Getting rid of Bit Locker pop up

JohnB47

We have an Asus laptop - bought a few months ago. Only ever used for general web browsing and emails.

At first all was well, except for the annoying prompts to take up Office 365 and McAfee.

About a month ago I used Revo Uninstaller to remove 365 and McAfee.

Since then (or so it seems, maybe just coincidence) we've been getting a pop up asking for a Bit Locker code. We've never set up Bit Locker and don't really know what it is or want to use it.

We've learnt how to get around it: on the first Bit Locker window we click "click here for other options" , then on the next one "escape this drive". The laptop then becomes unresponsive, so we hold down the power button for 10 seconds and start it up again. The Bit Locker window doesn't reappear at this point. (Perhaps a power off/on would achieve the same result).

How do we completely disable Bit Locker, so that we don't get the annoying prompt?

[Deleted User]

I've been using bitlocker for years and what you describe does not sound like the official bitlocker. Never seen "escape this drive" ever. and if it asks for your bitlocker code it is before Windows starts.

I think it is malware / nagware of some sort, screenshot would be useful.

Are you on Windows 10 home or pro? Only Pro has bitlocker built in.

pbartlett

Only Pro has bitlocker built-in but if you insert or have a bitlocker protected drive the pop-up asking for the password will still appear even on Home editions.

To completely disable bitlocker as you asked, do win+r and type services.msc and find the bitlocked drive encryption service and disable it. This will stop bitlocker but really you need to get to the bottom of why it is happening.

JohnB47

Thanks guys.

This laptop is used solely by the missus and she has facial recognition set up. Presumably to stop me seeing all the presents she's ordering for me! So I'll have to rely on her to take a picture of the dialogue that pops up. She tells me that she leaves the laptop in standby (sleep?) simply by closing the lid and it's when she opens the lid that this bitlocker dialogue appears (perhaps about one in 15 times or so).

I've just had a look at my other older laptop (a Toshiba) to see what I can see following the advice given by pbartlett. I can see the bitlocker entry and it is showing as 'manual (trigger start)'. Presumably that means it's disabled and that's why I've never had any experience of bitlocker.

Presumably, if this really is bitlocker running on the Asus laptop, I need to do the same thing then select 'Action' and select 'stop'?

I'll get back with progress.

[Deleted User]

JohnB47 said:

Thanks guys.

This laptop is used solely by the missus and she has facial recognition set up. Presumably to stop me seeing all the presents she's ordering for me! So I'll have to rely on her to take a picture of the dialogue that pops up. She tells me that she leaves the laptop in standby (sleep?) simply by closing the lid and it's when she opens the lid that this bitlocker dialogue appears (perhaps about one in 15 times or so).

I've just had a look at my other older laptop (a Toshiba) to see what I can see following the advice given by pbartlett. I can see the bitlocker entry and it is showing as 'manual (trigger start)'. Presumably that means it's disabled and that's why I've never had any experience of bitlocker.

Presumably, if this really is bitlocker running on the Asus laptop, I need to do the same thing then select 'Action' and select 'stop'?

I'll get back with progress.

"Manual (Trigger Start)" doesn't mean it isn't running, I have Bitlocker on both my Laptop drives and it shows the same, you need to look at the status column to see if it is running - but I think it will be running even if no drives are encrypted.



But here's the thing, if the drive is genuinely encrypted with Bitlocker, stopping the service will prevent access to the encrypted drive so I wouldn't go messing with the services yet until you have an understanding of what this really is.

If this really is Bitlocker then everything your wife describes doesn't fit with real Bitlocker.

See what drives are installed on the Laptop and whether Bitlocker is enabled on them. Open Windows explorer (Win key-E) and click on "This PC" and have a look at the drives:



If any of the drives have Bitlocker encryption you will see a padlock symbol as per the screen shot above - could be like either the open padlock on the C: drive or the closed padlock D : drive on the screenshot from my PC.

Come back here with a list of which drives do / don't have the padlock symbol and we can take it from there.

If Bitlocker is enabled on the system drive (usually C: drive) then it will either ask for a key before Windows starts or not at all if it is stored in the TPM - never when resuming from standby because it wouldn't even be able to resume if the C: drive was locked.

If it does ask for a Bitlocker password or key then the box looks like this but this will only be for a secondary drive - never for your C: drive because Windows cannot even start until C: drive is unlocked. This screenshot is from my D : drive:



There was a "More Options" which I clicked and as per above it shows "Enter recovery key" but crucially not a "Click here for more options" so again I'm thinking this isn't genuine BitLocker.

Never once did it say "Escape this drive" - again I've never seen genuine Bitlocker ever use that phrase which is leaning me towards this being malware instead.

Now I also have facial recognition and sometimes it doesn't recognise me after standby and then it will give me more options to log in such as fingerprint and passcode - are you sure it is not that? 

pbartlett

Very thorough reply and help from @[Deleted User]. Right in that this does not feel like the 'real' bitlocker but a screenshot if you can get one (use you phone camera if it is easier) might throw some light on this.

For info, to disable the service you need to rt-click on the line, choose 'properties' and from the drop-down box choose 'disable' then reboot (or 'stop' the service).

Since you don't use bitlocker it shouldn't change things and if you then keep getting the popup then you know it is not the real bitlocker

Reverse the process and switch the drop-down box to manual when you want to.

JohnB47

Thanks again guys.

I'll have a look as per your advice tallmansix. Your post is very helpful.

 "..... sometimes it doesn't recognise me after standby and then it will give me more options to log in such as fingerprint and passcode - are you sure it is not that? 

Yes, I believe that does happen occasionally and no, I don't think there is confusion about that. It's definitely a separate thing.

pbartlett - thanks but I think I'll get some screenshots for you both to look at and look at the tallmansix suggestions before I make any changes.

This has me a bit worried now, but the laptop does seem to recover from it when the process I mentioned earlier is followed. 

If it is malware, what is the point of it I wonder?

JohnB47

Just one more thing. The dialog that tallmansix has posted looks nothing like what we're seeing. We see a large blue dialogue, almost filling the screen, with a long rectangular box near the top and text asking for the user or enter a key (or code or whatever). 

At this point I thought I'd search for examples of the bitlocker dialogs. I found a youtube video that show what we are seeing. Actually the ,message "escape this drive" option I mentioned is probably "skip this drive". Sorry, I'm getting this info from the wife, so there's a bit of 'lost in translation'.

Anyway, this video show almost exactly what my wife has been doing - although the bit at the end is different - after choosing "skip this drive" she doesn't get any further options, the laptop seems to just freeze and she has to turn off/on again.

Here is the video:

https://www.youtube.com/watch?v=exz3R6icsNk&ab_channel=HowToThinkPad

Does any of that help?

[Deleted User]

Perfect - yes it is very helpful and that probably blows away the malware theory then, it does now look genuine.

Yes it will always freeze if you don't put the recovery key in because it can't access the drive and Windows needs it to run. Now the issue is why is it randomly asking for the recovery key.

So what normally happens with Bitlocker is that the long key is not needed to access the drive because remembering a key like this is example below is not practical:

371648-214788-042645-314431-148460-204351-643071-393250

So instead Bitlocker will either ask for a short password or passcode or as probably is your case - automatically unlock using the above key stored in the hardware of the computer - typically the TPM chip.

All good and normally you never need the long recovery key or anything to use the laptop.

But sometimes when there as been a significant changes to hardware ./ firmware / software, the Windows bootloader detects this and requires the full key to be entered for security reasons.

As this seems to happen when coming out of standby is puzzling, the Bitlocker encryption key should still be stored in memory and not required.

I'll do some more digging, it all makes more sense now but as to why it is asking for it randomly is the problem, I've seen some issues mentioned on Microsoft forums about it requiring the Bitlocker key after hibernation, that is a possibility I'm looking into but never happened to me.

BTW I hope your wife has the full recovery key stored safely somewhere - it will probably be stored on her Microsoft online account but without it then one day the laptop hard drive could become totally inaccessible.

One option might be to switch off Bitlocker for the affected drive if you feel it is not needed but I do recommend using it if because if the laptop is stolen, it will protect all the contents of the drive.

I'll do some digging about why it is randomly asking for it.....

JohnB47

Thanks for all your help. 

I'll get the wife to let me check her Microsoft account and see if I can get and store that key. I'll also check your other suggestions out.

JohnB47

OK some more info.

This problem hasn't occurred again but I've just logged into my wife's Microsoft account and managed to find that Bitlocker is indeed turned on, on the C drive. We've no idea how that got set up.

I now have the recovery key copied and safely stored.

So, the next time she gets asked for it, presumably she can copy and paste that key and it will get rid of the problem?

One question - presumably at the point she is asked for the key, she wouldn't be able to open a document and copy the key for pasting in. So she would have to refer to a written copy of it? If so, does she enter the dashes between each group of 5 characters, or leave the dashes out?

But why is it asking her for it - and only occasionally?

Thanks for the help.