[TIP] Lock My PC Used By Tech Support Scammers, Dev Offers Free Recovery

[Porthos]

Tech Support scammers are using a free utility called Lock My PC to lock users out of their PCs unless they pay the requested "support" fees.

For years telephone scammers pretending to be from Microsoft, Google, and other companies have been convincing people to let them access their computer to fix a "detected" issue. Once the scammers gain access to the computer, though, they would use the Windows Syskey program to lock the user out of Windows with a password unless they paid for the "support" call.

Computer Locked with Syskey
With the release of Windows 10 1709, otherwise known as the Fall Creators Update, Microsoft removed all support for Syskey from the operating system.

With Syskey no longer being available, tech support scammers have switched to another product called Lock My PC to lock victims out of Windows.

When installed Lock My PC will require a user to enter a password before they can gain access to Windows. When used to lock a PC, users will see an animated 'Locked' screen when they start their computer.

Lock My PC screen
If they press any button on the keyboard, a password prompt dialog would be shown stating "The computer has been locked".

Unlike Syskey, which encrypts the Windows SAM database and uses the inputted password to decrypt it, Lock My PC does not encrypt anything and only blocks access to the computer with the password.

Unfortunately, in our tests, the software also runs in Safe Mode, which makes it difficult to disable without the password or bootable recovery tools.

These tools, though, can be difficult to use for those who are affected by this scam.

Lock My PC dev offers free recovery keys
When FSPro Labs, the developers of Lock My PC, discovered that their free software was being abused, they no longer made the software publicly available for download.

"After receiving too many reports of Lock My PC misuse, we decided to make our user access control software unavailable for the public. However, the programs are still available for our existing customers on requests. New customers may request Lock My PC business edition only using their corporate email address," FSPro Labs stated on the product's download page.

For users who fell victim to one of these scams and have had Lock My PC installed on their computer, FSPro is offering free recovery passwords that will allow users to unlock their PC.

To get access to a recovery password, at the Lock My PC password prompt enter '999901111' and a numeric recover code will appear under the password field.

Getting a recovery code
Victims can input this code on the Lock My PC recovery page to receive a recovery password that can be entered into the password field to unlock the PC.

Users can then uninstall the Lock My PC program from their computer.

 

[Mick]

Does it say how users are supposed to access the 'Lock My PC recovery page' if they can't start their computer?

 

[Larry Sabo]

On their smart phone, no doubt. Kids are born with them these days.

 

[Markverhyden]

Wonder if they made the backdoor known in their T&C's.

 

[britechguy]

On their smart phone, no doubt. Kids are born with them these days.

Or another computer. How many people don't know someone, most likely their next door neighbors, who don't have a computer and who wouldn't allow a "hop on" in a circumstance like that?

I'm endlessly amazed how often, on the end-user support groups, I get the question, "How am I supposed to get back on my computer when . . .?," comes up. My response is, you aren't, until you've gone to another computer and followed the instructions given to get the tools needed to get back on your own. This just seems so obvious to me. No different than, "My car won't start," where someone helps to diagnose the problem, suggests what parts to get, etc. You virtually never see someone say, "But how am I supposed to get to the store to get those parts?"

 

[Larry Sabo]

Many of my customers also have tablets, as a back-up device and for vacations. Comes in handy.

 

[Brett A]

I wish i had known this last week, I had an older customer come in last week with a Windows 7 computer which encountered the lock screen and phone call.

 

[Porthos]

I actually posted this for US to be able to fix when someone calls and brings us the computer.

a Windows 7 computer

That was probably done the old way with Syskey. The new versions of Win 10 do not have syskey so they are using this free program to accomplish the same.

I still believe a nuke is the only way to be truly sure the scammers did nothing else while they were connected. With asking the victim to change all their passwords.

 

[Brett A]

Syskey

Got you, was skimming and missed that part. Will be sure to pay more attention. Thanks!