<a href="mailto:OPLINTECH@lists.oplin.org" target="_blank">OPLINTECH@lists.oplin.org</a><br>
<a href="http://lists.oplin.org/mailman/listinfo/oplintech" target="_blank">http://lists.oplin.org/mailman/listinfo/oplintech</a><br>
Search: <a href="http://oplin.org/techsearch" target="_blank">http://oplin.org/techsearch</a><br>
<br></div></blockquote></div><br></div>
<br>_______________________________________________<br>
OPLINTECH mailing list<br>
<a href="mailto:OPLINTECH@lists.oplin.org">OPLINTECH@lists.oplin.org</a><br>
<a href="http://lists.oplin.org/mailman/listinfo/oplintech" target="_blank">http://lists.oplin.org/mailman/listinfo/oplintech</a><br>
Search: <a href="http://oplin.org/techsearch" target="_blank">http://oplin.org/techsearch</a><br>
<br></blockquote></div><br></div>