Tech scam hit neighbor

lenberman · 11 Mar 2018

My elderly neighbor fell victim to the Microsoft tech scam. She let him on to her computer remotely and now when you try to open Windows it asks for a password. Not a syskey password, but a password that wasn't there before. I thought, OK, I'll get her files off the HD and reload windows, no problem. However, the lock seems to be on the BIOS. The computer is a Dell AIO Inspiron 20. I tried to remove the cmos battery for 20 minutes thinking it would take off the lock, but it's still there. The problem is that when I try to fix it with the media creation tool, I can't because somehow I changed secure boot before the bios locked and I can't return to legacy boot. (those may be backwards)
Len

Caledon Ken · 11 Mar 2018

Hi Len.

Any chance this is a desktop. If so ....

https://www.dell.com/support/article...ssword?lang=en

If notebook web says to call Dell.

Can you enter BIOS but can't make changes or you can't enter BIOS?

lenberman · 11 Mar 2018

It's an "All-in-one" Thanks for the info.
Len

PolarNettles · 11 Mar 2018

I would expect that if you unplugged the computer and removed the coin battery for 20 minutes then it would have worked. But maybe the motherboard has some huge capacitance on that voltage rail...

From Inspiron 20 Owner's Manual
it looks like the RTCRST jumper is between the SODIMM sockets and the coin battery.

How to Perform a BIOS or CMOS Reset and/or Clear the NVRAM on your Dell System | Dell US

Bastet · 11 Mar 2018

Have you removed the CMOS battery, disconnected all USB devices, unplugged the mains cable/lead & pressed the on/off button for 10 seconds to discharge any remaining power then left it for 20 minutes?
If it has any other battery if you can remove that as well before discharging any residual power too.
Once done reconnect everything again & boot up.

lenberman · 11 Mar 2018

I couldn't find any jumpers at all on the board. I removed the cmos battery and held the power button. I will leave the battery out overnight. I hope this will wipe out the password.
Len

spunk · 11 Mar 2018

Remove the HDD from the computer and attach it to a working computer via USB-SATA Adapter, Dock or Enclosure. If the HDD isn't encrypted, you should be able to access the drive and recover it's files.
After backing up, go to Disk Management and Delete All Partitions so the drive is Unallocated Space. Put the drive back in the troubled computer. If you still can't boot from the Windows installer, restart and press F2 to enter Setup (Bios) If the Bios isn't Password Protected, go to the Security tab, if you see Secure Boot or Fast Boot, disable it or change it to Setup Mode. Go to the Boot tab. If you see UEFI Bios, add or change it to Legacy Bios. Save and Exit. On restart, boot back into the Bios with the Windows Installer in. At the Boot tab, the Windows Installer should show as a Legacy boot device Move this to first boot device, Save and Exit. On reboot, you should boot from the Installer.
At the Windows installer, choose your Language, then Custom Install. and go Next, Windows will automatically create partitions, and format them during the install.

PolarNettles · 11 Mar 2018

lenberman said:

I couldn't find any jumpers at all on the board. I removed the cmos battery and held the power button. I will leave the battery out overnight. I hope this will wipe out the password.
Len

Out of curiosity, does the motherboard at all match the photo in the manual I linked earlier?

lenberman · 12 Mar 2018

It didn't match but I could find the battery. There was no visible data on the hard drive, just a single text file called Recovery. so I formatted it. Hopefully tomorrow I will be starting with an operable computer. I had previously removed the data by running a Linux live DVD and copying the files.

Steve C · 12 Mar 2018

I guess you could try reflashing the BIOS if removing the battery doesn't reset the BIOS. This will only work if your existing BIOS will let you boot to a USB drive containing the BIOS update.