Windows 7 Locked after scam call - SYSKEY

Anonymous
2014-07-09T06:15:35+00:00

I have had a couple for customers fall for the "This is So and So from Windows 7 Tech support, we have detected malicious software on you PC. The customers have given the scamers access to the PC and its now locked with What looks like the XP Syskey lock screen. There are reports the Password are 123 or 1234 or abcd. But that all failed. If you have this problem:

THIS IS FOR WINDOWS 7 ONLY, MAY WORK ON OTHER OS!!!!

I have repaired the syskey issue when created by scam call from “Windows 7 Tech Support” in windows 7. I repaired customers computers (1 32-bit and 1 64-bit) successfully, To remove following the steps below:

1.     Boot from windows 7 install cd.

2.     When the Install Windows page appears, click Repair your computer to access system recovery options.

3.     Run System Restore to last point before syskey password blocked access. (This will fail, but must be done). Click run system restore again (this will take you back to the options list)

4.     Open Command Prompt from the options list.

5.     Open Regedit (Type regedit into the command prompt). Regedit will open.

6.     Navigate to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa, and change 'SecureBoot' value to 0.

7.     HKEY_LOCAL_MACHINE \SAM\SAM\Domains\Account Change F value to 0000

8.     Reboot and Login

This has worked for me on two machines. After reboot I ran Super-anti Spyware, Ad-Aware and Hitman Pro to confirm, found 68 items on Super-Anti Spyware, 5 more on ad aware and no further detection's on Hitman Pro. The PC now runs fine with not Lockouts or Passwords.

Hope this helps everyone with this problem.

MICROSOFT / WINDOWS 7 SUPPORT WILL NEVER RING YOU UNLESS YOU HAVE REQUESTED THEM TO DO SO!!!!!!!!!!!!!!!!

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2017-03-21T23:20:05+00:00

    I have the scammer's phone number.  One of my user was looking for Linkedin support and got this number and call and got syskey locked.  I've called them back with that number and just bogus at them to figured out where and who they are.   I wonder who can pin pointed where they are or bring in law enforcement on them?   someone please?

    Was this answer helpful?

    0 comments
  2. Monkey57 3,535 Reputation points
    2017-02-22T18:35:06+00:00

    With the problem at hand, I would just use a USB Linux boot media and copy the files  to another media... Or the user could plug the drive into their computer to copy the files, and if there is a virus on the compromised drive; share it with their machine.  (Hiren's is in my tool chest, but have not used it in a while (it's kinda old 2012))

    In the old days, the syskey blackmail situation, would be fixed and the user would go merrily on their way. Today, there are too may additional compromises, that the scammer/blackmailer could have done, to take a chance on not reformatting the drive.   So, nowadays, it's copy and clean install, and make sure the user has a good backup strategy, and is aware of the compromise to their data, passwords, and financial info.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2017-02-22T17:29:36+00:00

    With the problems at Hand Monkey57 they will be spending too much money at a local tech I could do the job for them in a matter of a couple hours waaaaay cheaper than any local tech and I would personally teach them how I did it that is why I have repeat customers and a few of the pc shops in my town shut down because they scammed these people including the Geek Squad biggest scam artists out there yet.

    Its not rocket science hiren's boot cd can fix the issue for them easily and its free

    Was this answer helpful?

    0 comments
  4. Anonymous
    2017-02-22T17:25:58+00:00

    Download Hirens boot cd burn it to a thumb drive or cd its relatively small.

    As the computer boots up usually f12 will get you into the boot menu to boot off the cd.

    it will give you options for using the tools from command prompt or XP lite...

    Boot into XP Lite you will have access to the former hard drive through my computer you will also have access to tools that can scan the hard drive for viruses and or surface errors that might be preventing you from doing anything.

    Worse comes to worse you can plug in a thumb drive back up the data through my computer  which won't harm anything if you watched any of the youtube videos on these syskey scams they generally have you download a program like myremotepc or something similar you punch in a pin they give you and thats how they get access but being the fact you are not backing up critical windows files needed to run the system nothing will auto startup so its clean backups.

    if you are worried and see something suspicious then use virustotal from a VM load all the files from the thumbdrive to a VM legitimate copy of the OS and scan the suspicious files with virus total.

    It is not rocket science it is very easy to do I use hirens a lot sometimes also to wipe passwords that shouldnt be set.

    if I am not mistaken there is also a tool that reads quite a bit of the boot records etc which can also repair boot records and in turn might also fix your problem if there is a busted MBR.

    Was this answer helpful?

    0 comments