Acer laptop bricked - need help for lost password

[ciccio]

A colleague gave me an Acer Travelmate 8471 laptop.
He set a startup password and forgot it, and the fingerprint reader seems not working.
I searched for a solution, but removing the BIOS battery and even the hard driver did not work.
I cannot even access the BIOS
All the solutions proposed on the Web seem inaccurate.
I found a site that wants to sell me a "master" password, but they need an error code that this machine does not give.
Can somebody give some help?
The machine is not new, and passing to Acer support (that will be, of course, costly) is not justified.
Thank you

[PA0PBZ]

I found a site that wants to sell me a "master" password, but they need an error code that this machine does not give.

You don't get an error code after entering a wrong password a few times?
If you do, here you can calculate the correct password without paying: http://www.tech-faq.com/how-do-i-reset-an-acer-bios-password.html

[ciccio]

Thank you for the response.
No, I do not get any error code: after 3 wrong password I get a message "System will halt" and then a black screen with a fixed cursor..

Best regards

[Tyrian]

The reason that pulling the battery doesn't work is that, on laptops, the password is actually stored on an EEPROM chip, not in CMOS.  This is probably the case with your laptop.  As a result, using a tool like cmospwd is a bad idea, as you can brick your laptop permanently.

That being said, there may still be some hope of recovery.  Acer laptops (some of them) have either a manual reset switch or jumper on the motherboard that can clear the EEPROM password.  You'll need to disassemble your laptop and go over the whole motherboard (both sides) to look for a switch.  Flip it, put the laptop back together, set a new password, open it up again, flip the switch back, and put the whole thing back together again.  Then you can input your newly set password to get into the BIOS to finally disable the need for a boot password.  The first place I'd look would be under the keyboard.

Whew.  That may get you your laptop back.

[ciccio]

Thanks.
I'll try to disassemble the laptop and see what I'll find inside.
Best regards

[amyk]

A quick Google finds the schematic, and reveals that this model has a TPM.

If you're lucky, it will not be in use and the password will be stored in the BIOS flash, which you can reflash to clear it.

Otherwise, chances are you'll have to replace the TPM chip.

[digsys]

Download ophcrack and create a bootable CD / USB. It's FREE and does an awesome job !! I've used it several times and it never failed.

[ciccio]

For what I understand, ophcrack removes Windows logon password.
The laptop is locked by a BIOS password.
Now I'm downloading it. Before dismantling the PC, I'll give a try.
Thank you for your cooperation
Best regards

[digsys]

For what I understand, ophcrack removes Windows logon password.
The laptop is locked by a BIOS password.
Now I'm downloading it. Before dismantling the PC, I'll give a try.

Yeah, sorry, you could be right, but as you say, can't hurt to try. Maybe they have a BIOS version? They're a good team.
I do remember cracking BIOS passwords long ago, I'll have a fish around to see if I can find what I used. Good luck

[malch]

You need to find a site like this: http://www.ja.axxs.net/eeprom_location.htm for Acer.
He lists the TPM part numbers for different Thinkpads. Your notebook might have the same chip.

[miguelvp]

from: http://www.fixya.com/support/t17795822-lost_bios_password_acer_travelmate_8471

just the jumper position on the mother board pin 1 and pin 2 will be occupied just unplug the power cord and remove the jumper and put the in 2 and 3 then wait for 5 sec then put the jumper to original position and power the laptop

and

Check on motherbord again you can find cmos cell it is look like round battery cell.
Then pull it for 10 minutes so all bios settings are defaults.
Also you can clear bios with jumper find jumper on motherbord it has 3 -pin 1-2-3 right now jumper is in 1-2 position set it to 2-3 position so your bios is clear.Then again set it to it's original position.
then it not ask for password.
Let me know if you need more assistance.
Thanks.

[ciccio]

I've found the Fixya answer before posting... I'ts not correct: it could be valid for a desktop PC (where password is stored in RAM) and I've never encountered a desktop motherboard where this solution will not work , but it is not applicable to the  ACER laptop I'm referring to (PLS read my first post).
Thanks anyway fr your time.
Best regards

[ciccio]

Acer laptops (some of them) have either a manual reset switch or jumper on the motherboard that can clear the EEPROM password.  You'll need to disassemble your laptop and go over the whole motherboard (both sides) to look for a switch.  Flip it, put the laptop back together, set a new password, open it up again, flip the switch back, and put the whole thing back together again.  Then you can input your newly set password to get into the BIOS to finally disable the need for a boot password.  The first place I'd look would be under the keyboard.

I dismantled the laptop. Countless screws and connectors... and I did not find any switch.
Tomorrow I'll try to reassemble it (hopefully)
How can I try to reflash the BIOS if the PC locks before booting (or it seems to do so)?
Thank you.

[wraper]

You need IC programmer to reprogram the bios flash IC. Even if notebook would boot, most likely, you would not be able to reprogram the needed flash region. Also you cannot just flash the bios downloaded from the acer website as it is not full image, it does not contain serial number and some other data. Though notebook likely would boot just like that, without editing the file, but with missing serial number and some other issues.

[wraper]

Or alternatively you can buy already programmed IC http://www.ebay.com/itm/Bios-Chip-ACER-Notebook-TravelMate-8481-8471-8481TG-8573-8172-8172Z-8471G-/281028639494?pt=LH_DefaultDomain_77&hash=item416e9cbb06

[wraper]

BTW for your particular model, removing battery seems to be the right solution. For how long time it was removed when this didn't work?

[Neverther]

Atleast http://www.cgsecurity.org/wiki/CmosPwd suggest removing the cmos battery for couple hours.

Site also has link to dogberts blog with scripts to recover passwords from checsums (I used the samsung one myself). Atleast with this laptop bypassing the password requires some work other than inputting couple numbers into a generator.

[bitwelder]

How can I try to reflash the BIOS if the PC locks before booting (or it seems to do so)?

Bus pirate + flashrom ?

[Tyrian]

Acer laptops (some of them) have either a manual reset switch or jumper on the motherboard that can clear the EEPROM password.  You'll need to disassemble your laptop and go over the whole motherboard (both sides) to look for a switch.  Flip it, put the laptop back together, set a new password, open it up again, flip the switch back, and put the whole thing back together again.  Then you can input your newly set password to get into the BIOS to finally disable the need for a boot password.  The first place I'd look would be under the keyboard.

I dismantled the laptop. Countless screws and connectors... and I did not find any switch.
Tomorrow I'll try to reassemble it (hopefully)
How can I try to reflash the BIOS if the PC locks before booting (or it seems to do so)?
Thank you.

Reflashing the BIOS may not help.  As I said before, the password (usually stored as a CRC32 hash) is kept in the EEPROM on laptops.  If the BIOS update doesn't clear the EEPROM, at best, you'll be back where you started.  It's why I suggested the motherboard switch first.  (You might want to take another pass looking for it though.  It'll be very small.)  Reflashing might be worth a shot though, if everything else fails.

Since you've got the laptop apart and I couldn't find what kind of BIOS you have on Google, try to find the BIOS chip on the motherboard.  Since there's an EEPROM involved, the BIOS chip should be one of a pair of small ICs.  Note the manufacturer and Google for "[manufacturer] default bios passwords" or "[manufacturer] backdoor bios passwords".  You'll get a number of lists.  You'll just have to try all the passwords for that manufacturer.  (If it happens to be an AWARD BIOS, the password I always use for them is AWARD_SW.)

[poot36]

On some laptop motherboards there is a group of switches but I have seen more with two <l l> shaped copper or solder coated pads that are usually near the cmos battery that allow you to clear the cmos by shorting them with a screwdriver or tweezers.  The pads can also look like a smd resistor or cap should have been placed there but is not populated.  Either way there will be thin traces going to these pads if they are thick that is usually for an unpopulated cap or power resistor (do not short these unless you are sure that it is the cmos clear pads)!  They may also be under the black stuck on covers under the ram sticks or in other places.

[Stonent]

On some laptop motherboards there is a group of switches but I have seen more with two <l l> shaped copper or solder coated pads that are usually near the cmos battery that allow you to clear the cmos by shorting them with a screwdriver or tweezers.  The pads can also look like a smd resistor or cap should have been placed there but is not populated.  Either way there will be thin traces going to these pads if they are thick that is usually for an unpopulated cap or power resistor (do not short these unless you are sure that it is the cmos clear pads)!  They may also be under the black stuck on covers under the ram sticks or in other places.

That is certainly the case on many toshibas fortunately.  I say fortunately because of the self locking bios fault that just randomly seems to set a password.

The typical eeprom I've seen on modern laptops is a 8 pin SPI chip about as big a two grains of rice side by side.

[ciccio]

Thanks to all for the suggestions.
I really appreciated the effort.
I could not find a viable option. It is still bricked.
Yesterday I reassembled the laptop and put it in a box.
I have no more free time for this job. Maybe during summer holidays.., or maybe my colleague will remember the password...

Thank you very much
Ciccio