PC bricked after using AVG Clear (Bitlocker Recovery screen)

MichaelS · Mar 1, 2023

Hi forum members,

Grateful for any help with the following issue.

I was trying to help a friend who had a problem with McAfee-themed malware popups on their Windows 11 Pro machine. I installed AVG and Malware Bytes to scan for malware / adware. When these found nothing, I ran the AVG Clear Tool from AVG to remove AVG completely. I restarted the machine and got a blue BitLocker Recovery screen asking for a recovery key, with this message:

Bitlocker needs your recovery key to unlock your drive because the Boot Configuration Data setting 0x25000020 has changed for the following boot application: WINDOWS\system32\winload.efi.

My friend does not have the Bitlocker recovery key. I checked and the key has not been backed up to their Microsoft account either. The person who originally installed Windows 11 Pro on the machine has no record of the recovery key either.

I am preparing to do a clean install of Windows 11 on the machine, with the loss of all personal files.

Before I do this, is there anything else I can try to recover the machine and data, or is a clean install my only option?

Of course, after the install, I will backup the Bitlocker key and ensure my friend backs up data (which is something I should have done before making any interventions).

Thank you,

Michael

neoopus · Mar 2, 2023

Normally if your Windows is linked to your email account (outlook) then you can check the Bitlocker code there and insert it.

Try3 · Mar 2, 2023

Do check this discussion before doing anything.
lots about device encryption in this thread - Bree #38 - TenForums

Best of luck,
Denis

Dru2 · Mar 2, 2023

neoopus said:
Normally if your Windows is linked to your email account (outlook) then you can check the Bitlocker code there and insert it.

Note the post Try links is about a laptop (Dell) which works different from a Desktop machine, especially if custom built.

Just something to be aware of as one is not the same as the other

Haydon · Mar 2, 2023

MichaelS said:
Hi forum members,

Grateful for any help with the following issue.

I was trying to help a friend who had a problem with McAfee-themed malware popups on their Windows 11 Pro machine. I installed AVG and Malware Bytes to scan for malware / adware. When these found nothing, I ran the AVG Clear Tool from AVG to remove AVG completely. I restarted the machine and got a blue BitLocker Recovery screen asking for a recovery key, with this message:

Bitlocker needs your recovery key to unlock your drive because the Boot Configuration Data setting 0x25000020 has changed for the following boot application: WINDOWS\system32\winload.efi.

My friend does not have the Bitlocker recovery key. I checked and the key has not been backed up to their Microsoft account either. The person who originally installed Windows 11 Pro on the machine has no record of the recovery key either.

I am preparing to do a clean install of Windows 11 on the machine, with the loss of all personal files.

Before I do this, is there anything else I can try to recover the machine and data, or is a clean install my only option?

Of course, after the install, I will backup the Bitlocker key and ensure my friend backs up data (which is something I should have done before making any interventions).

Thank you,

Michael

BitLocker has actually 2 keys, the unlock key and the recovery key, exactly for cases like this (and for some other cases). Although the message specifically asked for the recovery key, the unlock key would unlock the computer too > hence, look for the unlock key. If you don't have the unlock key either, then you are out of luck.

idgat · Mar 2, 2023

MichaelS said:
I am preparing to do a clean install of Windows 11 on the machine, with the loss of all personal files.

Before I do this, is there anything else I can try to recover the machine and data, or is a clean install my only option?

Do the clean install to a new blank SSD and keep the old drive intact. That way, there is no risk of (recoverable) data loss while messing around with attempts at unlocking, etc.

You can then try all recovery options on the offending drive, to your hearts content

And when Windows is (re)installed, remove/block/disable Bitlocker. It doesn't just turn itself on, I suspect the user has, in fact, done something, albeit unbeknownst/unintentional.

Porthos · Mar 2, 2023

MichaelS said:
I was trying to help a friend who had a problem with McAfee-themed malware popups on their Windows 11 Pro machine. I installed AVG and Malware Bytes to scan for malware / adware. When these found nothing

This will not correct your current issue but this was probably your issue and it will come back when the user signs into their browser.
It sounds like an issue with the push notifications feature in Chromium-based browsers (which includes MS Edge). Please see if the instructions in this Malwarebytes Labs article help or not.

hsehestedt · Mar 3, 2023

I'm going to approach from a totally different angle as a potential last resort...

Based upon the questions asked, I am assuming that there are no backups of the system disk, however, was Macrium Reflect ever installed on this system? If so, was a Macrium Reflect recovery disk created and does he still have possession of that disk?

The reason that I ask is simply because Reflect can save a copy of the recovery key to the boot disk, in fact, if I am not mistaken, that may be the default.

I know it's a long shot, but I felt obligated to present it as a possible option.

idgat · Mar 3, 2023

hsehestedt said:
I'm going to approach from a totally different angle as a potential last resort...

I think you should back off now, before any more damage is done. You seem to clutching at straws/pie-in-the-sky solutions.

Time to seek professional assistance. But investigate and choose selectively/judiciously, there are some cowboys out there

Haydon · Mar 3, 2023

Professional support to decrypt a key 50+ characters long?

Dru2 · Mar 3, 2023

idgat said:
I think you should back off now, before any more damage is done. You seem to clutching at straws/pie-in-the-sky solutions.

Time to seek professional assistance. But investigate and choose selectively/judiciously, there are some cowboys out there

If you've lost your BitLocker key, you are done. Not even Microsoft can help here. Been there, done that!!!

As for seeking "professional assistance".... They'd have a better chance of hitting the lottery 3 times in a row than hacking BitLocker.

hsehestedt · Mar 3, 2023

idgat said:
I think you should back off now, before any more damage is done. You seem to clutching at straws/pie-in-the-sky solutions.

Time to seek professional assistance. But investigate and choose selectively/judiciously, there are some cowboys out there

Why would I back off??? As has been stated, if you don't have the BitLocker, you are done. This is one potential source of that recovery key. You are going to tell me to back off from presenting a possible source of that key?

I noted that this was a long shot, but it is definitely worth mentioning.

pparks1 · Mar 3, 2023

idgat said:
I think you should back off now, before any more damage is done. You seem to clutching at straws/pie-in-the-sky solutions.

Time to seek professional assistance. But investigate and choose selectively/judiciously, there are some cowboys out there

This isn't like drive data recovery when the hard drive is failing and further attempts to gain access lessen your chances of success.

you cannot just run this down to Best Buy and have them bypass bitlocker and have access. If they could, bitlocker is useless.

idgat · Mar 3, 2023

pparks1 said:
This isn't like drive data recovery when the hard drive is failing and further attempts to gain access lessen your chances of success.

you cannot just run this down to Best Buy and have them bypass bitlocker and have access.

And that's exactly what I'm NOT advocating, hence my distinct advice to choose the consultant selectively/judiciously.

pparks1 said:
If they could, bitlocker is useless.

Which it is in the hands of the unsuspecting/unknowing/inexperienced. Well, maybe not quite useless, but downright dangerous.

Many-a-times I've come across users held to ransom by Bitlocker. When questioned why ..
- Windows said to turn it on/activate it
- Everyone else does it
- I want to protect my data ... What data? ... my family photos, so they won't be delated.
... and so on.

idgat · Mar 3, 2023

hsehestedt said:
Why would I back off??? As has been stated, if you don't have the BitLocker, you are done. This is one potential source of that recovery key. You are going to tell me to back off from presenting a possible source of that key?

I noted that this was a long shot, but it is definitely worth mentioning.

Just my advice. If that's your wont, then knock yourself out experimenting.

Just remember, it's someone else's device and data you're tinkering with, not your own.

Good luck.

Hazel123 · Mar 3, 2023

Would he be able to access the files using linux live? To back them up and then do a clean install?

hsehestedt · Mar 3, 2023

idgat said:
Just my advice. If that's your wont, then knock yourself out experimenting.

Just remember, it's someone else's device and data you're tinkering with, not your own.

Good luck.

Tinkering with someone else's device?

Let's look at the facts:

There is one way, and only one way, to recover from this situation: You need to get the BitLocker key. Since Macrium Reflect can copy this key to their rescue media that is one potential source for that key. How is that tinkering with someone else's machine? Besides, what have they got to lose at this point? The data is gone without that key.

I'm quite familiar with BitLocker, so I know what I am talking about here.

hsehestedt · Mar 3, 2023

Hazel123 said:
Would he be able to access the files using linux live? To back them up and then do a clean install?

No. Linux cannot simply bypass BitLocker. If it could, what would be the point of using BitLocker?

Hazel123 · Mar 3, 2023

Edit - deleted that linux link as you still need the bitlocker password to use linux dislocker.

Hazel123 · Mar 3, 2023

Read something that said check his microsoft account on another computer as the bitlocker key may be saved there.

Recovery key is saved in microsoft account