Can't Remove Lock Screen as Administrator

[Dormouse]

I hope someone will be able to help with the issue I am having with my laptop. After I start it up, and the Welcome screen is displayed, the computer locks up and the screen goes red telling me to contact the computer administrator.
I've been looking at several website that says it may be a BIOS problem? I entered in my BIOS administrator password and there are options like locking the hard drive, but changing the settings had no effect. I don't know if this is a virus problem or what caused this to start happening. Any help or advice would be wonderful. Thanks!

 

[Neutron16]

Looks like a virus. WinBlocker kinda type. Usually they ask for money, bank accounts, or to send an expensive text message.

There is a free service from Kaspersky Unlock Windows
that provides instructions based on the info about winblocker.

If that won't work you might have to go as far as creating Kaspersky Rescue Disk 10

 

[Dormouse]

Still no luck. I tried the rescue disk, did a full scan of all drives, and no infection was found. Rebooted the computer and it still locked me out. Do you think a reinstalling the OS would work?

 

[mitchell65]

Have you tried booting up in Safe Mode? Also please complete your System Specs so we know what we are dealing with here. Follow this guide:
http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

 

[Dormouse]

Okay, thanks. I updated my specs. Here are some observations I made. Booting in safe mode results in the same problem. When I start up normally, I have a few seconds where I have access before Internet Explorer (I think) opens and I lose all control of the computer and that screen comes up. I then have to force shut it down to turn it off.
A couple of times during startup I saw IE open on the taskbar, right clicked it, and clicked Close Tab, and that stopped it from happening, but the Control and Alt keys wouldn't work, and it was only temporary. I've been trying to repeat that with no luck.

 

[AddRAM]

Try Defender offline.

What is Windows Defender Offline?

Microsoft

http://www.online-tech-tips.com/com...-defender-offline-tool-to-fix-an-infected-pc/

 

[Dormouse]

I'm afraid that didn't work either.

 

[Neutron16]

Malware that is not in antivirus databases yet..
Because that thing autostarts, you will likely to turn it off manually through Kaspersky Rescue disc.

On Kaspersky Rescue disc there is a utility call Kaspersky registry editor.
You want to start that, then select your Windows version in there and check the following keys for any suspicious entries (the most important are in bold).
HKLM stands for HKEY_LOCAL_MACHINE

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Wow6432Node\\Microsoft\Windows\CurrentVersion\RunOnce

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Also,
HKEY_USERS\your_login_here\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_USERS\your_login_here\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can cross check entries with this database.
But myself, I would disable everything, just to make sure.

By disabling, I mean renaming entries. For example,
"C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE" into
"C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE123"

 

[Dormouse]

I disabled everything in the locations you listed. In the folder
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
I renamed the explorer.exe and userinit.exe files, and got a black screen after the welcome screen. I reverted the names back and got to the desktop and then the lock screen came up as before.
While using the rescue disk, I renamed the Internet Explorer folder in Program Files, and the lock screen does not come up anymore. But I still can't access the Task Manager and the keyboard and touchpad settings are strange. I don't know if that makes sense to anyone. Thanks so much for your help so far!

 

[Neutron16]

For task manager please refer to this thread.
And I would totally scan a computer with good antivirus product. You still need to find and disinfect that malware.

There is a trial version of Kaspersky Internet Security for Windows. It has an option "Windows Troubleshooting".

Using this tool you can detect and eliminate the traces of actions by malware objects in the system after your computer disinfection or if you suspect your computer is infected.

 

[Dormouse]

The computer is still compromised, but I am able to use it. Until I get it completely healed, I'm just going to use it as an offline computer, and try to fix it later when I have more time. Still can't get into Task Manager, but I can live with that.

But my keyboard and touchpad are messed up. The control, alt, and windows keys do not work. They don't register being pressed. I can pull up the on-screen keyboard and they work when I click on them, but just not through the keyboard. The touchpad resets its settings every time I sleep or hibernate. So the tap to click option returns and I end up clicking everything. I'm sure there are other posts dealing with this, but I have no idea how to search for them given the specific issues I've been having. Any help or links other threads would be appreciated.

 

[Layback Bear]

You are still infected. Until you get uninfected you will have all kinds of problems. Let these good folks here know when you can find time to get your computer clean.

 

[VistaKing]

hi Dormouse

On a working computer Download this software and add it to you flash drive

:ar: Farbar Recovery Scan Tool Download

:note: You do need a USB flash drive...

You may want to print these instructions so you can have access to follow them.
Also, you may want to read them once befor you apply them.


Please plug a USB flash drive into a clean computer.


Go to Start > Computer
Double-click Computer, and select the flash drive.
Right-click and select: Format
Press Start on the Format prompt.
Next, download Farbar Recovery Scan Tool:


Farbar Recovery Scan Tool Download
Select the 64-bit download.


Save the program to the >>> USB flash drive.
Remove the drive from the clean computer.


Next, plug the flash drive into the infected computer.

>>>Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
Use the arrow keys to select the Repair your computer menu item.
Select your language settings, and click: Next
Select your User account and click: OK (If you did not set a password, leave blank.)
On the System Recovery Options menu you get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Scan your computer's memory for errors.
Command Prompt
Select: Command Prompt
In the Command window, at the bliking cursor type notepad and press: Enter
In Notepad, under the File menu select: Open
Double-click Computer, find the flash drive letter, remember what letter it is, click on it, and press: Open
Close out of Notepad.
Click the Command window
Type x:\frst.exe, and press: Enter
Note: Replace the drive letter x with the drive letter of your flash drive!
The tool starts and prepares to run. Follow the prompts.
Click Yes to the disclaimer.
Press: Scan
When done, the program saves the FRST.txt report, on the flash drive.
Click the Command prompt window, and type exit, and press: Enter




Back at the System Recovery Options, press: Restart


When the computer boots back into Windows, please provide the FRST.txt in your reply.
It is located in the USB flash drive.

:info: Instructions from COTTONBALL

 

[Dormouse]

In the advanced boot options, there are a number of options, but Repair Your Computer, or anything sounding like that, isn't an option.

 

[VistaKing]

 

[Layback Bear]

I'm afraid that didn't work either.

What does this mean?
-------
Did you get WDO using a clean computer?
Were you able to run WDO on the infected computer?
Did WDO complete the scans?
What was the results of the scans if completed?
---------
This didn't work tells us absolutely nothing.

 

[Dormouse]

I'll reformat the USB disk and copy the scan tool again. All the scans I've run, Kaspersky, Windows Defender Offline, and Malware-Bytes have come up clean.

 

[Layback Bear]

Now that you can use your computer somewhat try this as per tutorial.
---

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
---
Did you ever get your password to work for bios?