Windows 10: Tech scam hit neighbor

My elderly neighbor fell victim to the Microsoft tech scam. She let him on to her computer remotely and now when you try to open Windows it asks for a password. Not a syskey password, but a password that wasn't there before. I thought, OK, I'll get her files off the HD and reload windows, no problem. However, the lock seems to be on the BIOS. The computer is a Dell AIO Inspiron 20. I tried to remove the cmos battery for 20 minutes thinking it would take off the lock, but it's still there. The problem is that when I try to fix it with the media creation tool, I can't because somehow I changed secure boot before the bios locked and I can't return to legacy boot. (those may be backwards)
Len

:)

 

Scam warnings

Follow either my link, or Don's steps, in this thread for getting rid of popup tech support scams. If you follow my link, no need to run those programs since not infection.

Edit: fixed broken link

Pop Up and Voice Alert Microsoft RDN Trojan Worm - Windows 10

Info on tech support scams and how to avoid them:

Tech Support Scams
Tech Support Scams

Tech Support Scams use new Tricks to Hold Browsers Hostage
Tech Support Scams use new Tricks to Hold Browsers Hostage

Beware of US-based Tech Support Scams

Beware of US-based Tech Support Scams - Malwarebytes Labs

PSA: Tech Support Scams Pop-Ups on the Rise

PSA: Tech Support Scams Pop-Ups on the Rise - Malwarebytes Labs

 

Tech Scam?

I was called about I have a virus on my computer. They said they were Microsoft support. They went in and did random stuff and this is what they said after.

MONEY ORDER

Need to go to nearest post office and do the money order of $599.99 usd on priority basis to Msupport , and give us the tracking number by calling us on the toll free number : 1-800-498-5006

pay to : Msupport

Address: 5910 great star drive #206

clarksville MD 21029

They also made this:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.1.4 (07.09.2017)

Operating System: Windows 10 Home x64

Ran by ----(Administrator) on Fri 11/17/2017 at 15:06:19.66

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 2

Failed to delete: C:\Program Files (x86)\Common Files\innovative solutions (Folder)

Successfully deleted: C:\WINDOWS\system32\Tasks\PCKeeper updater (Task)

Registry: 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 11/17/2017 at 15:20:31.32

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Moved from: [Microsoft Education / Sway / Other / Windows 10]

 

Hi Len.

Any chance this is a desktop. If so ....

https://www.dell.com/support/article...ssword?lang=en

If notebook web says to call Dell.

Can you enter BIOS but can't make changes or you can't enter BIOS?

 

It's an "All-in-one" Thanks for the info.
Len

 

I would expect that if you unplugged the computer and removed the coin battery for 20 minutes then it would have worked. But maybe the motherboard has some huge capacitance on that voltage rail...

From Inspiron 20 Owner's Manual
it looks like the RTCRST jumper is between the SODIMM sockets and the coin battery.

How to Perform a BIOS or CMOS Reset and/or Clear the NVRAM on your Dell System | Dell US

 

Have you removed the CMOS battery, disconnected all USB devices, unplugged the mains cable/lead & pressed the on/off button for 10 seconds to discharge any remaining power then left it for 20 minutes?
If it has any other battery if you can remove that as well before discharging any residual power too.
Once done reconnect everything again & boot up.

 

I couldn't find any jumpers at all on the board. I removed the cmos battery and held the power button. I will leave the battery out overnight. I hope this will wipe out the password.
Len

 

Remove the HDD from the computer and attach it to a working computer via USB-SATA Adapter, Dock or Enclosure. If the HDD isn't encrypted, you should be able to access the drive and recover it's files.
After backing up, go to Disk Management and Delete All Partitions so the drive is Unallocated Space. Put the drive back in the troubled computer. If you still can't boot from the Windows installer, restart and press F2 to enter Setup (Bios) If the Bios isn't Password Protected, go to the Security tab, if you see Secure Boot or Fast Boot, disable it or change it to Setup Mode. Go to the Boot tab. If you see UEFI Bios, add or change it to Legacy Bios. Save and Exit. On restart, boot back into the Bios with the Windows Installer in. At the Boot tab, the Windows Installer should show as a Legacy boot device Move this to first boot device, Save and Exit. On reboot, you should boot from the Installer.
At the Windows installer, choose your Language, then Custom Install. and go Next, Windows will automatically create partitions, and format them during the install.

 

Out of curiosity, does the motherboard at all match the photo in the manual I linked earlier?

 

It didn't match but I could find the battery. There was no visible data on the hard drive, just a single text file called Recovery. so I formatted it. Hopefully tomorrow I will be starting with an operable computer. I had previously removed the data by running a Linux live DVD and copying the files.

 

I guess you could try reflashing the BIOS if removing the battery doesn't reset the BIOS. This will only work if your existing BIOS will let you boot to a USB drive containing the BIOS update.

 

Since the computer is an AIO, I found this for a Dell AIO Inspiron 20-3052. The system board is very difficult to make out, but does it resemble what your system board looks like?





You could go on another computer, plug in the Dell service tag number and should be able to access the manual for target computer and look for specific information. If the version isn't 3052 please let us know.
--- You could also go to Dell on-line support and ask them if there are password reset jumpers on that system: naturally you'll want to explain why.

Since you mention the media creation tool, it appears to me you created install media via a USB or DVD.
It might be possible to disable Fast Boot.
--- Use the USB or DVD install media to see if you can get to Command Prompt: hopefully it will allow you to use it as (Admin).
--- If you can, enter powercfg.exe /hibernate off. If it takes I believe it turns off Fast Boot.
--- I've read re-starting a computer circumvents Fast Boot but if you actually can set Fast Boot to stay off it's better.

On having changed secure boot and the inability to return to legacy boot (those may be backwards): that's a tough one. However if you can do a System Restore via your install media, maybe that will help: I know that since the BIOS is involved, it might not work but I would consider it based on what else was changed on the computer maybe even in the registry.

 

Left the CMOS battery out all night, then held the power button 30 seconds, but when I put it back together and tried to load windows I received this message: The admin password is set. You cannot access setup until the correct password is entered... System number:6T5NDY1-1F66. (That is the service tag number). I can't seem to get past this.

 

Hi,
Yeah one can not add a bios password remotely
Only way to remove a admin password would be to reload windows unless Dell can do it which they may have a master but I doubt that.

Enable or Disable Elevated Administrator account in Windows 10 Windows 10 Tutorials