Something (Windows 10 maybe) deletes system files and stops responding

Hi there !

I didn't know which subforum to post this thread in so I'm posting my issue here. It's a really weird one. I've got a pc running W10 Pro (I7 6700k, 32gb RAM, rtx 2080 ti and several ssds) that has been running flwlessly until recently. First a couple weeks ago when I turned it on in the morning it stopped respondind after 2 min. or so with blank icons in the taskbar and I can't find this item message whenever I clicked on something. Only managed to restart it bit it wouldn't boot to windows as there were obviously some boot files missing. I thought that it might be a bad drive but ghost image restore fixed the problem and ssd monitoring software didn't flag up any issues. Yet I replaced ssd with a system partition with a new one and restored the image to the latest one. For the next couple of weeks pc ran without any issues.

Yesterday, the same thing happened. So I restored the system from image. However, this time after restore the same thing happened - system unresponsive. Attempted a lot of troubleshooting until to my suprise it turned out that it only happens when after restoriong ghost image I connect the pc to the internet - no matter, wheter it is ethernet or wifi. I thought about my router being the culprit, maybe even infected with some virus maybe. But all other computers on my home network work fine and when I just connected the mulfunctioning pc to a hotspot on my mobile the same thing happened.

I also discovered the exact mechanism of the problem. It appears that whenever after image restore I connect to the internet someting or maybe windows iteself after about a minunte or so deletes exactly 20gb of files from system partition including contents of user folder, program files and windows folder itself etc and some boot files as well. It happens no matter whch image file I use - the latest is from the 31st of December but I also tried restoring earlier backups (I use norton ghost from HIREN's boot usb on all my computers). I always leaves exactly 12.2 gb of windows content I could see that by not closing file explorer when the deletion happened and it still resided in ram so I still could browse the contents of my pc untic I closed it. Other ssd disks and partition D on the same drive remain intact. When I turn off the internet connection immedietely after restore I can use the pc for hours on end, use apps, play steam games offline etc. so I don't think hardware is at fault.

I'm completely at a loss as what to do next . I have run out of ideas and couldn't find anything on google search even remotely resembling my problem. I'm new to this forum but I know tere are may knowledgeable people here. Please help me. I would be very grateful.

Thanks all good people for all swift replies!

As for the things you've mentioned I have already checked the ssd (Adata SU800) with HDTune, CrystalDiskInfo and BIOS buuilt utility and no errors were found. I'm running version 1909 OS build 18363.535. I can check it as I have restored again and immediately after logging in I switched off internet access. The computer has been running like that for 30 minutes or so as I was typing my messages from a different pc (connected to the same router). Shall I try the safe mode with networking? I'll try the clean boot as well. It also just came to my mind that it may have something to to with the date of the image. It's the new year now and the last image is from New Year's Eve but that semms rather stupid - I have used ghost image software for years and it seems oblivious to the version of the operating system. I still use it on other computers with different OSes.

I also wanted to mention that yesterday I tried installing W10 from scratch. I deleted the OS partition, system reserved, recovery partition and let windows installer create new ones as I thought that they too might have got infected or something. All went smooth, Windows got installed without ahitch, I installed all basic drivers and the internet connection was on all the time. I left it running like that for 2 hours and then restored one of the previous images. Unfortunately same problem occured once I switched on the internet my os partition shrank to 12.2 gb and became unresponsive... As for the antivirus I use avast free antivirus and built in windows defender. I have just downloaded some free offline portable antimalware and anti virus programmes and scanned the pc no threats were found. I can't use online based solutions for obvious reasons... I don't use any cleaners and I restored just C partition as I wrote before I now have the reserved partition created from scratch from usb windows 10 installer. I also have another D partition on the disk with additional 'Steam 2' folder with 4 games inside and nothing else on it, when the whole deletion thing happens this partition and other disk remain untouched by the "purge".

I know that I can start from stratch but for me that would be a distaster as I have hundreds of apps and games with my custom settings I have tweaked over past two years and that would be really time consuming and daunting experience. And by the way I haven't installed any new apps over the last two weeks, just updated the MSI Afterburner to the latest version and I also downloaded and installed a couple of games from Steam thats all.

- - - Updated - - -

And the whole troubleshooting is made difficult by the fact that when I'm disconnected nothing hapens - the pc is working as expected and once I connect everything happens so fast I can literally see the gigabytes dwindle down and then I cannot do anything; no installation of any troubleshooting software possible no reboot possibility. All I can do is boot up Hiren's usb and restore the image from my other drive...

What do you mean by 'starting from scratch'? In one paragraph you say you tried starting from scratch and the following paragraph that starting from scratch would be a disaster.
Have you used ---sfc /scannow---at least twice,followed by ---dism /online /cleanup-image /restorehealth---?
Check your Reliability History for any entries which might be relevant.
The indications given suggest the Norton Ghost image could be corrupt and perhaps a change to Macrium,paid or free,may be a better way to go.
A clean install of win 10 followed by a slow,selective install of data from the Ghost image,could be the only effective solution.

What I meant by the disaster 'of starting from scratch' is that it would entail many hours of installing everything that I need and of course I'm relieved to find out that fresh install wil work but at the same time I may spend several hours, maybe days even, to bring everything up to date with no guarantee that the problem won't happen again. And I don't think the corrupt image is to blame as I have tried seven different one s that used to work before so I ddon't suspect corruption on all of them. And unfortunately these are not incremental images but backups of the whole partition so I can't choose whch folders to restore.

Thanks for suggestions so far. I'll try the software you suggested for capturing network traffic. Hopefully I'll be able to save the log to another drive when the problem occurs and show it to you here. Right now the pc is stiill working flawlessly without the connection. I'm really dismayed at why the whole thing happens. After all I already used that images and they were working fine. Whenever I backup to an image I always restore from itimmediately aftertwards to see if there are no corruptions. So unless they somehow all get corrupted it is seems really weird. And I not only keep them on other drive but also copy to my NAS and that copies behave the same. How this can be even possible? The software just deletes the partition every time and overwites it with the image so there can't be any files left over on the partition. Can it be a virus residing in network adapter? or some malware file lying dormant in the system that gets activated once it connect to the internet? So why didn't it get triggered before? I haven't experienced anything like this in my whole life...