remove syskey password within windows?

[ComputerRepairTech]

I have a client that disconnected from a scammer but hasnt rebooted yet. I can see that they have put in a syskey password but how can I remove it remotely while inside windows?

 

[Markverhyden]

Just do a system restore to the last good point. Hopefully the scammers have not removed them.

 

[Larry Sabo]

deleted.

 

[ComputerRepairTech]

no restore points

 

[Markverhyden]

Maybe this might help.

http://www.windowsnetworking.com/kb...swhensyskeyisinstalledandhowtogetridofit.html

 

[FoolishTech]

Not that it will help you after the fact, but just a general FYI: I've just updated CryptoPrevent with an option to block syskey.exe from running to prevent this from happening.

 

[ComputerRepairTech]

Not that it will help you after the fact, but just a general FYI: I've just updated CryptoPrevent with an option to block syskey.exe from running to prevent this from happening.

any extra command lines needed for that? or is it included with the /silent /whitelist?

 

[FoolishTech]

any extra command lines needed for that? or is it included with the /silent /whitelist?

it will default to on when you apply protection manually, but from the command line you need to specify /blocksysfiles