HOW TO BYPASS BIOS PASSWORDS

Accessing information on the hard disk

When you turn on the host machine,

Ø enter the CMOS setup menu (usually you have to press F2, or DEL, or CTRL+ALT+S during the boot sequence) and

Ø go to STANDARD CMOS SETUP

Ø set the channel to which you have put the hard disk as TYPE=Auto, MODE=AUTO,

Ø Then SAVE & EXIT SETUP.

Ø Now you have access to the hard disk.


Standard BIOS backdoor passwords

The first, less invasive, attempt to bypass a BIOS password is to try on of these standard manufacturer’s backdoor passwords:

AWARD BIOS
AWARD SW, AWARD_SW, Award SW, AWARD PW, _award, awkward, J64, j256, j262, j332, j322, 01322222, 589589, 589721, 595595, 598598, HLT, SER, SKY_FOX,

aLLy, aLLY, Condo, CONCAT, TTPTHA, aPAf, HLT, KDD, ZBAAACA, ZAAADA, ZJAAADC, djonet,

AMI BIOS
AMI, A.M.I., AMI SW, AMI_SW, BIOS, PASSWORD, HEWITT RAND, Oder

Other passwords you may try (for AMI/AWARD or other BIOSes)
LKWPETER, lkwpeter, BIOSTAR, biostar, BIOSSTAR, biosstar, ALFAROME, Syxz, Wodj


Flashing BIOS via hardware

If you can’t Access the Computer when it’s on, and the standard backdoor passwords didn’t work, you’ll have to flash the BIOS via hardware. Please read the important notes at the end of this section before to try any of these methods.

Using the jumpers

1. The canonical way to flash the BIOS via hardware is to plug, unplug, or switch a jumper on the motherboard (for “switching a jumper” I mean that

2. you find a jumper that joins the central pin and a side pin of a group of three pins,

3. you should then unplug the jumper

4. and then plug it to the central pin and to the pin on the opposite side,

5. so if the jumper is normally on position 1-2,

6. You have to put it on position 2-3 or viceversa).

7. This jumper is not always located near to the BIOS, but could be anywhere on the motherboard.

8. While the computer is turned OFF.

9. Wait a couple of seconds then put the jumper back to its original position.

10. In some motherboards it may happen that the computer will automatically turn itself on,

11. After flashing the BIOS. In this case,

12. turn it off, and put the jumper back to its original position,

13. Then turn it on again. Other motherboards require you turn the computer on for a few seconds to flash the BIOS.

Removing the battery

Ø If you can’t find the jumper to flash the BIOS or if such jumper doesn’t exist,

Ø You can remove the battery that keeps the BIOS memory alive.

Ø It’s a button-size battery somewhere on the motherboard (on elder computers the battery could be a small, typically blue, cylinder soldered to the motherboard,

Ø but usually has a jumper on its side to disconnect it,

Ø Otherwise you’ll have to unsolder it and then solder it back).

Ø Take it away for 15-30 minutes or more,

Ø then put it back and the data contained into the BIOS memory should be volatilized

Ø I’d suggest you to remove it for about one hour to be sure,

Ø Because if you put it back when the data aren’t erased yet you’ll have to wait more time, as you’ve never removed it.

Ø If at first it doesn’t work, try to remove the battery overnight.

Ø Important note: in laptop and notebooks you don’t have to remove the Computer’s power batteries (which would be useless),

Ø But you should open your computer and remove the CMOS battery from the motherboard.

Short-circuiting the chip

Ø Another way to clear the CMOS RAM is to reset it by short circuiting two pins of the BIOS chip for a few seconds.

Ø You can do that with a small piece of electric wire or with a bended paper clip.

Ø Always make sure that the Computer is Turned OFF before to try this operation.
Similar chips with different names if they are compatible chips made by another brand.

Ø If you find the BIOS chip you are working on matches with one of the following you can try to short-circuit the appropriate pins.

Ø Be careful, because this operation may damage the chip.

For more information, Call us on 1-888-889-3335 or visit Ask PC Experts and we shall be glad to help you.

Latest Virus is Microsoft Security Update!!!

Ask PC Experts - Latest news via sources.

Virus writers are never out of jobs. In October itself they have come up with a new way to lure all Internet users. They have disguised a Trojan as a Microsoft Security update. When the user clicks on the spoof Microsoft Security update email link, they allow a Trojan horse to sit inside the machine allowing the remotely located resource to control it. To convince the users, there is also a EULA screen where the customer has to agree to the terms and conditions.



Here’s what you get if you have the email:

IP(s)/Domains(s): 66.49.184.119 (No WHOIS available)
URL(s): http://66.49.184.119/Windows-KB899588-x86-ENU.exe
Recommend Block?: Yes - For the time being

Description

Our first trojan write-up since we’ve been gone. This trojan uses a “Windows Update” spam as its lure. The email sent out reads:

Subject: Critical security update available

Microsoft Security Bulletin MS05-039
Vulnerability in Plug and Play Could Allow Remote Code Execution and Elevation of Privilege (899588)
Summary:
Who should receive this document: Customers who use Microsoft Windows
Impact of Vulnerability: Remote Code Execution and Local Elevation of Privilege
Maximum Severity Rating: CRITICAL
Recommendation: Customers should apply the update immediately.
Security Update Replacement: None
Caveats: None
Tested Software and Security Update Download Locations:

Affected Software:

• Microsoft Windows 2000 Service Pack 4 - Download the update
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 - Download the update
• Microsoft Windows XP Professional x64 Edition - Download the update
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 - Download the update
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems - Download the update
• Microsoft Windows Server 2003 x64 Edition - Download the update

Non-Affected Software:

• Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)

Executive Summary:

This update resolves a newly discovered, privately reported vulnerability. A remote code execution vulnerability exists in Plug and Play (PnP) that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Conclusion: We recommend that customers apply the update immediately.

© 2005 Microsoft Corporation. All rights reserved. Terms of Use | Trademarks | Privacy Statement

The filename to beware about is Wupdate-20050401.exe. All Internet users are requested to be careful about such emails and spam efforts passing under the name of Microsoft.

To know more about VIrus Problem Solutions and to select the Computer Security for your system check with us at ASK PC EXPERTS.