Windows 10 hacked - nothing works - Hands COMPLETELY tied - Please help.

[Raraku]

Dear Tomshardware friends,

My little brother-in-laws windows 10 appears to have been hacked, and over the last 48 hours I've tried countless methods to try and resolve the issue. PLEASE help me so he can regain access to his computer and enjoy what's left of his summer.

Basic computer description:

Windows 10 64 bit
intel core i5
AMD HD 5870
ASUS Mobo
The computer is about 5-6 years old now, and honestly, he does not take very good care of it

A description of the problem:

It began the other day when he was trying to play Overwatch. The computer crashed, the screen went dark, and when we tried to restart it the computer attempted diagnosis and automatic repairs but failed. At first, the screen was also shutting off after about 5 minutes of being on. I thought maybe it was an overheating issue so we cleaned the dust from the PC (there was a ton) and that problem was resolved - the screen at least stayed on and it seemed the overheating was fixed.

After trying a few other solutions with the repair/startup tool but without effect, I figured that the Windows files were corrupted as a result of overheating, so I attempted a reinstall using a USB with windows 10 install filed on it. Windows 10 reinstalled successfully (I thought the problem was finally fixed!), but when I went to try and install anything (Windows updates, graphics drivers, other drives, etc.) nothing would install. Sometimes the install file would not even start up. I even tried installing some virus scanners, online or otherwise, but again, I cannot install anything. Even essential windows updates fail. After some more digging I realized there are several (3, to be exact) other reserved drives, and 2 of them are hidden. I tried deleting these partitions (again through windows startup tool, and also through command prompt using the windows 'diskpart' utility, but again was unable to remove the partition.

I've tried to do a completely clean install of windows 10, but the windows.old file on the drive cannot even be successfully deleted. And yes, I've tried various methods, but after deletion it always returns to the drive, as if it was never deleted. When I try to do a format using the windows 10 installation on a USB, it tells me there is not enough space on the drive so I cannot do a clean install. Even if I somehow manage to start the windows 10 installation process, it fails partway through.



PLEASE friends, I know there are many computer geniuses out there, I really need some help with this issue as my hands seem tied and I'm ready to give up. Rest assured that if we get it up and running again I'll be giving my younger brother-in-law a thorough lesson in taking better care of his computer (which I GAVE to him 3 years ago).

Thank you for any help you can provide.

 

[USAFRet]

This is when you go nuclear, and wipe the entire drive, and install a fresh OS.

Boot from your newly created install media, delete any and all partitions...install on a blank slate.

I know that in your description you state that this sort of fails..but booting from a known good OS install, and wiping ALL existing partitions...the only way it could fail is a bad target hard drive.


Do all that, and then tell us exactly what you did and how it failed,
or....that it actually worked.

 

[JackNaylorPE]

Reinstall Windows and tell it to wipe the boot drive.


1. Prepare for Windows installation with USB tool
https://www.microsoft.com/en-us/download/windows-usb-dvd-download-tool

2. Connect boot drive data cable to lowest numbered SATA port .... but don't connect:
-Ethernet cable
-SATA Data Cable for any other drives

3. Install Windows to boot drive after formatting everything on boot partition

4. Turn off Windows ability to install Hardware drivers
https://www.tenforums.com/tutorials/48277-enable-disable-driver-updates-windows-update-windows-10-a.html

5. Install all hardware drivers from original media in boxes See Item 7 below

6. Connect ethernet cable and run Windows Update till it stops doing anything

7. Install latest drivers for ALL hardware from manufacturers web sites. The reason we didn't do this in step 5 is 3 fold:
-Sometimes MoBo CD comes with licensed utilities with product key embedded and these are not on web site versions
-Its advisable to establish a working out of box conditions
-Sometimes newer drivers require latest Windows Updates

If you have a 2nd drive ....

8. Shut down and connect HD data cable to 2nd lowest numbered SATA port.

9. Boot to BIOS and make sure that SSD is the 1st boot device, if not fix it

10. Boot to Windows

 

[Raraku]

This is when you go nuclear, and wipe the entire drive, and install a fresh OS.

Boot from your newly created install media, delete any and all partitions...install on a blank slate.

I know that in your description you state that this sort of fails..but booting from a known good OS install, and wiping ALL existing partitions...the only way it could fail is a bad target hard drive.


Do all that, and then tell us exactly what you did and how it failed,
or....that it actually worked.

OK, thank you for your initial response.

I tried what you said again. Booted from the USB drive with the installation media on it. Proceeded to delete each of the partitions visible there. When I selected the SSD drive for install it says "Windows could not create a partition on Disk 1. The error occurred while preparing the partition selected for installation. Error code 0x80070070"

So this being the case, and provided my installation media is good (newly created yesterday), is there a chance the SSD drive is bad?

 

[Raraku]

Reinstall Windows and tell it to wipe the boot drive.


1. Prepare for Windows installation with USB tool
https://www.microsoft.com/en-us/download/windows-usb-dvd-download-tool

2. Connect boot drive data cable to lowest numbered SATA port .... but don't connect:
-Ethernet cable
-SATA Data Cable for any other drives

3. Install Windows to boot drive after formatting everything on boot partition

4. Turn off Windows ability to install Hardware drivers
https://www.tenforums.com/tutorials/48277-enable-disable-driver-updates-windows-update-windows-10-a.html

5. Install all hardware drivers from original media in boxes See Item 7 below

6. Connect ethernet cable and run Windows Update till it stops doing anything

7. Install latest drivers for ALL hardware from manufacturers web sites. The reason we didn't do this in step 5 is 3 fold:
-Sometimes MoBo CD comes with licensed utilities with product key embedded and these are not on web site versions
-Its advisable to establish a working out of box conditions
-Sometimes newer drivers require latest Windows Updates

If you have a 2nd drive ....

8. Shut down and connect HD data cable to 2nd lowest numbered SATA port.

9. Boot to BIOS and make sure that SSD is the 1st boot device, if not fix it

10. Boot to Windows

Thank you Jack for the detailed response, but I must admit some of the steps were a little unclear to me, or are difficult to do.

#2. Can i somehow connect the Boot data USB directly to my SSD for install? Can you please clarfiy here?

#5. The computer is about 5-6 years old now, and unfortunately my in-laws were careless with the original CDs... they are no longer available.

 

[USAFRet]

OK, thank you for your initial response.

I tried what you said again. Booted from the USB drive with the installation media on it. Proceeded to delete each of the partitions visible there. When I selected the SSD drive for install it says "Windows could not create a partition on Disk 1. The error occurred while preparing the partition selected for installation. Error code 0x80070070"

So this being the case, and provided my installation media is good (newly created yesterday), is there a chance the SSD drive is bad?

Are you dong this install with only the SSD connected?

 

[Raraku]

Alright, so I digged around on tomshardware and found another poster who seemed to be having similar issues (albeit long ago, 2013).

I followed these instructions:

"Run the installation media. select repair windows>Advanced Startup >command prompt(admin). in the command prompt:
type diskpart and press enter
type list disk and press enter. all the disks are displayed as disk 0, disk 1 etc.
type select disk 0 and press enter
type list volume and press enter. make a note of all the volumes present on the disk
type select volume 0 and press enter
type delete volume and press enter. repeat this step for all volumes on the disk. this will free up all the space on the disk. now install windows 8 (fresh install) and celebrate"

However when I got to the part where I tried to delete the 2 hidden volumes, it did not succesfully delete any volumes and returned me back to the beginning of command prompt, seemingly booting me out of the diskpart utility. Could this hack be so deeply ingrained in the system that I cannot delete the drive from command prompt using the startup tool?

 

[Raraku]

OK, thank you for your initial response.

I tried what you said again. Booted from the USB drive with the installation media on it. Proceeded to delete each of the partitions visible there. When I selected the SSD drive for install it says "Windows could not create a partition on Disk 1. The error occurred while preparing the partition selected for installation. Error code 0x80070070"

So this being the case, and provided my installation media is good (newly created yesterday), is there a chance the SSD drive is bad?

Are you dong this install with only the SSD connected?

No I didn't, should I disconnect the HD and try using JUST the SSD?

 

[USAFRet]

No I didn't, should I disconnect the HD and try using JUST the SSD?

Absolutely, yes.

 

[Raraku]

No I didn't, should I disconnect the HD and try using JUST the SSD?

Absolutely, yes.

OK, so after disconnecting all the other drives and hooking up just the SSDs, it turns out that apparently it is the SSD that appears to be infected (the two hidden drives are with the SSD) - so in this case should I just try to use the normal HD as a boot drive and forget about the SSD?

 

[USAFRet]

No I didn't, should I disconnect the HD and try using JUST the SSD?

Absolutely, yes.

OK, so after disconnecting all the other drives and hooking up just the SSDs, it turns out that apparently it is the SSD that appears to be infected (the two hidden drives are with the SSD) - so in this case should I just try to use the normal HD as a boot drive and forget about the SSD?

If, during this clean install on the SSD, you actually delete ALL existing partitions...it cannot still be 'infected'.

During the install, when it asks "where", select Custom.
You'll be presented with a list of all partitions on that drive.
Delete ALL of them, one by one.
An infection cannot survive that.

 

[JackNaylorPE]

No I didn't, should I disconnect the HD and try using JUST the SSD?

yes, always

 

[Raraku]

No I didn't, should I disconnect the HD and try using JUST the SSD?

Absolutely, yes.

OK, so after disconnecting all the other drives and hooking up just the SSDs, it turns out that apparently it is the SSD that appears to be infected (the two hidden drives are with the SSD) - so in this case should I just try to use the normal HD as a boot drive and forget about the SSD?

If, during this clean install on the SSD, you actually delete ALL existing partitions...it cannot still be 'infected'.

During the install, when it asks "where", select Custom.
You'll be presented with a list of all partitions on that drive.
Delete ALL of them, one by one.
An infection cannot survive that.

I tried deleting all of them, one by one, but then when I went to delete/format the main SSD portion, the installation failed in the way shown above. Then the previously 'deleted' partitions show up again. Even when using the 'diskpart' utility, it was unable to wipe or clean the SSD drive properly. The HD, on the other hand, I appeared able to completely clean, so maybe the SSD was just damaged in some way?

I've since detached the SSD and am now installing windows on just the HD, it seems to be going ok so far. Will keep you updated if it works.

 

[JackNaylorPE]

Thank you Jack for the detailed response, but I must admit some of the steps were a little unclear to me, or are difficult to do.

#2. Can i somehow connect the Boot data USB directly to my SSD for install? Can you please clarfiy here?

#5. The computer is about 5-6 years old now, and unfortunately my in-laws were careless with the original CDs... they are no longer available.

Well if the puter is that old, i dunno that it will be capable of doing USB install.... and if its that old, no way i would be putting Win 10 on it. All you need is the product key from the sticker ... or Belarc Advisor

https://www.microsoft.com/en-us/software-download/home

As far as deletion... I usually only wip[e the OS partition as that controls any virus going active. Once Windows and a quality AV scanner are installed on the SSD, with the HD disconected, it certainly if of no risk. once Windows installed, updated, WU disabled from loading HW drivers and AV installed, simply shut down and connect the other drive. Any virus on it is harmless as long as you don't launch any files off it.

So boot the machine after making sure that system is booting off the fresh install in SSD and then run the AZ .... not a free AV but use a 30 day free trial from Kasperky or Bit Defender

Of course the best why to clean / wipe any drive is from another PC using a docking station

https://www.newegg.com/Product/Product.aspx?Item=N82E16817153066&cm_re=blacx-_-17-153-066-_-Product

 

[USAFRet]

I tried deleting all of them, one by one, but then when I went to delete/format the main SSD portion, the installation failed in the way shown above. Then the previously 'deleted' partitions show up again. Even when using the 'diskpart' utility, it was unable to wipe or clean the SSD drive properly. The HD, on the other hand, I appeared able to completely clean, so maybe the SSD was just damaged in some way?

Given that, if I wanted to use the SSD as the OS drive (recommended)...
I would have gone LARGE nuclear.
From a different PC...whatever Secure Erase function the manufacturer gives. This literally nukes every single cell location on the drive.
If it fails to work after that...that SSD is broken.

 

[Raraku]

So, unfortunately the HD also failed to install. It crashed part way through the installation process. Really don't know what to try next - I'm thinking of just bringing it in to a specialist or something.

Thank you Jack for the detailed response, but I must admit some of the steps were a little unclear to me, or are difficult to do.

#2. Can i somehow connect the Boot data USB directly to my SSD for install? Can you please clarfiy here?

#5. The computer is about 5-6 years old now, and unfortunately my in-laws were careless with the original CDs... they are no longer available.

Well if the puter is that old, i dunno that it will be capable of doing USB install.... and if its that old, no way i would be putting Win 10 on it. All you need is the product key from the sticker ... or Belarc Advisor

https://www.microsoft.com/en-us/software-download/home

As far as deletion... I usually only wip[e the OS partition as that controls any virus going active. Once Windows and a quality AV scanner are installed on the SSD, with the HD disconected, it certainly if of no risk. once Windows installed, updated, WU disabled from loading HW drivers and AV installed, simply shut down and connect the other drive. Any virus on it is harmless as long as you don't launch any files off it.

So boot the machine after making sure that system is booting off the fresh install in SSD and then run the AZ .... not a free AV but use a 30 day free trial from Kasperky or Bit Defender

Of course the best why to clean / wipe any drive is from another PC using a docking station

https://www.newegg.com/Product/Product.aspx?Item=N82E16817153066&cm_re=blacx-_-17-153-066-_-Product

It's an old PC but it was well built and top tier when I built it. It appears to be handling USB install fine, since the boot disk boots up and it begins install. It also already installed once, but it wasn't a 'clean' installation - just an upgrade to windows 10.

I really did try deleting the partitions in multiple ways, through diskpart as well as the install tool, but it fails every time. I got a little further with the HD than the SSD, but even the HD failed. I wish there was an explanation but I don't know what else to tell you guys. Isn't it possible this is more than your run-of-the-mill virus - but something that embeds itself throughout the computer?

I've actually just found the old windows 7 CD - perhaps I should try with that instead of the USB?

 

[Raraku]

I tried deleting all of them, one by one, but then when I went to delete/format the main SSD portion, the installation failed in the way shown above. Then the previously 'deleted' partitions show up again. Even when using the 'diskpart' utility, it was unable to wipe or clean the SSD drive properly. The HD, on the other hand, I appeared able to completely clean, so maybe the SSD was just damaged in some way?

Given that, if I wanted to use the SSD as the OS drive (recommended)...
I would have gone LARGE nuclear.
From a different PC...whatever Secure Erase function the manufacturer gives. This literally nukes every single cell location on the drive.
If it fails to work after that...that SSD is broken.

OK, if I go LARGE nuclear, can I do it without any special hardware from my PC - at ZERO risk to my PC? Last thing I need is something infecting my PC as well...

 

[USAFRet]

I tried deleting all of them, one by one, but then when I went to delete/format the main SSD portion, the installation failed in the way shown above. Then the previously 'deleted' partitions show up again. Even when using the 'diskpart' utility, it was unable to wipe or clean the SSD drive properly. The HD, on the other hand, I appeared able to completely clean, so maybe the SSD was just damaged in some way?

Given that, if I wanted to use the SSD as the OS drive (recommended)...
I would have gone LARGE nuclear.
From a different PC...whatever Secure Erase function the manufacturer gives. This literally nukes every single cell location on the drive.
If it fails to work after that...that SSD is broken.

OK, if I go LARGE nuclear, can I do it without any special hardware from my PC - at ZERO risk to my PC? Last thing I need is something infecting my PC as well...

Yes.
What make/model SSD is this?

 

[USAFRet]

(I'm still not convinced that the previous procedure...delete ALL partitions then reinstall...was done correctly)
(But we'll progress down this Secure Erase path)