Could this be malware?

By devnulllore
in Microsoft (Windows)

 Share

Recommended Posts

Grand Master

sc302 Veteran

Posted
  • Veteran
Posted

So being that you have reinstalled and are still having issues, can you drill into process explorer and see what the actual issue is?

 

I mean, we can take a bigger gun to it and just tell you to replace the system, there is always that option.  

 

I am not trying to be a jerk, but we haven't identified actual root cause...just something with explorer.exe is causing the issue.  Need to dig deeper.  It could be a driver or some other software (intel, crucial, etc) that is causing the issue.  The shot gun approach didn't fix this time.  We can attack it with a bigger gun and put the system out of its misery, or take out the scalpel and perform some surgery to remove the cancer.

Mentor

Ve7878

Posted
Posted
1 hour ago, devnulllore said:

Ok, I just did another fresh install from a new 1903 build install disc. WInver says version 1903 (OS Build 18962.1000) I will let you know how it works.

Yes as Adrenalyn said that's an insider build so I have no idea what you're doing here. You mentioned in a previous thread that you keep getting upgraded to the Insider builds. What are you actually doing after you install Windows?

Mentor

Ve7878

Posted
Posted
3 minutes ago, devnulllore said:

Downloaded and burned the ISO file

I find that most bizarre. Would you be able to put the DVD you burned and run the following command:

 

 dism /Get-WimInfo /WimFile:G:\sources\install.wim /index:1

 

Change G:\ to whatever your DVD drive letter is, then post the output of this command here. It may help to see if this is happening pre or post installation.

Grand Master

devnulllore

Posted
  • Author
Posted (edited)
7 minutes ago, Vince800 said:

I find that most bizarre. Would you be able to put the DVD you burned and run the following command:

 

 dism /Get-WimInfo /WimFile:G:\sources\install.wim /index:1

 

Change G:\ to whatever your DVD drive letter is, then post the output of this command here. It may help to see if this is happening pre or post installation.

C:\WINDOWS\system32>dism /Get-WimInfo /WimFile:H:\sources\install.wim /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1


Error: 2

The system cannot find the file specified.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

 

There is no install.wim file only boot.wim

 

Mentor

Ve7878

Posted
Posted
31 minutes ago, devnulllore said:

C:\WINDOWS\system32>dism /Get-WimInfo /WimFile:H:\sources\install.wim /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1


Error: 2

The system cannot find the file specified.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

 

There is no install.wim file only boot.wim

 

Ah it may be an .esd file.

 

dism /Get-WimInfo /WimFile:H:\sources\install.esd /index:1

Grand Master

devnulllore

Posted
  • Author
Posted
29 minutes ago, Vince800 said:

Ah it may be an .esd file.

 

dism /Get-WimInfo /WimFile:H:\sources\install.esd /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Details for image : H:\sources\install.esd

Index : 1
Name : Microsoft Windows PE (x64)
Description : Microsoft Windows PE (x64)
Size : 1,692,329,773 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.18362
ServicePack Build : 239
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3704
Files : 16232
Created : 3/19/2019 - 12:10:55 AM
Modified : 8/20/2019 - 1:09:55 PM
Languages :
        en-US (Default)

The operation completed successfully.

Mentor

Ve7878

Posted
Posted
25 minutes ago, devnulllore said:

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Details for image : H:\sources\install.esd

Index : 1
Name : Microsoft Windows PE (x64)
Description : Microsoft Windows PE (x64)
Size : 1,692,329,773 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.18362
ServicePack Build : 239
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3704
Files : 16232
Created : 3/19/2019 - 12:10:55 AM
Modified : 8/20/2019 - 1:09:55 PM
Languages :
        en-US (Default)

The operation completed successfully.

So the update must be happening after installation. Do you sign in with a local or Microsoft account. I'm just wondering if you're signing in with a Microsoft account in the Insider programme on a machine which doens't have a valid license for some strange reason.

Mentor

Ve7878

Posted
Posted
5 minutes ago, SnoopZ said:

Sounds like you have previously signed up to the Insider buiilds which probably means it will update to the latest Insider build?

That shouldn't trigger an automatic update to the Insider programme without any manual intervention though.

 

To answer the actual question though, it's not malware.

Grand Master

Brandon H Supervisor

Posted
  • Supervisor
Posted
4 minutes ago, Vince800 said:

That shouldn't trigger an automatic update to the Insider programme without any manual intervention though.

 

To answer the actual question though, it's not malware.

correct; from all my personal re-installs I've never seen the insider builds enable themselves; If I want to use insider builds again I have to enable it manually in settings as always.

 

I have no idea why it keeps forcing OP onto insider builds; I'd recommend OP reach out to Microsoft Support at this point to determine why that particular thing keeps happening.

Grand Master

+Warwagon MVC

Posted
  • MVC
Posted
36 minutes ago, Riggers said:

Any errors in Event Viewer directly after it happening?

correct, check the event viewer and look at the log entry for the application crash explorer.exe

 

I've seen it before were the onboard audio driver was killing explorer. It may have a dll or sys file in log entry telling you which file killed it.

Grand Master

devnulllore

Posted
  • Author
Posted

Ok, I did the only thing I can think of and did a new fresh install off the new disc and checked the winver immediately it reads version 1903 (OS Build 18362.295)

 

I found where to enable the insider program and it was enabled by default so I turned it off.

 

So I will monitor with process explorer and see if it happens again. Any other suggestions?

Grand Master

firey

Posted
Posted
1 hour ago, devnulllore said:

Ok, I did the only thing I can think of and did a new fresh install off the new disc and checked the winver immediately it reads version 1903 (OS Build 18362.295)

 

I found where to enable the insider program and it was enabled by default so I turned it off.

 

So I will monitor with process explorer and see if it happens again. Any other suggestions?

If you can get it to happen consistently, can you try recording it happen? Would be interesting to see what it is, if it's some sort of GPU window re-draw or if it's actually explorer reloading.

 

Are you restoring multiple files (images, documents, etc) when you complete an install?
Do all folders have this issue or is it only ones with many files?
If you have multiple monitors, does it happen on only one of them?
Do you have any devices plugged in (webcam, microphone, external hdd)? 
Have you tried googling the issue (possibly other forums, youtube, etc)?

Grand Master

devnulllore

Posted
  • Author
Posted
On 8/20/2019 at 4:23 PM, Vince800 said:

So the update must be happening after installation. Do you sign in with a local or Microsoft account. I'm just wondering if you're signing in with a Microsoft account in the Insider programme on a machine which doens't have a valid license for some strange reason.

Yes I am logging into my Microsoft Account. Mi licence is valid as far as I know. The registration is in my bios.

Just now, SnoopZ said:

Has it happened again since you stopped it downloading an insider build?

The lag, yes but Explorer has not crashed since I got rid of the insiders build.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.