Could this be malware?

[devnulllore]

Ok, I just did another fresh install from a new 1903 build install disc. WInver says version 1903 (OS Build 18962.1000) I will let you know how it works.

[adrynalyne]

8 minutes ago, devnulllore said:

Ok, I just did another fresh install from a new 1903 build install disc. WInver says version 1903 (OS Build 18962.1000) I will let you know how it works.

That’s an insider build...

[devnulllore]

Just now, adrynalyne said:

That’s an insider build...

I followed the instructions to the letter and that's the build it gave me.

[Matthew S.]

Regardless.. Issues still present?

[devnulllore]

Yes and explorer has crashed three times.

[sc302 Veteran]

So being that you have reinstalled and are still having issues, can you drill into process explorer and see what the actual issue is?

 

I mean, we can take a bigger gun to it and just tell you to replace the system, there is always that option.  

 

I am not trying to be a jerk, but we haven't identified actual root cause...just something with explorer.exe is causing the issue.  Need to dig deeper.  It could be a driver or some other software (intel, crucial, etc) that is causing the issue.  The shot gun approach didn't fix this time.  We can attack it with a bigger gun and put the system out of its misery, or take out the scalpel and perform some surgery to remove the cancer.

[Ve7878]

1 hour ago, devnulllore said:

Ok, I just did another fresh install from a new 1903 build install disc. WInver says version 1903 (OS Build 18962.1000) I will let you know how it works.

Yes as Adrenalyn said that's an insider build so I have no idea what you're doing here. You mentioned in a previous thread that you keep getting upgraded to the Insider builds. What are you actually doing after you install Windows?

[devnulllore]

I did nothing this time. That was what winver said immediately after installing.

[Ve7878]

Just now, devnulllore said:

I did nothing this time. That was what winver said immediately after installing.

When you ran the media creation tool did you use a USB Flash drive or just download an ISO file?

[devnulllore]

Just now, Vince800 said:

When you ran the media creation tool did you use a USB Flash drive or just download an ISO file?

Downloaded and burned the ISO file

[Ve7878]

3 minutes ago, devnulllore said:

Downloaded and burned the ISO file

I find that most bizarre. Would you be able to put the DVD you burned and run the following command:

 

 dism /Get-WimInfo /WimFile:G:\sources\install.wim /index:1

 

Change G:\ to whatever your DVD drive letter is, then post the output of this command here. It may help to see if this is happening pre or post installation.

[devnulllore]

7 minutes ago, Vince800 said:

I find that most bizarre. Would you be able to put the DVD you burned and run the following command:

 

 dism /Get-WimInfo /WimFile:G:\sources\install.wim /index:1

 

Change G:\ to whatever your DVD drive letter is, then post the output of this command here. It may help to see if this is happening pre or post installation.

C:\WINDOWS\system32>dism /Get-WimInfo /WimFile:H:\sources\install.wim /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Error: 2

The system cannot find the file specified.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

 

There is no install.wim file only boot.wim

 

[Ve7878]

31 minutes ago, devnulllore said:

C:\WINDOWS\system32>dism /Get-WimInfo /WimFile:H:\sources\install.wim /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Error: 2

The system cannot find the file specified.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

 

There is no install.wim file only boot.wim

 

Ah it may be an .esd file.

 

dism /Get-WimInfo /WimFile:H:\sources\install.esd /index:1

[devnulllore]

29 minutes ago, Vince800 said:

Ah it may be an .esd file.

 

dism /Get-WimInfo /WimFile:H:\sources\install.esd /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Details for image : H:\sources\install.esd

Index : 1
Name : Microsoft Windows PE (x64)
Description : Microsoft Windows PE (x64)
Size : 1,692,329,773 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.18362
ServicePack Build : 239
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3704
Files : 16232
Created : 3/19/2019 - 12:10:55 AM
Modified : 8/20/2019 - 1:09:55 PM
Languages :
        en-US (Default)

The operation completed successfully.

[Riggers]

Any errors in Event Viewer directly after it happening?

[Ve7878]

25 minutes ago, devnulllore said:

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Details for image : H:\sources\install.esd

Index : 1
Name : Microsoft Windows PE (x64)
Description : Microsoft Windows PE (x64)
Size : 1,692,329,773 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.18362
ServicePack Build : 239
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3704
Files : 16232
Created : 3/19/2019 - 12:10:55 AM
Modified : 8/20/2019 - 1:09:55 PM
Languages :
        en-US (Default)

The operation completed successfully.

So the update must be happening after installation. Do you sign in with a local or Microsoft account. I'm just wondering if you're signing in with a Microsoft account in the Insider programme on a machine which doens't have a valid license for some strange reason.

[SnoopZ]

Sounds like you have previously signed up to the Insider buiilds which probably means it will update to the latest Insider build?

[Ve7878]

5 minutes ago, SnoopZ said:

Sounds like you have previously signed up to the Insider buiilds which probably means it will update to the latest Insider build?

That shouldn't trigger an automatic update to the Insider programme without any manual intervention though.

 

To answer the actual question though, it's not malware.

[Brandon H Supervisor]

4 minutes ago, Vince800 said:

That shouldn't trigger an automatic update to the Insider programme without any manual intervention though.

 

To answer the actual question though, it's not malware.

correct; from all my personal re-installs I've never seen the insider builds enable themselves; If I want to use insider builds again I have to enable it manually in settings as always.

 

I have no idea why it keeps forcing OP onto insider builds; I'd recommend OP reach out to Microsoft Support at this point to determine why that particular thing keeps happening.

[+Warwagon MVC]

36 minutes ago, Riggers said:

Any errors in Event Viewer directly after it happening?

correct, check the event viewer and look at the log entry for the application crash explorer.exe

 

I've seen it before were the onboard audio driver was killing explorer. It may have a dll or sys file in log entry telling you which file killed it.

[devnulllore]

Ok, I did the only thing I can think of and did a new fresh install off the new disc and checked the winver immediately it reads version 1903 (OS Build 18362.295)

 

I found where to enable the insider program and it was enabled by default so I turned it off.

 

So I will monitor with process explorer and see if it happens again. Any other suggestions?

[firey]

1 hour ago, devnulllore said:

Ok, I did the only thing I can think of and did a new fresh install off the new disc and checked the winver immediately it reads version 1903 (OS Build 18362.295)

 

I found where to enable the insider program and it was enabled by default so I turned it off.

 

So I will monitor with process explorer and see if it happens again. Any other suggestions?

If you can get it to happen consistently, can you try recording it happen? Would be interesting to see what it is, if it's some sort of GPU window re-draw or if it's actually explorer reloading.

 

Are you restoring multiple files (images, documents, etc) when you complete an install?
Do all folders have this issue or is it only ones with many files?
If you have multiple monitors, does it happen on only one of them?
Do you have any devices plugged in (webcam, microphone, external hdd)? 
Have you tried googling the issue (possibly other forums, youtube, etc)?

[devnulllore]

On 8/20/2019 at 4:14 PM, Riggers said:

Any errors in Event Viewer directly after it happening?

No

[SnoopZ]

1 minute ago, devnulllore said:

No

Has it happened again since you stopped it downloading an insider build?

[devnulllore]

On 8/20/2019 at 4:23 PM, Vince800 said:

So the update must be happening after installation. Do you sign in with a local or Microsoft account. I'm just wondering if you're signing in with a Microsoft account in the Insider programme on a machine which doens't have a valid license for some strange reason.

Yes I am logging into my Microsoft Account. Mi licence is valid as far as I know. The registration is in my bios.

Just now, SnoopZ said:

Has it happened again since you stopped it downloading an insider build?

The lag, yes but Explorer has not crashed since I got rid of the insiders build.