Windows 7 Locked after scam call - SYSKEY

Anonymous
2014-07-09T06:15:35+00:00

I have had a couple for customers fall for the "This is So and So from Windows 7 Tech support, we have detected malicious software on you PC. The customers have given the scamers access to the PC and its now locked with What looks like the XP Syskey lock screen. There are reports the Password are 123 or 1234 or abcd. But that all failed. If you have this problem:

THIS IS FOR WINDOWS 7 ONLY, MAY WORK ON OTHER OS!!!!

I have repaired the syskey issue when created by scam call from “Windows 7 Tech Support” in windows 7. I repaired customers computers (1 32-bit and 1 64-bit) successfully, To remove following the steps below:

1.     Boot from windows 7 install cd.

2.     When the Install Windows page appears, click Repair your computer to access system recovery options.

3.     Run System Restore to last point before syskey password blocked access. (This will fail, but must be done). Click run system restore again (this will take you back to the options list)

4.     Open Command Prompt from the options list.

5.     Open Regedit (Type regedit into the command prompt). Regedit will open.

6.     Navigate to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa, and change 'SecureBoot' value to 0.

7.     HKEY_LOCAL_MACHINE \SAM\SAM\Domains\Account Change F value to 0000

8.     Reboot and Login

This has worked for me on two machines. After reboot I ran Super-anti Spyware, Ad-Aware and Hitman Pro to confirm, found 68 items on Super-Anti Spyware, 5 more on ad aware and no further detection's on Hitman Pro. The PC now runs fine with not Lockouts or Passwords.

Hope this helps everyone with this problem.

MICROSOFT / WINDOWS 7 SUPPORT WILL NEVER RING YOU UNLESS YOU HAVE REQUESTED THEM TO DO SO!!!!!!!!!!!!!!!!

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

64 answers

Sort by: Oldest
  1. Anonymous
    2017-02-20T17:23:39+00:00

    It has screws on the outside edges of that panel you have to remove and they unscrewed easy, but also has 4 in the center and are a little deeper than the ones on the outside edges, and I can't get them to budge!

    Use a screw driver with a larger handle.

    Was this answer helpful?

    0 comments No comments
  2. Monkey57 3,535 Reputation points
    2017-02-20T17:32:30+00:00

    It is not a good idea to attempt to to evade security measures built into the software.  One bad key stroke, and/or using outdated info, or scratching a critical hardware component;  and you may never see your data again!

    See:

    https://www.youtube.com/user/LewissTech/videos

    Some of his videos show some of the common methods scammers use, in the initial phases of the scam;  consider posting/asking on his youtube channel.

    Look for the common syskey codes used by these malicious actors, in the large network of scammers.  Consider taking the computer/device to a local professional.

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2017-02-20T18:01:20+00:00

    It is not a good idea to attempt to to evade security measures built into the software.  One bad key stroke, and/or using outdated info, or scratching a critical hardware component;  and you may never see your data again!

    In my capacity as an electronics engineer with decades of experience I have to add the "scratching a critical hardware component" is not an issue. Static discharge or a torn ribbon cable (e.g. when slipping with a screw driver) is a much greater danger. The hard disk is particularly robust in its metal case and its data can be read even if the motherboard is beyond repair - provided, of course, that the OP gets around the SysKey issue!

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments
  4. Anonymous
    2017-02-20T18:15:55+00:00

    It is my knowledge from over 20 years of expertise that 99% of the time Windows built in protection can be circumvented easier than any other OS it has been proven time and time again....

    As long as you keep a strict log or record what you are doing you can very easily undo anything that might get broken by accident...

    I am extremely pro learn how to do things yourself my customers are very happy with me because 1 I don't lie to them 2 I teach as I work and 3 I encourage them to break their systems and learn how to fix them!

    Even though I do this my customers are still repeat customers and I do not rip them off like these so called "professionals" 

    I have betatested for for some big name security software companies and enjoyed that greatly please I encourage you continue you're research into the syskey fixes who knows you might come across the simplest fix find someone who can write a script or program and go into business together!

    Was this answer helpful?

    0 comments No comments
  5. Monkey57 3,535 Reputation points
    2017-02-20T18:28:59+00:00

    Yes, there are many hurdles in a novice disassembling a device and/or making configuration changes in a disconnected OS hard-drive.   And between you and me;  today, there are other ways to recover the data, and reload the OS (i.e. i be a professional, too)....

    The critical issue is:   the computer remains compromised, even if the SysKey code is guessed/reconfigured, as Allowed suspicious access has obviously been granted, and there is no telling what has been done to the computer, and/or information harvested;  the device should be considered compromised;  until a clean install is done.  All passwords should be changed from a safe device, or after the clean install, and financial accounts should be watched closely....

    The data can probably be recovered by a local professional, regardless of the 'current' SysKey issue;  as long as the drive is not damaged.  

    If the data is Backed up, there are quick and easy ways to resolve the issue by the user->clean install, then restore data and software.

    Was this answer helpful?

    0 comments No comments