Neighbor got siskeyed

lenberman · 15 Jan 2017

My neighbour fell for the Microsoft repair scam. When he wouldn't give the guy any money, he got zapped. Now when you try to boot you are stopped by a System Password window. He has W10 and I am trying to do the startup repair where you keep files intact. It's at 12% so far. Is the system likely to boot when the repair is done.
My second thought was to try and open with Linux Live and retrieve files, will I be able to do that? Then, hopefully, I will use the media creation tool to reload W10. Can I do that?
Len

spunk · 15 Jan 2017

Ransomware encrypts data and the malcontent wants you to pay them to decrypt the drive with a password. Restoring the computer may still not allow you to access the files. Booting from a Linux Live CD should allow you to find and copy the files to an external HDD, then on another computer, use the Media Creation Tool to make a USB or DVD Installer for Windows 10 then boot off of that and wipe the drive and reinstall Windows.

Samuria · 15 Jan 2017

If it is ransom ware some can be decrpted but we need to know hat type it is a screenshot of the system password screen may help do you mean the normal login or something else like a bios password?

topgundcp · 15 Jan 2017

If you wish, you can try:

Boot up with Windows Recovery disk or even with Linux.
Navigate to: C:\Windows\System32\config\RegBack. All the files under this folder are the backup registry files.
Copy them back to: C:\Windows\System32\config
Reboot the PC

essenbe · 15 Jan 2017

Try booting into the installation USB created on another computer. Use the Repair my computer option and see if you have any restore points. DO NOT try to boot to the OS again. If you do not have recovery points or it does not work here's something else to try. Assuming they didn't also delete the backup registry or the attempted reboots did not overwrite it. You can try this, with a Linux live distro or with the Windows 10 recovery ISO (Windows 10 Recovery Tools - Bootable Rescue Disk)

1.POWER OFF your PC immediately.
2.Boot to external media of some sort (NOT your Windows installation) and navigate to the %SYSTEMROOT%\system32\config folder.
3.Backup the registry hives in this folder to a temporary location. The files are:
A.SOFTWARE
B.SYSTEM
C.SAM
D.SECURITYE.DEFAULT

4.Navigate to %SYSTEMROOT%\system32\config\RegBack as mentioned earlier.
5.Copy all registry hives from this folder (the same files as listed above) into the %SYSTEMROOT%\system32\config folder.
6.Reboot the PC.

lenberman · 16 Jan 2017

I re-formatted my neighbor's ruined hard drive on my W7 machine and I downloaded the Media creation tool. Is there a way to make a W10 rescue disk from my W7 computer? I tried making a rescue USB stick but it doesn't seem to work and it only takes me on a long trip around and around the Acer software but never gets to the USB with the creation tool.
Len