Locked out of Laptop

[DPChristman]

II was asked to try an recover this laptop (HP pavillion G7 running windows 10).

The owner fell victim to the out of the blue 'incoming tech support call' scam.

He actually allowed the caller to access his laptop remotely and begin tinkering around.

When he realized his mistake, he killed the laptop, and hadn't turned it back on since.

Prior to even turning it back on, I removed the drive, and ran antivirus programs, anti malware programs etc, via sata cable from my computer.

I successfully found and removed the software used to get into the system, as well as a number of viruses and malware.

however, when I put the drive back in and booted up the laptop, I got a system password (not windows password).

According to the owner, he did not set a system password, only a windows password.  That password did not work.

My guess is that the intruder managed to password the laptop before the owner had a chance to pull the plug.

Had he continued, I am guessing the intruder would have extorted the owner to unlock the machine.

After trying a number of things unsuccessfully, I was able to boot to a trouble shooting screen, and am currently running a system reset (keeping files), that has been sitting at 8% for a while now.

I have already told the owner that there is a strong possibility I will not be able to get into the machine.

If that is the case, we will need to wipe the drive and reinstall.

Problem is, he upgraded through the Win 10 program upgrade from 8.1, and does not have discs for either.

Anticipating this, I contacted Microsoft on the day I receieved the laptop (last Friday) to see if I could get a Win 10 install disc.

So far they have not gotten to me.

Any suggestions??

Dan

[Paul_Tikkanen]

Hi:

The good news out of all of this is that since the notebook was previously upgraded to W10 from W8.1 (and presumably successfully activated at the time of the upgrade), you can make your own W10 installation dvd or usb flash drive (need 4 GB flash drive), to reinstall W10.

You want the media creation tool from the link below...

http://www.microsoft.com/en-us/software-download/windows10

After you create the bootable media, boot from it and when you go to reinstall W10, you will be given two options...

Enter the W10 product key (which you don't have), or select the 'I don't have a product key' option.

You select the latter option, and windows 10 installs and automatically activates once the PC is reconnected to the internet, since Microsoft has a record that that PC was previously upgraded to W10.

I also recommend you select the skip check for updates which seems to slow the process down...at least it did for me.

Just install W10 and let it do the updates afterward.

[DPChristman]

Unfortunately, I dont think that will work.

On a more detailed second look...

When you start the computer, you get a message that reads:

This computer is configured to require a password in order to start up.

This suggest that the hacker changed (actually created) a startup password in the laptop, not windows.

That being the case, having the reinstall software won't do any good, because it is the laptop and not windows that is locked.

[Paul_Tikkanen]

If you are getting that message after you get past the HP welcome screen, you should be able to reinstall windows.

If the actual notebook was password protected, the only way to do that would be to put a password in the BIOS, and when you booted up the notebook, you would get a system disabled message when you go to enter an unknown password 3 times.

Can't you have the W10 dvd or flash drive in the notebook, turn it on, tap the ESC key at the beginning of the HP welcome screen, get a menu of options, select the F9 boot options menu and select the device you want to boot from?

If you are getting that message at the HP welcome screen, try entering any password 3 times and see if the PC generates a system disabled code.

If it does, post that code.

[DPChristman]

Ok, I had already pulled the HD from the laptop, and connected it to mine via sata cable.

I then did a search for the word "Syskey"

There were a lot of files referencing SYSKEY

However, the file listed below was dated 6/23/16  11:57 AM (day / time of the intrusion)

Doubt that that is a coincidence

SYSKEY.EXE-76801CB2.pf

I disconnected the drive, and put it back in the infected laptop.

I am booting it up now, and will try different variations of -76801CB2, 76801CB2, 76801

Who know, maybe the hacker was lazy, and wanted to make sure there was a code in there he could pull up later.

Right now the laptop is hung up on a "Undoing Changes" loop.  I don't know why, although I did try to put another drive in to see at what point I got the password prompt

[DPChristman]

Strange.  After putting the HD back in the laptop boots to an Windows options screen

Continue - Exit and Continue to Windows Recovery Invironment

Use a Divice - Use a USB, Network Connection or windows recovery DVD

Use another Operating System - Continue with another installed versionof Windows

Troubleshoot - reset your PC or See Advanced Options

Turnoff your PC

I am trying to create another USB - the first one did not work

[DPChristman]

Trying to run the tool to create a USB, I get the message 

There was a problem running this tool

We're not sure what happened, but we were unable to run this tool on your PC.  If you continue to experience problems, reference error code when contacting customer support 0xC180010C 0xA0019

[DPChristman]

So I have downloaded the ISO to my Harddrive.

How do I burn it to a DVD?

[Paul_Tikkanen]

Hi:

Install this free DVD burning software (if you don't have a DVD burning program that can burn an ISO file to a DVD so that it is bootable.

https://www.cdburnerxp.se/en/download

After you install CD Burner XP, launch it and select the Burn ISO Image option.  The browse to the ISO file you downloaded and follow the on screen instructions.

I like to change the burn speed to 4x or lower to get a nice burn into the DVD.

[DPChristman]

Thanks.  I actually found out how to do it through a Google seach.  The media creation tool had steps, but I clicked on finish too soon,