Can't Remove Lock Screen as Administrator

Dormouse · 20 Feb 2013

I hope someone will be able to help with the issue I am having with my laptop. After I start it up, and the Welcome screen is displayed, the computer locks up and the screen goes red telling me to contact the computer administrator.
I've been looking at several website that says it may be a BIOS problem? I entered in my BIOS administrator password and there are options like locking the hard drive, but changing the settings had no effect. I don't know if this is a virus problem or what caused this to start happening. Any help or advice would be wonderful. Thanks!

Neutron16 · 21 Feb 2013

Looks like a virus. WinBlocker kinda type. Usually they ask for money, bank accounts, or to send an expensive text message.

There is a free service from Kaspersky Unlock Windows
that provides instructions based on the info about winblocker.

If that won't work you might have to go as far as creating Kaspersky Rescue Disk 10

Dormouse · 22 Feb 2013

Still no luck. I tried the rescue disk, did a full scan of all drives, and no infection was found. Rebooted the computer and it still locked me out. Do you think a reinstalling the OS would work?

mitchell65 · 22 Feb 2013

Have you tried booting up in Safe Mode? Also please complete your System Specs so we know what we are dealing with here. Follow this guide:
System Info - See Your System Specs

Dormouse · 22 Feb 2013

Okay, thanks. I updated my specs. Here are some observations I made. Booting in safe mode results in the same problem. When I start up normally, I have a few seconds where I have access before Internet Explorer (I think) opens and I lose all control of the computer and that screen comes up. I then have to force shut it down to turn it off.
A couple of times during startup I saw IE open on the taskbar, right clicked it, and clicked Close Tab, and that stopped it from happening, but the Control and Alt keys wouldn't work, and it was only temporary. I've been trying to repeat that with no luck.

AddRAM · 22 Feb 2013

Try Defender offline.

What is Windows Defender Offline?

Microsoft

http://www.online-tech-tips.com/comp...n-infected-pc/

Dormouse · 22 Feb 2013

I'm afraid that didn't work either.

Neutron16 · 23 Feb 2013

Malware that is not in antivirus databases yet..
Because that thing autostarts, you will likely to turn it off manually through Kaspersky Rescue disc.

On Kaspersky Rescue disc there is a utility call Kaspersky registry editor.
You want to start that, then select your Windows version in there and check the following keys for any suspicious entries (the most important are in bold).
HKLM stands for HKEY_LOCAL_MACHINE

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Wow6432Node\\Microsoft\Windows\CurrentVersion\RunOnce

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Also,
HKEY_USERS\your_login_here\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_USERS\your_login_here\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can cross check entries with this database.
But myself, I would disable everything, just to make sure.

By disabling, I mean renaming entries. For example,
"C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE" into
"C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE123"

Dormouse · 23 Feb 2013

I disabled everything in the locations you listed. In the folder
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
I renamed the explorer.exe and userinit.exe files, and got a black screen after the welcome screen. I reverted the names back and got to the desktop and then the lock screen came up as before.
While using the rescue disk, I renamed the Internet Explorer folder in Program Files, and the lock screen does not come up anymore. But I still can't access the Task Manager and the keyboard and touchpad settings are strange. I don't know if that makes sense to anyone. Thanks so much for your help so far!

Neutron16 · 23 Feb 2013

For task manager please refer to this thread.
And I would totally scan a computer with good antivirus product. You still need to find and disinfect that malware.

There is a trial version of Kaspersky Internet Security for Windows. It has an option "Windows Troubleshooting".

Using this tool you can detect and eliminate the traces of actions by malware objects in the system after your computer disinfection or if you suspect your computer is infected.