[mo713]

windows 8.1 spontaneously rolled back and lost all updates and installed programs

 

My father has a Toshiba laptop which came with Windows 8 and it had been upgraded to 8.1 some years ago. Yesterday he says that he was typing in a chat window, and suddenly, out of nowhere, his screen changed to a blue windows setup screen where you are supposed to set up a new computer for first use. Out of nowhere! If you fill in the selections for your settings, it opened into the tile homepage screen, and it was back to windows 8. All custom installed programs were gone and the OS was back to almost a factory state. Many user files were still there, but firefox browser was gone, along with all browsing history, settings, bookmarks, saved logins, etc. Other user installed programs like classic shell and vlc player were gone also.

 

I found the windows.old folder and at first it contained the folders Program Files and Program Files (x86)... but then moments later, those folders were gone. Almost as if by looking into the folder, it caused it to be deleted.

 

1. What is the most likely reason this happened out of the blue? He swears he did not update anything or do anything different at the moment this happened. Has anyone else ever seen this (instant screen change and revert to old OS out of the blue) ? I have never heard of this either from windows itself or even malware....

 

2. Why were the program files folders deleted out of the blue from windows.old? They were there and then they were gone.

 

3. Is there any way to get back to the old 8.1 installation without re-installing all the windows updates and again updating to 8.1 as if it never existed before?

 

Windows.old now contains about 13gigs, but the program folders are gone. There is a users folder and there is lots in the WinSxS folder. Is this enough to recreate the old installation?

 

I am not too familiar with Windows 8, and the other issue is I am not usually in the same location as this laptop, so I can't constantly access it.

Edited by mo713, 12 August 2017 - 03:46 PM.

[Advertisements]

Hello mo713,

 

Really odd and for the following reasons;

 

My father has a Toshiba laptop which came with Windows 8 and it had been upgraded to 8.1 some years ago.

 

 

Only way back to Windows 8 from Windows 8.1 would be by using a recovery partition on the Toshibas HDD or by clean installing from a Windows 8 DVD that shipped with the Toshiba when it was first purchased.

 

out of nowhere, his screen changed to a blue windows setup screen where you are supposed to set up a new computer for first use. Out of nowhere! If you fill in the selections for your settings, it opened into the tile homepage screen, and it was back to windows 8. All custom installed programs were gone and the OS was back to almost a factory state. Many user files were still there, but firefox browser was gone, along with all browsing history, settings, bookmarks, saved logins, etc. Other user installed programs like classic shell and vlc player were gone also.

 

 

If a recovery partition had somehow been accessed/used then the notebook would be back to out of the box new, there would be no personal data at all present only what had been factory installed such as Windows 8, system drivers and trial programs (bloatware) the latter programs that you mention like Classic Shell and VLC being missing would though normally suggest a recovery partition had been used.

 

I found the windows.old folder and at first it contained the folders Program Files and Program Files (x86)... but then moments later, those folders were gone. Almost as if by looking into the folder, it caused it to be deleted.

 

 

A Windows old folder is only created when you upgrade from an earlier OS to a later one and Windows automatically overwrites the Windows old folder after one month meaning that the original version of Windows 8 on the C: drive would be long gone.

 

1. What is the most likely reason this happened out of the blue?

 

 

No logical explanation so would suggest that the computer is checked for malware, will ask for a colleague to check this thread.

 

3. Is there any way to get back to the old 8.1 installation without re-installing all the windows updates and again updating to 8.1 as if it never existed before?

 

 

I strongly suspect not 

 

 

Edit to add: Security expert RKinner   suggests taking a look at the hard drive, can you do the following for us please mo713;

 

 

 Check the HDD with CrystalDiskInfo 7.0.0 Standard Edition which you can download from here once done grab a screenshot (possibly two) of the results and attach to your next reply for us.

 

To capture and post a screenshot;

Click on the ALT key + PRT SCR key..its on the top row..right hand side..now click on start...all programs...accessories...paint....left click in the white area ...press CTRL + V...click on file...click on save...save it to your desktop...name it something related to the screen your capturing... BE SURE TO SAVE IT AS A .JPG ...otherwise it may be to big to upload... Click on the More Reply Options tab then after typing in any response you have... click on Choose File...desktop...find the screenshot..select it and click on Attach This File...on the lower left...after it says upload successful...click on add reply like you normally would.

 

Screenshot instructions are provided to assist those that may read this topic but are not yet aware of the “how to”.

[phillpower2]

Hello mo713,

 

Really odd and for the following reasons;

 

My father has a Toshiba laptop which came with Windows 8 and it had been upgraded to 8.1 some years ago.

 

 

Only way back to Windows 8 from Windows 8.1 would be by using a recovery partition on the Toshibas HDD or by clean installing from a Windows 8 DVD that shipped with the Toshiba when it was first purchased.

 

out of nowhere, his screen changed to a blue windows setup screen where you are supposed to set up a new computer for first use. Out of nowhere! If you fill in the selections for your settings, it opened into the tile homepage screen, and it was back to windows 8. All custom installed programs were gone and the OS was back to almost a factory state. Many user files were still there, but firefox browser was gone, along with all browsing history, settings, bookmarks, saved logins, etc. Other user installed programs like classic shell and vlc player were gone also.

 

 

If a recovery partition had somehow been accessed/used then the notebook would be back to out of the box new, there would be no personal data at all present only what had been factory installed such as Windows 8, system drivers and trial programs (bloatware) the latter programs that you mention like Classic Shell and VLC being missing would though normally suggest a recovery partition had been used.

 

I found the windows.old folder and at first it contained the folders Program Files and Program Files (x86)... but then moments later, those folders were gone. Almost as if by looking into the folder, it caused it to be deleted.

 

 

A Windows old folder is only created when you upgrade from an earlier OS to a later one and Windows automatically overwrites the Windows old folder after one month meaning that the original version of Windows 8 on the C: drive would be long gone.

 

1. What is the most likely reason this happened out of the blue?

 

 

No logical explanation so would suggest that the computer is checked for malware, will ask for a colleague to check this thread.

 

3. Is there any way to get back to the old 8.1 installation without re-installing all the windows updates and again updating to 8.1 as if it never existed before?

 

 

I strongly suspect not 

 

 

Edit to add: Security expert RKinner   suggests taking a look at the hard drive, can you do the following for us please mo713;

 

 

 Check the HDD with CrystalDiskInfo 7.0.0 Standard Edition which you can download from here once done grab a screenshot (possibly two) of the results and attach to your next reply for us.

 

To capture and post a screenshot;

Click on the ALT key + PRT SCR key..its on the top row..right hand side..now click on start...all programs...accessories...paint....left click in the white area ...press CTRL + V...click on file...click on save...save it to your desktop...name it something related to the screen your capturing... BE SURE TO SAVE IT AS A .JPG ...otherwise it may be to big to upload... Click on the More Reply Options tab then after typing in any response you have... click on Choose File...desktop...find the screenshot..select it and click on Attach This File...on the lower left...after it says upload successful...click on add reply like you normally would.

 

Screenshot instructions are provided to assist those that may read this topic but are not yet aware of the “how to”.

[mo713]

Hi phillpower2,

 

Please be reminded that my father has limited skills with pc management, and he absolutely did not knowingly attempt anything resembling a recovery or factory reset and didn't do anything at all other than surf the web and run a few apps. So he did not take any "action" that could have made these changes.

 

I have heard of people being fooled into clicking the wrong button and upgrading to win10, but never heard of being tricked into downgrading to 8, or even if that was possible without some major effort.

 

He added that the screen said something about "you need to reinstall acrobat" and he clicked a button to restart. It's possible he clicked something more like "refresh", but even that shouldn't wipe 8.1 .

 

As you noted, the personal data files were still there. The downloads folder was still there. Installed programs were gone (but so was the OS version).

 

I suppose it could be malware, but again, I have not heard about malware that does this and doesn't give any message or other obvious signs. I also doubt that most malware is capable of doing this type of thing this specific. Wiping the hard drive- yes. Encrypting files- yes. Deleting certain data- yes. But removing a version upgrade and going back to old version without changing partition? I don't believe so.

 

Another guess of mine would be hardware failure, but in my past experience bad memory or hard drive or even file corruption would give very weird errors and messed up screen images, etc. Not continuing everything as normal but with a "lobotomy". In fact even if someone TRIED to delete all traces of 8.1 and remove installed applications in a quick and simple way, you either couldn't delete everything in the first place, or if you did, you would create such damage that the machine would not boot or would not run smoothly.

 

It doesn't make any sense!

 

 

p.s. I am aware that the windows.old folder is supposed to delete after 30 days if you don't use it, but in this case a new upgrade was not chosen and there was nothing to roll back, plus it has not been 30 days. Plus, the folder didn't get removed, only the "progam files" and program files x86 folders got removed suddenly after being there minutes before.

Edited by mo713, 13 August 2017 - 11:32 AM.

[phillpower2]

Please be reminded that my father has limited skills with pc management, and he absolutely did not knowingly attempt anything resembling a recovery or factory reset

 

 

Never suggested otherwise, only offered an explanation as to how this type of thing can sometimes come about and please keep in mind that forums are here to help and not apportion blame, especially when no one can explain what has caused the computer problem/s in the first place.

 

It's possible he clicked something more like "refresh", but even that shouldn't wipe 8.1 .

 

 

Neither a reset or refresh would create a Windows old folder, this question answered by Microsoft here

 

I suppose it could be malware, but again, I have not heard about malware that does this a

 

Another guess of mine would be hardware failure

 

 

Touched on both in the edit in my reply #2 but will add here that security expert RKinner said that he had never seen malware that caused such behaviour, none of us know everything and that was why I asked for a malware expert to give an informed opinion.

 

We are aware that you do not have readily available access to the computer concerned, there is no rush here but checking the HDD as advised needs to be done when convenient.

 

 

Edit to add: Security expert RKinner   suggests taking a look at the hard drive, can you do the following for us please mo713;

 

 

 Check the HDD with CrystalDiskInfo 7.0.0 Standard Edition which you can download from here once done grab a screenshot (possibly two) of the results and attach to your next reply for us.

 

 

 

To capture and post a screenshot;

 

Click on the ALT key + PRT SCR key..its on the top row..right hand side..now click on start...all programs...accessories...paint....left click in the white area ...press CTRL + V...click on file...click on save...save it to your desktop...name it something related to the screen your capturing... BE SURE TO SAVE IT AS A .JPG ...otherwise it may be to big to upload... Click on the More Reply Options tab then after typing in any response you have... click on Choose File...desktop...find the screenshot..select it and click on Attach This File...on the lower left...after it says upload successful...click on add reply like you normally would.

 

 

 

Screenshot instructions are provided to assist those that may read this topic but are not yet aware of the “how to”.

 

 

 

p.s. I am aware that the windows.old folder is supposed to delete after 30 days if you don't use it, but in this case a new upgrade was not chosen and there was nothing to roll back, plus it has not been 30 days. Plus, the folder didn't get removed, only the "progam files" and program files x86 folders got removed suddenly after being there minutes before.

 

 

 

 

 

As covered at the Microsoft link here

[mo713]

 

Please be reminded that my father has limited skills with pc management, and he absolutely did not knowingly attempt anything resembling a recovery or factory reset

 

 

Never suggested otherwise, only offered an explanation as to how this type of thing can sometimes come about and please keep in mind that forums are here to help and not apportion blame, especially when no one can explain what has caused the computer problem/s in the first place.

 

Don't get me wrong- I surely did not think you were assigning blame. I may have been inarticulate in my writing, but I do know that you guys are trying to help. I was only trying to put a big underline on the fact that this happened pretty much without any user involvement at all. I did not take offense and didn't intend any either

 

With regard to the hard drive check- I will get on that the next time I visit the location of the problem laptop, within the next week.

 

I will also add new info that I just learned- and I hope this doesn't hurt our efforts:

 

Father reports that on a recent reboot, Windows installed about 120 updates that were probably downloaded and waiting as part of the windows 8 update system. It now advises what I remember from the "last time" when 8.1 was offered.... no more o/s updates until you upgrade to 8.1, you must download it from the store and then your newest patches will start to be available again. So he is in a holding pattern with windows 8 until my next visit- but it has been altered and patched from the starting point of this problem.

[mo713]

Regarding windows.old: I don't know how it got created, but it contained info that dates as late as 8/11/17 which is when the problem started. So apparently it got created a different way from what that link talks about (install from media only). Also that link does not discuss the deletion of program files folders from within windows.old, but there are several google searches that mention that same phenomenon from other users. I haven't been able to find out why this happens at random without a trace, but it definitely does happen to lots of people.

[phillpower2]

Don't get me wrong- I surely did not think you were assigning blame. I may have been inarticulate in my writing, but I do know that you guys are trying to help. I was only trying to put a big underline on the fact that this happened pretty much without any user involvement at all.  I did not take offense and didn't intend any either 

 

 

No problem and likewise no offence intended or indeed taken   

 

Have another suggestion courtesy of RKinner 

Access the problem computer remotely using Team Viewer which you can download from here

 

Btw another of our well informed malware colleagues DonnaB has seen this before and caused by a person inadvertently clicking on something by accident, also of note was that a Windows old folder can be created, see article courtesy of Brink here info also passed on by DonnaB 

[mo713]

" Btw another of our well informed malware colleagues DonnaB has seen this before and caused by a person inadvertently clicking on something by accident,"

 

-----

 

Hmmmm...... any more details on what type of situation led to this or what kind of click- intended or otherwise- could accomplish this very amazing feat of surgically removing a newer o/s version and leaving everything else intact without a major process running operation? I.E. could this behavior be re-created if you wanted to?

 

Was it malware or just an unfortunate key sequence?

[phillpower2]

I am sure that DonnaB will not mind me passing the info on so that it may help others to understand that these things can and do happen;

 

I help the elderly at a senior citizen hi-rise where I deliver mail. One of the ladies there wanted me to look at her laptop because for some reason she said it just went back to how it was when she took it out of the box. She said she was just playing a game and all of a sudden the laptop went to a blue screen and the next thing she knows she was setting it up again as she did when it was new. She is up in her 80's and has little to no computer skills. After several questions I found she had clicked on something but didn't remember what she did. 

 

[DonnaB]

@ Phillpower2,

I don't mind at all Phill. Was just getting ready to jump in myself to prevent from you having to quote me.

Hi mo713,
 

Was it malware or just an unfortunate key sequence?

In my case, let's just say it was an unfortunate key sequence. I deliver mail to a senior citizen hi-rise. One of my customers is in her mid 80's and has very little computer skills. When she contacted me she said it happened so fast she has no idea how it happened. As a matter of fact, she had no idea what happened till I pointed out to her that somehow she restored the laptop back to factory settings. She does remember playing a game and that's it. I recall her telling me that in the past the laptop would be acting funny so to try and fix it she would do a system restore. I have a feeling that is what she was trying to do but can not verify this since I was not there when it happened to her. From there she has no idea what happened except she lost everything. Even the little doggie in a tall field of grass background I had set for her just a couple weeks before.

I wonder, is your fathers touch pad very sensitive? I have trouble with mine and have had near disasters because even the slightest touch of my palm will cause windows to open, the cursor move about on it's own and things get clicked on by accident. I even had a cat walk on my keyboard once and all kind of windows pop up. So many things could have caused what happened to your father and if it was sudden he may not remember what happened to cause it. It happens to the best of us.
 

Father reports that on a recent reboot, Windows installed about 120 updates that were probably downloaded and waiting as part of the windows 8 update system. It now advises what I remember from the "last time" when 8.1 was offered.... no more o/s updates until you upgrade to 8.1, you must download it from the store and then your newest patches will start to be available again. So he is in a holding pattern with windows 8 until my next visit- but it has been altered and patched from the starting point of this problem.

To be completely honest with you, I have never encountered that. Tell him to keep checking for updates. When I restoring the used Windows 8.1 that I bought a couple years ago to factory condition, it took me 2-3 days to get it up to date. The Windows Update applet will pause in between updates found and will tell you there are no more to download and install. The Windows 8.1 update did finally appear, though only after KB 2919442 was installed which is a pre-requisite for the installation of the Windows Update 8.1 (KB 2919355) which will not be offered till all pre-requisite are installed. I do have a feeling there are many more updates to come. I am pretty sure that once all the pre-requisites are downloaded and installed, the 8.1 update (KB 2919355) will appear.

See Note below found here:
 

Note

If you dont see KB 2919355 in the list of available updates, you might be missing one or more required updates. Follow the previous steps to check for updates, install all important updates, particularly KB 2919442, restart your PC, and then check for KB 2919355 again.

In regards to getting the Windows 8.1 KB (2919355) update from the Windows Store...

In order to prepare the system for the W8.1 update that you download and install from the Windows Store, you will need to have updates KB 2871389 and KB 2917499 installed. See first note half way down this page.

[mo713]

Good stuff to know! Sounds very similar . But even if there was a special key sequence that led to the behavior, it still seems extremely odd and not right that the blue screen or windows setup screen popped up out of nowhere right in the middle of typing a chat. There was no warning box, no notice that windows would be shut down or anything. That should never happen If that is how win8 was designed, it is unfathomable. If it wasn't designed to do this, it is the most ridiculous bug I have ever witnessed from an o/s. Oh wait! It is an undocumented "feature"

 

One important difference here (from what I read above) is that he still has access to most of the user files he created or downloaded. It was not in a fully factory state, only the core operating system files were brought back to their original versions. Basically the windows folder as far as I can tell.

[DonnaB]

Sounds like a refresh occurred to me. Read here about what will and will not be preserved during a refresh. Specifically Which Settings will be Preserved and under Which Settings will be NOT be Preserved where it points out that Installed Windows Updates will be removed. Windows 8.1 is an update so it was removed and reverted back to Windows 8. All his personal files, data, programs that he created using his "User" account should still be intact.

[mo713]

"All his personal files, data, programs that he created using his "User" account should still be intact. "

 

That is true about the first two. The last one (programs) got removed. The biggie that got removed was Firefox, which is where he does the most work and had the most settings and history stored. The only programs remaining were the ones that come with win8 or those that I presume are packaged/bundled with the pc such as Norton AV.

 

******* Is there a way to "un- Refresh"??

Edited by mo713, 14 August 2017 - 08:46 PM.

[DonnaB]

Far as I know there is no way to undo a refresh. Do you know if he had any current restore points? I thought I read somewhere that if there was a current restore point that the refresh would only go back that far. Don't quote me on that though. That is something I would have to research further unless one of the other members here can verify (or not) my thoughts on that.

[phillpower2]

@ Phillpower2,

I don't mind at all Phill. Was just getting ready to jump in myself to prevent from you having to quote me.

Hi mo713,
 

Was it malware or just an unfortunate key sequence?

In my case, let's just say it was an unfortunate key sequence. I deliver mail to a senior citizen hi-rise. One of my customers is in her mid 80's and has very little computer skills. When she contacted me she said it happened so fast she has no idea how it happened. As a matter of fact, she had no idea what happened till I pointed out to her that somehow she restored the laptop back to factory settings. She does remember playing a game and that's it. I recall her telling me that in the past the laptop would be acting funny so to try and fix it she would do a system restore. I have a feeling that is what she was trying to do but can not verify this since I was not there when it happened to her. From there she has no idea what happened except she lost everything. Even the little doggie in a tall field of grass background I had set for her just a couple weeks before.

I wonder, is your fathers touch pad very sensitive? I have trouble with mine and have had near disasters because even the slightest touch of my palm will cause windows to open, the cursor move about on it's own and things get clicked on by accident. I even had a cat walk on my keyboard once and all kind of windows pop up. So many things could have caused what happened to your father and if it was sudden he may not remember what happened to cause it. It happens to the best of us.
 

Father reports that on a recent reboot, Windows installed about 120 updates that were probably downloaded and waiting as part of the windows 8 update system. It now advises what I remember from the "last time" when 8.1 was offered.... no more o/s updates until you upgrade to 8.1, you must download it from the store and then your newest patches will start to be available again. So he is in a holding pattern with windows 8 until my next visit- but it has been altered and patched from the starting point of this problem.

To be completely honest with you, I have never encountered that. Tell him to keep checking for updates. When I restoring the used Windows 8.1 that I bought a couple years ago to factory condition, it took me 2-3 days to get it up to date. The Windows Update applet will pause in between updates found and will tell you there are no more to download and install. The Windows 8.1 update did finally appear, though only after KB 2919442 was installed which is a pre-requisite for the installation of the Windows Update 8.1 (KB 2919355) which will not be offered till all pre-requisite are installed. I do have a feeling there are many more updates to come. I am pretty sure that once all the pre-requisites are downloaded and installed, the 8.1 update (KB 2919355) will appear.

See Note below found here:
 

Note

If you dont see KB 2919355 in the list of available updates, you might be missing one or more required updates. Follow the previous steps to check for updates, install all important updates, particularly KB 2919442, restart your PC, and then check for KB 2919355 again.

In regards to getting the Windows 8.1 KB (2919355) update from the Windows Store...

In order to prepare the system for the W8.1 update that you download and install from the Windows Store, you will need to have updates KB 2871389 and KB 2917499 installed. See first note half way down this page.

 

 

Thanks Donna