Source
r/computertechs•
ComputersByte

Needing tool for Syskey

Does anyone happen to have anything to brute force, or otherwise get through Syskey? I've run into yet another customer that gave some malicious call centre from India access to her machine and they turned on Syskey with at least a semi-decent password.

I'm trying to avoid wiping out the machine if possible, but I know that will work if need be. Just looking for something that will be able to break in without resorting to full data loss (which I have already informed her is likely at this time).

Thanks for any suggestions.

Posted Dec 12, 2016, 1:54 PM UTC

932
etemplin•

Roll back the registry using shadow copy. Also I don't think syskey encrypts the drive so the data should still be safe?

3
ComputersByteOP•

It does actually encrypt it, which is why it's a pain in the ass. It's effectively built in Ransomware.

1
webtroter•

That is hust the Windows Account Database, not all the drive. I too think that you could use VSS.

1
etemplin•

Assuming the fake TS didn't disable and clear it. Sometimes we see that, sometimes just a rollback works

1
allsystemscrash•

I've done this a few times and had it work. It hasn't been 100% effective for me, though.

1
Williamstrav•

Look into this: http://www.chntpw.com/download/ It is also available on the UBCD. I have successfully cleared it but the computer was still screwed and I had to re-install. Good luck! Any questions let me know and I can try to help. I did this a couple months ago.

2
ComputersByteOP•

Will give it a go and report back.

I do love how Microsoft has built in Malware that is all but forgotten, don't even need to infect a machine, just simple social engineering and you've got people by the balls.

2
Williamstrav•

I know. It's ridiculous. I forgot to mention but was implying that you have to make a bootable disk/USB.

2
ComputersByteOP•

Yeah that's not a concern, E2B flash drive for that stuff, just dump in the ISO and away you go.

2
Williamstrav•

I like Rufus: https://rufus.akeo.ie/

2
TheFottyRepair Shop•

Come on man, you can't call built in encryption malware just because people are stupid enough to fall for social engineering tricks. That is like saying the file delete command is malware because you can trick someone into deleting an important file.

1
jfoust2•

Tell me what this "encryption" feature is protecting. Tell me why it shouldn't be removed.

2
TheFottyRepair Shop•

It is protecting the SAM hive of the windows registry.

2
ComputersByteOP•

It's purpose is for corporate use. It being even in the home versions of the OS is absolutely ridiculous.

It has no purpose in a home users machine other than to be abused by someone more technically savvy than the user, which isn't exactly a difficult feat.

1
allsystemscrash•

I agree with you. It's definitely an odd feature that one may argue isn't very effective, but it wasn't added by MS engineers with the intent of being used maliciously.

1
TheFottyRepair Shop•

I fixed this by copying their backup registry hive over their current one for one of my customers who had fallen for this and it worked perfectly.

2
ddarkjedie•

Yep, that's what I was about to say. Sometimes the scammers delete those reg backups though :(

1
TheFottyRepair Shop•

Yeah, I think it depends on how long you let them have access. From what my client told me the single time I ever saw one of these guys actually put this password lock on, she told him she was just going to call her IT person and not give them any money, which is when they put on the password and rebooted the computer. I booted into recovery and swapped out the reg files manually from the backup subfolder folder of the registry files (they were about 2 days old thankfully) and crossed fingers and rebooted.

2
Eltigro•

This is the software I use in PCs that come in that have been accessed by 'tech support'

http://www.passcape.com/reset_syskey

Works everytime, even when there is no backup!

2
ComputersByteOP•

Thank you, will give it a go.

1
ddarkjedie•

So I take it there wasn't an older copy of the registry chillin in the OS? No restore points to use?

1
ComputersByteOP•

Not that I've been able to locate yet no.

Encrypted drives suck to work with.

1
Syde80•

Syskey only encrypts the accounts database... it does not touch the filesystem.

3
easyjet•

Check it isn't 1234,12345,123456 etc. They're not the brightest these scammers.

1
ComputersByteOP•

Tried all of the normal ones, I've run into this at least a dozen times in the last year. Just trying to find more of a resolution than manually guessing.

1
lostmatt•

PM me for the master key u/ComputersByte

1