Fixing corrupted windows?

LamoidZombieDog · April 21, 2020

Long story short I opened a file which generated an image in my downloads folder (where the origional file was located) with red text saying to pay btc for your corrupted files, and from what I saw it put this on my background as well as when the administrator prompt came up for something it appeared in the background. My computer was shut off within 2 minutes. Made a copy of my C drive and ran it on a lower end laptop I had. After it finally started it was scanned with no problems and the picture was gone. After trying to view my 4TB drive (which has my downloads folder documents photos videos music on it plus other random files) on this laptop it appeared as a 16tb drive. Did the same thing on another laptop as well. Booted up image for windows and tried to make a copy of the drive, for it to show as a regular 4tb. Since my external 4tb I wanted to copy decided to show as a 2tb I decided to boot windows back on my main computer along with the 4tb installed, and now I can't get windows to boot. First it got stuck on getting devices ready, then got stuck on the windows spining screen. Now it just tells me it couldn't finish automatic repair and goes further. In the process I ended up making a new copy of my C drive ssd to a different hdd incase booting off the laptop messed with it. Still the same problems. Tomorrow I'll try booting off the laptop again. Any way I can fix this so I have a computer for 2 weeks? I was planning to fully rebuild and reformat my computer then anyways so as long as i have a computer until then I'm good.

Eigenvektor · April 21, 2020

Sounds like ransomware has encrypted your files. You should not boot that system again, since that will most likely result in further damage.

Depending on how quickly you turned off your computer, you may be able to rescue files that haven't been encrypted yet, by mounting the drive in another OS (preferably a Linux live-CD) and copying them somewhere else. Files that have already been encrypted are unlikely to be salvageable unless it is a variant with a known decryption key. For this you would have to find out what kind of malware we are talking about.