puterherbParticipantJanuary 25, 2019 at 1:29 am #613302
My laptop was hacked yesterday and the current password was not recognized by the computer. The hacker asked me pay him 0.2 bitcoin to unlock the device. Should I pay him? Any way to delete the user account created by hacker?January 25, 2019 at 6:10 am #613309
Do you have a backup? If so reformat, reinstall the OS/applications and restore your data.
If not, check out the Forgotten Password section of the site.
JeremyWModeratorJanuary 25, 2019 at 9:27 am #613312
What is the message you get? Is it a screen you normally don’t see or is it the regular Windows Logon screen and your password isn’t working?
I agree with Blood, if you have a backup, reformat and reinstall. If you get the normal Windows logon screen then you can use the Offline NT Password and Registry Editor and see if that works for you. https://pogostick.net/~pnh/ntpasswd/
If it’s not the normal logon screen then you’ll need to determining what malware was used to “encrypt” your computer so you can see if it is reversible or not.
puterherbParticipantFebruary 4, 2019 at 10:42 pm #613833
the login screen shows up an user name I never set so I can’t login.
P.S i don’t have a timely backupFebruary 5, 2019 at 3:52 am #613835
Remove the hard drive and connect it as a slave to another computer (so that the other computer does not boot from it). Take ownership of the disk, or, if you know where your data is take ownership of the relevant folders. This will give you access to your data. Run a virus check on the drive and then copy your data. Pop your drive back into your own computer, reformat and reinstall the OS, restore your data.
CasseryParticipantFebruary 21, 2019 at 4:37 am #614399
Don’t paying hackers anything,some free tools can be found on Google ,which can helps you remove the user account created by hacker and the password from laptop.February 21, 2019 at 10:01 am #614411
@cassery: This is good advice, but it is not enough. Where a compromise has occurred, the best recourse is to reformat/reinstall/restore. If just the rogue account is removed, there is no guarantee that any malicious software has also been removed. And, if the malicious software is a zero-day threat it will not be picked up by traditional anti-virus solutions.
This is why creating a backup of your data and storing it on removable media that is not connected to your network is the single most important thing you can do.
CasseryParticipantFebruary 25, 2019 at 3:23 am #614502
I mean to reset the account,then you can make new Windows password.
as for deleting malicious software,there will be some recommendations on Google.
You must be logged in to reply to this topic.