Could this be malware?


Recommended Posts

So being that you have reinstalled and are still having issues, can you drill into process explorer and see what the actual issue is?

 

I mean, we can take a bigger gun to it and just tell you to replace the system, there is always that option.  

 

I am not trying to be a jerk, but we haven't identified actual root cause...just something with explorer.exe is causing the issue.  Need to dig deeper.  It could be a driver or some other software (intel, crucial, etc) that is causing the issue.  The shot gun approach didn't fix this time.  We can attack it with a bigger gun and put the system out of its misery, or take out the scalpel and perform some surgery to remove the cancer.

1 hour ago, devnulllore said:

Ok, I just did another fresh install from a new 1903 build install disc. WInver says version 1903 (OS Build 18962.1000) I will let you know how it works.

Yes as Adrenalyn said that's an insider build so I have no idea what you're doing here. You mentioned in a previous thread that you keep getting upgraded to the Insider builds. What are you actually doing after you install Windows?

3 minutes ago, devnulllore said:

Downloaded and burned the ISO file

I find that most bizarre. Would you be able to put the DVD you burned and run the following command:

 

 dism /Get-WimInfo /WimFile:G:\sources\install.wim /index:1

 

Change G:\ to whatever your DVD drive letter is, then post the output of this command here. It may help to see if this is happening pre or post installation.

7 minutes ago, Vince800 said:

I find that most bizarre. Would you be able to put the DVD you burned and run the following command:

 

 dism /Get-WimInfo /WimFile:G:\sources\install.wim /index:1

 

Change G:\ to whatever your DVD drive letter is, then post the output of this command here. It may help to see if this is happening pre or post installation.

C:\WINDOWS\system32>dism /Get-WimInfo /WimFile:H:\sources\install.wim /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1


Error: 2

The system cannot find the file specified.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

 

There is no install.wim file only boot.wim

 

31 minutes ago, devnulllore said:

C:\WINDOWS\system32>dism /Get-WimInfo /WimFile:H:\sources\install.wim /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1


Error: 2

The system cannot find the file specified.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

 

There is no install.wim file only boot.wim

 

Ah it may be an .esd file.

 

dism /Get-WimInfo /WimFile:H:\sources\install.esd /index:1

29 minutes ago, Vince800 said:

Ah it may be an .esd file.

 

dism /Get-WimInfo /WimFile:H:\sources\install.esd /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Details for image : H:\sources\install.esd

Index : 1
Name : Microsoft Windows PE (x64)
Description : Microsoft Windows PE (x64)
Size : 1,692,329,773 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.18362
ServicePack Build : 239
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3704
Files : 16232
Created : 3/19/2019 - 12:10:55 AM
Modified : 8/20/2019 - 1:09:55 PM
Languages :
        en-US (Default)

The operation completed successfully.

25 minutes ago, devnulllore said:

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Details for image : H:\sources\install.esd

Index : 1
Name : Microsoft Windows PE (x64)
Description : Microsoft Windows PE (x64)
Size : 1,692,329,773 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.18362
ServicePack Build : 239
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3704
Files : 16232
Created : 3/19/2019 - 12:10:55 AM
Modified : 8/20/2019 - 1:09:55 PM
Languages :
        en-US (Default)

The operation completed successfully.

So the update must be happening after installation. Do you sign in with a local or Microsoft account. I'm just wondering if you're signing in with a Microsoft account in the Insider programme on a machine which doens't have a valid license for some strange reason.

5 minutes ago, SnoopZ said:

Sounds like you have previously signed up to the Insider buiilds which probably means it will update to the latest Insider build?

That shouldn't trigger an automatic update to the Insider programme without any manual intervention though.

 

To answer the actual question though, it's not malware.

4 minutes ago, Vince800 said:

That shouldn't trigger an automatic update to the Insider programme without any manual intervention though.

 

To answer the actual question though, it's not malware.

correct; from all my personal re-installs I've never seen the insider builds enable themselves; If I want to use insider builds again I have to enable it manually in settings as always.

 

I have no idea why it keeps forcing OP onto insider builds; I'd recommend OP reach out to Microsoft Support at this point to determine why that particular thing keeps happening.

36 minutes ago, Riggers said:

Any errors in Event Viewer directly after it happening?

correct, check the event viewer and look at the log entry for the application crash explorer.exe

 

I've seen it before were the onboard audio driver was killing explorer. It may have a dll or sys file in log entry telling you which file killed it.

Ok, I did the only thing I can think of and did a new fresh install off the new disc and checked the winver immediately it reads version 1903 (OS Build 18362.295)

 

I found where to enable the insider program and it was enabled by default so I turned it off.

 

So I will monitor with process explorer and see if it happens again. Any other suggestions?

1 hour ago, devnulllore said:

Ok, I did the only thing I can think of and did a new fresh install off the new disc and checked the winver immediately it reads version 1903 (OS Build 18362.295)

 

I found where to enable the insider program and it was enabled by default so I turned it off.

 

So I will monitor with process explorer and see if it happens again. Any other suggestions?

If you can get it to happen consistently, can you try recording it happen? Would be interesting to see what it is, if it's some sort of GPU window re-draw or if it's actually explorer reloading.

 

Are you restoring multiple files (images, documents, etc) when you complete an install?
Do all folders have this issue or is it only ones with many files?
If you have multiple monitors, does it happen on only one of them?
Do you have any devices plugged in (webcam, microphone, external hdd)? 
Have you tried googling the issue (possibly other forums, youtube, etc)?

On 8/20/2019 at 4:23 PM, Vince800 said:

So the update must be happening after installation. Do you sign in with a local or Microsoft account. I'm just wondering if you're signing in with a Microsoft account in the Insider programme on a machine which doens't have a valid license for some strange reason.

Yes I am logging into my Microsoft Account. Mi licence is valid as far as I know. The registration is in my bios.

Just now, SnoopZ said:

Has it happened again since you stopped it downloading an insider build?

The lag, yes but Explorer has not crashed since I got rid of the insiders build.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Pretty nice tool, thanks
    • Indeed. But note that this has Wifi7, HDMI 2.1, BlueTooth 5.4, and 5G Ethernet, so even in the additional features list this bundle blows the Steam Machine away. And, with the money saved, one could improve this dramatically.
    • One of the strangest galaxies in our Universe could help answer some long overdue questions by Sayan Sen Image by Pixabay via Pexels | Not representative An international team of astronomers led by the Department of Astronomy at Tsinghua University has discovered an unusually metal-poor galaxy that may contain signs of first-generation star formation. The galaxy, named Metal-Pristine Galaxy COSMOS Redshift 3 (MPG-CR3), or CR3, was identified using observations from the James Webb Space Telescope (JWST), the Very Large Telescope (VLT), and the Subaru Telescope. The findings, published in The Astrophysical Journal Letters, describe CR3 as the most metal-poor galaxy known from the period known as "cosmic noon," around 11.5 billion years ago. Cosmic noon refers to a period when the universe was producing stars at its highest rate and galaxies were growing rapidly. In astronomy, "metals" refers to all elements heavier than helium, including oxygen, carbon, and iron. Because CR3 contains so few of these heavier elements, researchers say it closely resembles what scientists expect the earliest galaxies in the universe may have looked like. The discovery is significant because it could offer clues about Population III (Pop III) stars, the first generation of stars thought to have formed after the Big Bang. These stars are believed to have formed from gas made almost entirely of hydrogen and helium, before heavier elements were created inside stars and spread across the universe through supernova explosions. Hence this is why CR3 has been referred to as a "living fossil." Scientists have long believed that Population III stars existed only in the very early universe. As more generations of stars formed and died, they enriched surrounding gas with heavier elements, making the conditions needed for metal-free star formation increasingly rare. Because of this, researchers expected the formation of such stars to have largely ended after the epoch of reionization, a period when radiation from the first stars and galaxies transformed the neutral hydrogen filling the universe and made it largely transparent to ultraviolet light. CR3 appears to challenge that idea. The galaxy was observed at a redshift of z = 3.193 ± 0.016. Redshift measures how much light from a distant object has been stretched as the universe expands and helps astronomers determine how far back in time they are looking. In this case, the redshift corresponds to roughly 11.5 billion years ago during cosmic noon. Although the universe was already several billion years old by that point, CR3 shows characteristics more commonly associated with much earlier galaxies. Observations revealed exceptionally strong emissions from hydrogen and helium, including Lyα, Hα, and He I λ10830. Lyα, or Lyman-alpha emission, is a specific wavelength of light produced by hydrogen and is widely used to study distant galaxies. Hα emission is another hydrogen signature commonly used to trace active star formation, while He I λ10830 is produced by helium and can indicate the presence of very hot, young stars. The measured equivalent widths of EW₀(Lyα) = 822 ± 101 Å and EW₀(Hα) = 2814 ± 327 Å are among the highest ever observed in star-forming galaxies. Equivalent width is a measure of the strength of an emission line relative to the surrounding light, and such large values are typically associated with intense and very recent star formation. At the same time, researchers found no statistically significant detections of metal emission lines, including [O III] λλ4959, 5007 and C IV λλ1548, 1550. Emission lines act as chemical fingerprints that reveal which elements are present in a galaxy. Oxygen and carbon lines are commonly seen in galaxies that have already undergone significant chemical enrichment. Their absence in CR3 suggests an unusually pristine environment. Using abundance calibration methods developed with JWST observations, the team placed a 2σ upper limit on the galaxy's gas-phase metallicity of 12+log(O/H)<6.52, corresponding to less than 0.7% of the Sun's metallicity (Z < 7 × 10⁻³ Z⊙). Gas-phase metallicity measures the abundance of heavy elements in a galaxy's gas. A 2σ upper limit indicates that the true value is very unlikely to be higher than the quoted threshold. Even when accounting for uncertainties in the calibration methods, the most conservative limit remains 12+log(O/H)<6.95, making CR3 the most metal-poor galaxy identified at cosmic noon. The galaxy also appears to contain very little dust. Researchers measured a Lyα/Hα flux ratio of 13.9 ± 2.5, a result that suggests negligible dust attenuation, meaning very little of the galaxy's light is being absorbed or scattered by cosmic dust. Because dust is usually produced by earlier generations of stars, this finding further supports the idea that CR3 has experienced very little chemical enrichment. Further analysis using spectral energy distribution modelling, a technique that compares observed light with theoretical models, suggests that CR3 contains an extremely young stellar population only around 2 million years old. The modelling, which used Population III stellar templates, also indicates the galaxy has a stellar mass of approximately 6.1 × 10⁵ M⊙. The symbol M⊙ represents one solar mass, or the mass of the Sun. One of the key questions raised by the discovery is how such a chemically primitive galaxy could exist in a universe that had already spent billions of years producing heavier elements. To investigate this, the researchers examined CR3's surroundings. Their analysis suggests the galaxy may lie in a slightly underdense environment, with a density contrast of roughly δ ≈ −0.12. An underdense region contains less matter and fewer galaxies than average. The team suggests that this relative isolation may have helped preserve pockets of pristine gas. Metal-rich material expelled from nearby galaxies may never have reached CR3, while the lower rate of galaxy mergers and interactions could have slowed the mixing of enriched gas into the system. If future observations confirm these findings, CR3 could provide some of the strongest evidence yet that first-generation star formation continued well after the epoch of reionization. Such a result would challenge the conventional view that pristine star formation ended by z ≳ 6 and suggest that small pockets of metal-free gas survived much longer than previously thought. Researchers stress that more observations will be needed to determine the galaxy's true nature. Future spectroscopic studies with higher resolution and better signal quality could help confirm whether CR3 is genuinely hosting Population III star formation. The discovery is also expected to encourage searches for other similar galaxies, which could help astronomers better understand how the first stars formed and how galaxies evolved in the early universe. Source: Tsinghua University, IOPscience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "I think in the immediate absence of a partner to apply relief" In the words of Sterling Archer... "Phrasing!"
  • Recent Achievements

    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
  • Popular Contributors

    1. 1
      +primortal
      454
    2. 2
      +Edouard
      161
    3. 3
      PsYcHoKiLLa
      107
    4. 4
      Michael Scrip
      83
    5. 5
      Steven P.
      70
  • Tell a friend

    Love Neowin? Tell a friend!