"MS Support" victim with a new twist

[xxenon]

Hello all, The "Hi, I'm calling from Microsoft" scam artists seem to have been calling everyone in my neighborhood lately.

One of my customers fell for it and let them take control of her computer. Of course, they found tons of 'problems' and wanted $250.(greedy s.o.b's) to 'fix' them. They wanted her to wire them the money, but the people at her bank warned her this would be a bad idea, and she didn't.
Now her laptop, an Acer E1-572G running Win8.1, requires a Startup Password (not an Account Logon Pwd) and she has no idea what it is.
I can get into the bios, there are no bios passwords set.
Do any of the erds (DaRT8, Hiren's, etc.) have a reset for this?

 

[Blues]

Where is the prompt coming up what does it look like and what does it say?

 

[Martyn]

Kon boot http://www.piotrbania.com/all/kon-boot/

Is it a local password or online?

 

[NYJimbo]

I had one of those recently but a safe boot bypassed it. Did you try that ?

 

[xxenon]

I'm trying the pwd reset in DaRT8 now, will see if it works

 

[Larry Sabo]

http://www.technibble.com/forums/showpost.php?p=440363&postcount=16

 

[phaZed]

Not a new issue, sadly.

Sounds like the scammer has set up a "SysKey" password which actually encrypts the SAM registry hive. The only way around this is to have another copy of the SAM hive. I have come against this problem a few times and it's pretty much recover data, wipe and reload time.

You can read about it here.

http://www.technibble.com/forums/showthread.php?t=36882&highlight=syskey
http://www.technibble.com/forums/showthread.php?t=55536&highlight=syskey

 

[xxenon]

DaRT pwd reset didn't work.

Box pops up immediately after bios: Startup Password

This computer is configured to require a password in order to start up. Please enter the Startup Password below.

I have Konboot and others, But I believe they are all designed to reset a Windows account logon password. This is something else, not account logon, not bios.

 

[NYJimbo]

Can you take a picture so we can see if it matches anything we have seen ? The one I had was not some kind of encryption.

 

[xxenon]

Interesting, I'll boot into DaRT again and see if I can look at registry. I'm guessing these guys are so nasty they've been cut off by Visa and MC; this is the first time I've heard of a request for wire transfer.

 

[xxenon]

Yes , will get pic shortly, want to try a few more things on erd.

 

[phaZed]

SYSKEY:

 

[xxenon]

Thanks Aaron, That's it exactly.

Thanks Larry, I'll try that.

 

[AndyM]

Haven't encountered this before, but found this:

http://computernetworkingnotes.com/xp-tips-and-trick/remove-administrator-password.html

I know it says XP, but I figure every suggestion is worth something.

Andy

Edit: Just seen a bunch of other threads. Try and of the following three passwords: 123 12345 123456

 

[FremontPC]

If none of the above works (and make a copy of these files asap) check system32\config\regback to see if there are backups of the hives there.

 

[glricht]

I've run into the SysKey problem before and it's definitely a pain-in-the-b**t.

The only way I've found to remove it is to do a manual system restore to a restore point before the SysKey was turned on.

http://community.spiceworks.com/how...restore-manually-when-windows-is-not-bootable

http://support.microsoft.com/kb/307545

 

[JustInspired]

I've got one on the bench now. Syskey password was 1234. Hehe.

Restore points had been wiped.

 

[glricht]

I've got one on the bench now. Syskey password was 1234. Hehe.

Restore points had been wiped.

So now that you're in, how did you actually remove SysKey? Or does it turn itself off once you've entered the correct password?

I've been lucky that restore points were available and a manual system restore fixed the issue.

 

[Larry Sabo]

If the suggested passwords don't work, perhaps try Ophcrack to find it. BTW, using NTPWEdit on anything but XP is reported to cause continuous reboots. I think you can disable syskey by entering "syskey" in an elevated command prompt.

 

[JustInspired]

So now that you're in, how did you actually remove SysKey? Or does it turn itself off once you've entered the correct password?

I've been lucky that restore points were available and a manual system restore fixed the issue.

Hi Gary,
Instead of explaining I'll point you in the direction of this nice video which is pretty much the same as what we did: https://www.youtube.com/watch?v=5ow0NCpD0bU

Kind regards,
Julian