{"id":217,"date":"2013-04-10T10:57:31","date_gmt":"2013-04-10T15:57:31","guid":{"rendered":"http:\/\/triplescomputers.com\/blog\/?p=217"},"modified":"2015-06-26T13:37:43","modified_gmt":"2015-06-26T18:37:43","slug":"solution-this-is-microsoft-support-telephone-scam-computer-ransom-lockout","status":"publish","type":"post","link":"https:\/\/www.triplescomputers.com\/blog\/casestudies\/solution-this-is-microsoft-support-telephone-scam-computer-ransom-lockout\/","title":{"rendered":"SOLUTION: “This is Microsoft Support” telephone scam – Computer ransom lockout"},"content":{"rendered":"

A trend of the past couple of years has been for scammers to contact computer owners\u00a0directly via telephone\u00a0<\/em>in the United States in an effort to convince them that there is a problem with their PC and they’ll need to pay to have it fixed. \u00a0In general, these people cannot fix anything, and instead they merely charge exorbitant fees for absolutely nothing. In other words, they scam you.<\/p>\n

The call generally goes something like this:<\/p>\n

    \n
  1. A foreigner with a thick Indian accent identifies himself as a member of Microsoft Support or similar.
    \n<\/span><\/li>\n
  2. He informs you that you have a number of critical problems with your PC and that you will need to have it fixed.<\/li>\n
  3. To convince you, he offers to connect remotely and pulls up your Event Log (eventvwr.msc). \u00a0He then filters for Warnings, Errors, and Critical events and uses that as evidence that your PC will soon fail to work correctly if you do not pay him to correct it.<\/li>\n<\/ol>\n

    The astute among you have probably already sensed that something here is seriously wrong, and it’s not your PC. It’s the fact that someone is calling you\u00a0<\/em>to tell you there is a problem with your computer. No one will ever do that. The only way they could possibly know there is a problem is by hacking or guessing.<\/strong><\/p>\n

    In this case, it’s mere guesswork, and it’s not even correct most of the time. The Event Log is supposed\u00a0<\/i>to log warnings and errors, and even on the healthiest of PCs there are plenty of Error Events that can be safely ignored, as they often don’t amount to anything. The important thing to remember is to\u00a0never trust someone\u00a0<\/strong>who calls you about a problem with your PC, and\u00a0never, EVER\u00a0<\/strong>let them connect remotely to your PC.
    \n<\/span><\/p>\n

    If you\u00a0do<\/em>\u00a0<\/strong>make the mistake of letting them connect, but then you happen to get cold feet and refuse to pay the $180+ they request via credit card, the next thing that happens isn’t pretty. This scammer proceeded to actually follow through on his promise of the PC “not working” if they don’t agree to have him fix it, and so in a few quick steps, behind the user’s back, he enacted what is known as SysKey encryption on the SAM registry hive.<\/p>\n

    SysKey encryption is a little-known feature of Windows which allows administrators to lock out access to the Security Accounts Manager (SAM) registry hive so that login specifics cannot be stolen and the PC cannot be accessed without knowing the proper credentials. The problem is, unlike other scams, there is no way around the problem; you can’t simply remove the password, as the actual SAM hive has been encrypted entirely by the process. If your Windows installation has had SysKey activated, you’ll see the following message:<\/p>\n

    Startup Password<\/p>\n

    This computer is configured to require a password in order to start up. Please enter the Startup Password below.<\/p><\/blockquote>\n

    The window which appears looks like this:<\/p>\n

    \"This<\/p>\n

    The ONLY solution is to find a clean copy of the registry hives from before this occurred. This scammer knew this, however, and as such, he took an extra step to block any repair or recovery attempts: he\u00a0deleted all System Restore points on the machine<\/strong>, which normally house backup copies of the registry hives.<\/p>\n

    Unfortunately for him, I’m a much better technician. When the customer suspected foul play and decided to call me instead of proceeding, I immediately instructed them to power off the PC. Here’s how I fixed the problem without having to reinstall Windows.<\/p>\n

    FIRST, ensure you don’t have any Restore Points to work with:<\/strong><\/p>\n

      \n
    1. Check to ensure that the folder\u00a0%SYSTEMROOT%\\system32\\config\\RegBack<\/strong>\u00a0exists. \u00a0This is the folder which contains the last known good backup of the hives following a boot. \u00a0If it exists,\u00a0continue. \u00a0If not, stop and consider\u00a0contacting a technician instead.<\/li>\n
    2. Reboot the PC and repeatedly press F8 to reach the\u00a0Advanced Startup Options\u00a0<\/strong>menu.<\/li>\n
    3. Choose Repair your Computer<\/strong> from the menu.<\/li>\n
    4. Cancel\u00a0<\/strong>the automatic repair attempt and instead instruct the system to perform a\u00a0System Restore\u00a0<\/strong>to a date prior to the incident occurring.<\/li>\n<\/ol>\n

      If no Restore Points exist, your scammer intentionally removed them to prevent this from occurring. \u00a0If this happens to you, follow these additional steps to resolve the problem:<\/strong>
      \n<\/span><\/p>\n

        \n
      1. POWER OFF\u00a0<\/strong>your PC\u00a0immediately<\/em>.<\/li>\n
      2. Boot to external media of some sort (NOT your Windows installation) and navigate to the\u00a0%SYSTEMROOT%\\system32\\config\u00a0<\/strong>folder.<\/li>\n
      3. Backup the registry hives in this folder to a temporary location. The files are:\n
          \n
        1. SOFTWARE<\/li>\n
        2. SYSTEM<\/li>\n
        3. SAM<\/li>\n
        4. SECURITY<\/li>\n
        5. DEFAULT<\/li>\n<\/ol>\n<\/li>\n
        6. Navigate to\u00a0%SYSTEMROOT%\\system32\\config\\RegBack\u00a0<\/strong>as mentioned earlier.<\/li>\n
        7. Copy all registry hives from this folder (the same files as listed above) into the\u00a0%SYSTEMROOT%\\system32\\config\u00a0<\/strong>folder.<\/li>\n
        8. Reboot the PC.<\/li>\n<\/ol>\n

          This solution only works if you have not already tried to reboot the PC subsequently<\/strong>. \u00a0If you have, it\u00a0may\u00a0<\/em>still work, but that is entirely dependent upon whether or not Windows created a new RegBack copy following a successful boot.<\/p>\n

          In the case of my customer, it worked, and they were back in Windows, just like it never happened. \u00a0Nice try, scammer. \u00a0You’ll have to try harder to beat me though. \ud83d\ude42<\/p>\n

          Addendum A (update 6\/26\/2015):<\/strong><\/p>\n

          Thanks to FUScammers for pointing out this more involved, alternate method of actually\u00a0removing\u00a0<\/em>the SAM encryption.<\/p>\n

            \n
          1. Download this file<\/a>\u00a0and burn the .iso to a CD.<\/li>\n
          2. Boot to the CD on the affected system.<\/li>\n
          3. Follow the instructions to select the proper system drive and partition (NTFS is the partition type you are looking for).<\/li>\n
          4. Type the path to the registry files (it’s most likely Windows\/system32\/config<\/strong>).<\/li>\n
          5. Choose option 1 for Password reset (sam system security)<\/strong>.<\/li>\n
          6. Choose option 2 for Syskey status &\u00a0change<\/strong>.<\/li>\n
          7. Confirm that you wish to disable Syskey, then quit and confirm writing the new changes to the hive.<\/li>\n
          8. Reboot the PC and check.<\/li>\n<\/ol>\n

            For more detailed instructions, check out this link\u00a0(scroll down to \u201cHow to disable Syskey startup password\u201d):<\/p>\n

            http:\/\/computernetworkingnotes.com\/xp-tips-and-trick\/remove-administrator-password.html<\/a><\/p>\n

            In Windows 8, the GPT partition type makes the use of this utility impossible. \u00a0However, you can still manually copy the hives to a supported filesystem (NTFS or FAT32), mount that filesystem instead, and follow the steps from there, then copy the hives back over the originals. \u00a0I\u00a0can confirm that this method\u00a0does\u00a0<\/em>work and that even in Windows 8.1 recovery is possible using it.<\/p>\n","protected":false},"excerpt":{"rendered":"

            A trend of the past couple of years has been for scammers to contact computer owners\u00a0directly via telephone\u00a0in the United States in an effort to convince them that there is a problem with their PC and they’ll need to pay … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4,135],"tags":[],"class_list":["post-217","post","type-post","status-publish","format-standard","hentry","category-casestudies","category-security","category-recovery"],"_links":{"self":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts\/217","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/comments?post=217"}],"version-history":[{"count":0,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts\/217\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/media?parent=217"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/categories?post=217"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/tags?post=217"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}