OS is mostly disabled and inoperable

hempatches · 13 Nov 2018

Very strange morning. Husband restarted his PC after Facebook page would not load giving the "no internet" page. Internet/wifi was working fine on my other PC on the network. Before I restarted again, I ran the CCleaner both "cleaner" and "registry" and it worked. Then it went downhill fast with all the signs of a big Trojan or virus. Checked the properties of the hard drive and it appeared that it was almost empty, as if it had been somehow wiped. This is an an older PC and was at least half to two thirds full. Now it shows about 12% full, so a lot of stuff has been wiped off. Lost keyboard commands and most mouse control so had to hard restart again. Upon restart the CPU was swamped for twenty minutes and nothing would open. Finally got the Task Manager open to see most of the normal processes were not loaded, services were mostly off. Instead of the long list of processes and services, it looked quite abbreviated (reminded me of Windows 95--short list). Start key would not access OS controls or menus. Right click inoperable. Went in through Explorer on the taskbar, which opened but no functionality on any OS settings or controls. Nothing opens. Hard shutdown to restart using the switch on back of tower, the only way to shut off without keyboard or mouse commands.

It appears that the computer thinks it's running Windows 7 again, yet the startup screen shows the windows 10 graphics. It appears to be loading sound, network, desktop normally, printers in device list, but nothing will open. It also dumped Avast, and Defender seems to be active, but will not open or allow right click to disable in Task Manager. The weirdest thing is looking at the network it says "Public" and the Private Network is disabled. We are on a wireless Ptera connection, private password protected network, so no public network should show or be selected. I've tried all of my usual fixes and can't run a virus scan.

Thinking someone had hacked the network I've shut this PC off. Any help would be appreciated.

Caledon Ken · 13 Nov 2018

Hi hempatches. Welcome to the TenForums @hempatches

The Public or private is just a state on your local lan. If you are wireless when you first connected we've seen it default to Public. All that means is the firewall is in a more aggressive posture. Any device on your Lan can be Private (sharing) or Public (no sharing)

First off I would boot with Kyhi's recovery disk. From here you could run Malwarebytes available from Malwarebytes.com

Windows 10 Recovery Tools - Bootable Rescue Disk

use this download for Kyhi's disk from that page

OS is mostly disabled and inoperable-image.png

Free Malwarebytes

https://www.malwarebytes.com/mwb-download/

I hope your data is visible with Kyhi's disk and can be offloaded. I would keep it isolated from your other systems so it can be scanned when you get this device back.

I think I would also run chkdsk against your HDD, after you get data off. You may need to run chkdsk first to repair the disk so that you can get data off. Basically if you can see it do it first. If you can't see data run chkdsk.

Depending if you have a visitor or a bad disk will determine next steps.