Computer Locked by Scammers

alfarom said:

I've just got a laptop in that's running Windows 10. The owner thought he was dealing with his broadband provider as he has been having trouble with his internet. However, it turns out it was a scam and he allowed them access to his laptop. When they asked him to login to his bank account he realised what was going on but the scammers then locked his computer. So now you can login but just get a message saying LOCKED. It then logs out after a minute or two. I've tried using a cmd prompt to see what that shows but it says it is encrypted with BitLocker which the customer says he hasn't setup.

I've included a screen shot of the locked screen.

Anything that can be done or has he lost everything?

Can you enter the BIOS and boot from a USB and take a look around? If his data is intact then you could use a Linux live USB and save his data?

Hello @alfarom,

[1] Obviously do NOT connect to the Internet.
[2] Can you Boot into Safe Mode or the BIOS?

You can download the Trinity Rescue Kit (free, live distribution) Trinity Rescue Kit | CPR for your computer - Trinityhome

Hello @alfarom,

I think the best and safest method is to Backup ALL his data [ see below ] and then perform a Clean Install. You could also create a System Image that can be used for maybe missed files when performing the Backup.

 Linux Live USB/DVD

A Linux Live USB/DVD is a good method of retrieving data from an otherwise un-bootable drive or if you are having other drive difficulties.

Basically . . .

[1] Download the Linux ISO - I always use Linux Mint although there are others available.
[2] Create a Bootable USB/DVD [ media ] using Rufus for example => Rufus.
[3] Boot the media.
[4] Copy the files from the OS to an external HDD/SSD or USB.

> Download Linux Mint 20 Ulyana

I hope this helps.

Data may not have been encrypted, I certainly hope with you that your data has been not encrypted!
You did not mention having backups, going forward, in the future, please routinely, maybe bimonthly, make full images of OS partitions and data partition onto external disconnectable media. Ransomware and malware problem is growing larger and larger every day.

Its possible its a con and its just something running at start to encrypt the disk would take some time so they may have just installed software thats fake