Windows 10: System hacked with shadow drives and network restore points.

Hi, I am looking for some help to figure out how to completely remove everything from my system after I was hacked. I'm pretty sure the hacker has moved on but has left really annoying scripts and software like I cannot upgrade my graphics card or other things because when I try the program MMC shows up in task manager and takes control of them.I have tried to do a full clean install but found shadow drives installed then I found a network restore point that I cannot remove on my system, so everytime I do reinstall it gets restored back to when he took control.He has also taken control with th

:)

 

About deletion of Shadow Copy or System Restore in Windows 10

Hello,

Today I did a Disk Defragment on C: Drive in Windows 10. Before Defragmentation, I had 151GB/200GB, but after defragmentation now I have 147GB/200GB.

I searched on the internet and found that there might be some shadows copies done. Now according to a post in Microsoft Support, I was able to see that almost 3.57 GB is consumed by system restore. My question are :

1. Are System Restore and Shadow Copy same? Because both of them are consuming the same amount of space.
2. If I delete a system restore point at this point (Currently, I only have the latest restore point after Defragmentation), will it create any other problems?
3. Lastly, Are Shadow copies or the Windows Restore points automatically deleted?

Thanks in advance.

 

Restore Point and Shadow Copy

Greg Carmack,



Many thanks. Followed your suggestions for System Restore and although the Win 10 menus are different I found that System Protection was already “On” Turned off, rebooted and turned back “On” and was able to create a Restore Point for first time
in months.



Followed your suggestions on recovering the ability to create “Shadow Copy,” and create a backup my files was also successful. Had spent many hours following Microsoft Support instructions to no avail.



Again, many, many thanks.

 

System restore points are lost

Hi Tom,

Thanks you for posting your reply and update.

I suggest you to check if the Volume Shadow Copy service is running on your computer. This service enables System Restore on a computer. Refer the steps below to check the service.

• Press Windows + R Keys to open run command.
• Type services.msc and hit Enter.
• In the services panel look for the ‘Volume Shadow Copy’.
• Right click on the service and restart the service.
• Also set the startup type to ‘Automatic’

Hope this information is helpful. Please do let us know if you need further assistance, we’ll be glad to assist you.