Windows 7 Locked after scam call - SYSKEY

Anonymous
2014-07-09T06:15:35+00:00

I have had a couple for customers fall for the "This is So and So from Windows 7 Tech support, we have detected malicious software on you PC. The customers have given the scamers access to the PC and its now locked with What looks like the XP Syskey lock screen. There are reports the Password are 123 or 1234 or abcd. But that all failed. If you have this problem:

THIS IS FOR WINDOWS 7 ONLY, MAY WORK ON OTHER OS!!!!

I have repaired the syskey issue when created by scam call from “Windows 7 Tech Support” in windows 7. I repaired customers computers (1 32-bit and 1 64-bit) successfully, To remove following the steps below:

1.     Boot from windows 7 install cd.

2.     When the Install Windows page appears, click Repair your computer to access system recovery options.

3.     Run System Restore to last point before syskey password blocked access. (This will fail, but must be done). Click run system restore again (this will take you back to the options list)

4.     Open Command Prompt from the options list.

5.     Open Regedit (Type regedit into the command prompt). Regedit will open.

6.     Navigate to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa, and change 'SecureBoot' value to 0.

7.     HKEY_LOCAL_MACHINE \SAM\SAM\Domains\Account Change F value to 0000

8.     Reboot and Login

This has worked for me on two machines. After reboot I ran Super-anti Spyware, Ad-Aware and Hitman Pro to confirm, found 68 items on Super-Anti Spyware, 5 more on ad aware and no further detection's on Hitman Pro. The PC now runs fine with not Lockouts or Passwords.

Hope this helps everyone with this problem.

MICROSOFT / WINDOWS 7 SUPPORT WILL NEVER RING YOU UNLESS YOU HAVE REQUESTED THEM TO DO SO!!!!!!!!!!!!!!!!

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2017-02-20T17:23:39+00:00

    It has screws on the outside edges of that panel you have to remove and they unscrewed easy, but also has 4 in the center and are a little deeper than the ones on the outside edges, and I can't get them to budge!

    Use a screw driver with a larger handle.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2017-02-20T17:14:06+00:00

    This was my first idea, but I can't get 4 screws to budge on the Acer Aspire 7540. It has screws on the outside edges of that panel you have to remove and they unscrewed easy, but also has 4 in the center and are a little deeper than the ones on the outside edges, and I can't get them to budge! I watched a YouTube video on changing the HD in that model and you have to unscrew those screws in the center also. Anyone have any special way of loosening tight screws?  So far the heads are not stripped.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2017-02-18T10:36:25+00:00

    I got as far down as the #7 ( Account change the F value to 0000  In the F value) In the F I have at least 17 2 didgits sets of numbers (Reg_Binary) I have ab icon that says  (Default) and REC_5Z That says (Value not set).

    Do I just wipe out all the vales in F and set  just the four Zero's, or Change the default to four zeros?

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-11-27T03:17:26+00:00

    This worked for me with windows 10 version 1607 build 14393.  As a precaution, I first renamed the original registry files in the config folder just in case the regback files did not fix the problem.  Then I copied the 5 registry files from the regback folder to the config folder.  The system booted clean on the next boot.

    Rather than remove the drive from the PC, I simply booted from a Windows PE flash drive and made the changes.  You can also boot from a Windows Installation disk and, at the Install Screen (second screen), select repair computer and then select the command prompt from the advanced options screen.

    Thanks to everyone who contributed, especially Richard and Roshankumar for those last two posts. A friend was struck with the siskey scam and the simple restoration of the backed up Registry files in the WinPE environment worked easily.

    Was this answer helpful?

    0 comments
  5. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more