Daughter's Laptop Username & Password Were Somehow Hacked/Changed

Our daughter recently allowed her boyfriend to link his Apple cell phone to her Windows 10 HP laptop in order for him to send some photos to somebody else.

Well, after that linking was done, whenever the laptop gets powered on, it now displays that somebody else's email address as the username and requests a password be entered, which we do not have.

How do we restore her laptop to showing our daughter's username and accepting her password, so that we can log into Windows 10 again?

HI,  it is suggested that you start a Topic in the Malware Removal Forum to make sure there is nothing on the system.

You need to do this 1st : https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ before starting the Topic.

Edited by Pkshadow, 07 April 2024 - 05:38 PM.

cryptodan,

When my daughter's laptop is turned on, it displays the standard Windows 10 login screen.

It previously displayed a small picture of me, then my daughter's name would be displayed below that, and then a password/PIN box to enter a PIN code.

At startup, It now shows a blank or generic image instead of a small picture of me, then below that it shows a Gmail address belonging to an ex associate of her boyfriend, and then below that is the password/PIN box, plus a "I forgot my PIN" hyperlink.

I have no clear idea of what her boyfriend did that caused the username to get changed, but because of this situation, we are currently unable to log into Windows 10, so the laptop is essentially useless to us.

We tried to change the password by clicking on the "I forgot my PIN" link, but it merely offers to send a code to the email address of the boyfriend's ex associate. However, her boyfriend is unfortunately no longer on speaking terms with his ex associate, so that is no help to us.

cryptodan,

Sorry for my ignorance, but I do not know how to show you a picture of the login screen from my daughter's laptop.

I could take a picture of it with my cell phone, but would then need advice from you on how to upload/post that picture here on bleeping computer.

Thanks.

Pkshadow,

I tried pressing the windows key and the R key, but that did not do anything.

cryptodan,
 
Sorry for my ignorance, but I do not know how to show you a picture of the login screen from my daughter's laptop.
 
I could take a picture of it with my cell phone, but would then need advice from you on how to upload/post that picture here on bleeping computer.
 
Thanks.

cryptodan,

Using my cell phone, I took a picture of the login screen of my daughter's laptop, and uploaded it to the website you mentioned.

The link to that photo is   https://ibb.co/TH251YS

For some additional background on this situation, it seems that my daughter's boyfriend could not afford his monthly cell phone bill, so he let it lapse and was using the phone in wifi mode only. Then he connected his cell phone to my daughter's laptop using a USB cable to transfer a photo from the cell phone to the laptop, then emailed the photo from the laptop to his former associate's Gmail address. This is his explanation of how the login username may have got changed from my daughter's name and password to the email address of his former friend, with an unknown (to us at least) password or PIN. My daughter is very upset right now and is temporarily not speaking with her boyfriend, so this is the best explanation I've been able to squeeze out of both of them.

No, there is not a switch user icon in the lower left corner.  The screen is blank there.

In the lower right corner of the screen, there are three icons: Internet, Ease of Access, and Power.

Press the shift key and at the same time click on the power icon in the lower right and select Restart. This will bring up the Options screen. Click Troubleshoot. Click Advanced Options. On that screen click Command Prompt. Does it ask for a password? If it does not then at the command prompt type
 

net user administrator /active:yes

It will say if the command completed successfully.

Next type

net user administrator *

which will give a prompt for a password. Press enter to give it a blank password.

Reboot. You should then be able to access the Administrator account. This will at least get you access to the computer where you check the other accounts,i any, on the computer.

If clicking command prompt asks for a password then there is a way to enable the hidden administrator account but it requires one to create a bootable disk or USB flash drive. On the window that shows command prompt there is also the option to do a system restore but Windows 10 does not create restore points by default anymore.

Yes, the situation with this laptop  is very strange.

I know this HP laptop is my daughter's, as it is covered with a bunch of stickers that she pasted on the outside, and it looks exactly like the used laptop I bought and upgraded for her a couple of years ago, installed MS Office 2019 on, etc.

Until two weeks ago when she last used it, the laptop had only one username at the login screen (it was my daughter's name), and a four-digit PIN code.

Well, last night I asked to borrow it so I could make sure the latest MS Windows updates were installed, and that's when my daughter and I were surprised to see the login username had been changed.

That's when we started getting strange explanations from her boyfriend about borrowing it and connecting a cell phone to it that had supposedly been previously hacked by an ex-friend, etc., etc.

In the past week, we also discovered unauthorized charges on my wife's credit card, plus unauthorized charges on the debit card for a Social Security disability checking account I manage for our daughter. Too many weird things all at once!

We were also told by her boyfriend that the new username at the login screen is the same email address as an ex-associate of the boyfriend that he is now on the outs with and had supposedly hacked his cell phone.

This is all too weird. All I want is to find a way to regain access to my daughter's laptop.

Is there some way I would be able to reset it somehow so that it restores her original username and password?

If we took the laptop into a local computer store, would they possibly be able to get around this strange username/password and be able to gain access to log into Windows 10?