• Sign in to Neowin Faster!

    Create an account on Neowin to contribute and support the site.

Could this be malware?

Recommended Posts

devnulllore    33

Ok I will try it again

Share this post


Link to post
Share on other sites
sc302    1,735
14 minutes ago, devnulllore said:

Please tell me how? I have used this tool before and saw n o option to make an x64 image.

 

 

 

  • Like 1

Share this post


Link to post
Share on other sites
devnulllore    33

Ok, I just did another fresh install from a new 1903 build install disc. WInver says version 1903 (OS Build 18962.1000) I will let you know how it works.

Share this post


Link to post
Share on other sites
adrynalyne    12,141
8 minutes ago, devnulllore said:

Ok, I just did another fresh install from a new 1903 build install disc. WInver says version 1903 (OS Build 18962.1000) I will let you know how it works.

That’s an insider build...

Share this post


Link to post
Share on other sites
devnulllore    33
Just now, adrynalyne said:

That’s an insider build...

I followed the instructions to the letter and that's the build it gave me.

Share this post


Link to post
Share on other sites
Matthew S.    1,000

Regardless.. Issues still present?

Share this post


Link to post
Share on other sites
devnulllore    33

Yes and explorer has crashed three times.

Share this post


Link to post
Share on other sites
sc302    1,735

So being that you have reinstalled and are still having issues, can you drill into process explorer and see what the actual issue is?

 

I mean, we can take a bigger gun to it and just tell you to replace the system, there is always that option.  

 

I am not trying to be a jerk, but we haven't identified actual root cause...just something with explorer.exe is causing the issue.  Need to dig deeper.  It could be a driver or some other software (intel, crucial, etc) that is causing the issue.  The shot gun approach didn't fix this time.  We can attack it with a bigger gun and put the system out of its misery, or take out the scalpel and perform some surgery to remove the cancer.

Share this post


Link to post
Share on other sites
Vince800    256
1 hour ago, devnulllore said:

Ok, I just did another fresh install from a new 1903 build install disc. WInver says version 1903 (OS Build 18962.1000) I will let you know how it works.

Yes as Adrenalyn said that's an insider build so I have no idea what you're doing here. You mentioned in a previous thread that you keep getting upgraded to the Insider builds. What are you actually doing after you install Windows?

Share this post


Link to post
Share on other sites
devnulllore    33

I did nothing this time. That was what winver said immediately after installing.

Share this post


Link to post
Share on other sites
Vince800    256
Just now, devnulllore said:

I did nothing this time. That was what winver said immediately after installing.

When you ran the media creation tool did you use a USB Flash drive or just download an ISO file?

Share this post


Link to post
Share on other sites
devnulllore    33
Just now, Vince800 said:

When you ran the media creation tool did you use a USB Flash drive or just download an ISO file?

Downloaded and burned the ISO file

Share this post


Link to post
Share on other sites
Vince800    256
3 minutes ago, devnulllore said:

Downloaded and burned the ISO file

I find that most bizarre. Would you be able to put the DVD you burned and run the following command:

 

 dism /Get-WimInfo /WimFile:G:\sources\install.wim /index:1

 

Change G:\ to whatever your DVD drive letter is, then post the output of this command here. It may help to see if this is happening pre or post installation.

Share this post


Link to post
Share on other sites
devnulllore    33
Posted (edited)
7 minutes ago, Vince800 said:

I find that most bizarre. Would you be able to put the DVD you burned and run the following command:

 

 dism /Get-WimInfo /WimFile:G:\sources\install.wim /index:1

 

Change G:\ to whatever your DVD drive letter is, then post the output of this command here. It may help to see if this is happening pre or post installation.

C:\WINDOWS\system32>dism /Get-WimInfo /WimFile:H:\sources\install.wim /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1


Error: 2

The system cannot find the file specified.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

 

There is no install.wim file only boot.wim

 

Share this post


Link to post
Share on other sites
Vince800    256
31 minutes ago, devnulllore said:

C:\WINDOWS\system32>dism /Get-WimInfo /WimFile:H:\sources\install.wim /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1


Error: 2

The system cannot find the file specified.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

 

There is no install.wim file only boot.wim

 

Ah it may be an .esd file.

 

dism /Get-WimInfo /WimFile:H:\sources\install.esd /index:1

Share this post


Link to post
Share on other sites
devnulllore    33
29 minutes ago, Vince800 said:

Ah it may be an .esd file.

 

dism /Get-WimInfo /WimFile:H:\sources\install.esd /index:1

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Details for image : H:\sources\install.esd

Index : 1
Name : Microsoft Windows PE (x64)
Description : Microsoft Windows PE (x64)
Size : 1,692,329,773 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.18362
ServicePack Build : 239
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3704
Files : 16232
Created : 3/19/2019 - 12:10:55 AM
Modified : 8/20/2019 - 1:09:55 PM
Languages :
        en-US (Default)

The operation completed successfully.

Share this post


Link to post
Share on other sites
Riggers    181

Any errors in Event Viewer directly after it happening?

  • Like 1

Share this post


Link to post
Share on other sites
Vince800    256
25 minutes ago, devnulllore said:

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Details for image : H:\sources\install.esd

Index : 1
Name : Microsoft Windows PE (x64)
Description : Microsoft Windows PE (x64)
Size : 1,692,329,773 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.18362
ServicePack Build : 239
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3704
Files : 16232
Created : 3/19/2019 - 12:10:55 AM
Modified : 8/20/2019 - 1:09:55 PM
Languages :
        en-US (Default)

The operation completed successfully.

So the update must be happening after installation. Do you sign in with a local or Microsoft account. I'm just wondering if you're signing in with a Microsoft account in the Insider programme on a machine which doens't have a valid license for some strange reason.

Share this post


Link to post
Share on other sites
SnoopZ    261

Sounds like you have previously signed up to the Insider buiilds which probably means it will update to the latest Insider build?

Share this post


Link to post
Share on other sites
Vince800    256
5 minutes ago, SnoopZ said:

Sounds like you have previously signed up to the Insider buiilds which probably means it will update to the latest Insider build?

That shouldn't trigger an automatic update to the Insider programme without any manual intervention though.

 

To answer the actual question though, it's not malware.

Share this post


Link to post
Share on other sites
Brandon H    3,044
4 minutes ago, Vince800 said:

That shouldn't trigger an automatic update to the Insider programme without any manual intervention though.

 

To answer the actual question though, it's not malware.

correct; from all my personal re-installs I've never seen the insider builds enable themselves; If I want to use insider builds again I have to enable it manually in settings as always.

 

I have no idea why it keeps forcing OP onto insider builds; I'd recommend OP reach out to Microsoft Support at this point to determine why that particular thing keeps happening.

Share this post


Link to post
Share on other sites
+warwagon    13,116
36 minutes ago, Riggers said:

Any errors in Event Viewer directly after it happening?

correct, check the event viewer and look at the log entry for the application crash explorer.exe

 

I've seen it before were the onboard audio driver was killing explorer. It may have a dll or sys file in log entry telling you which file killed it.

Share this post


Link to post
Share on other sites
devnulllore    33

Ok, I did the only thing I can think of and did a new fresh install off the new disc and checked the winver immediately it reads version 1903 (OS Build 18362.295)

 

I found where to enable the insider program and it was enabled by default so I turned it off.

 

So I will monitor with process explorer and see if it happens again. Any other suggestions?

  • Like 1

Share this post


Link to post
Share on other sites
firey    3,924
1 hour ago, devnulllore said:

Ok, I did the only thing I can think of and did a new fresh install off the new disc and checked the winver immediately it reads version 1903 (OS Build 18362.295)

 

I found where to enable the insider program and it was enabled by default so I turned it off.

 

So I will monitor with process explorer and see if it happens again. Any other suggestions?

If you can get it to happen consistently, can you try recording it happen? Would be interesting to see what it is, if it's some sort of GPU window re-draw or if it's actually explorer reloading.

 

Are you restoring multiple files (images, documents, etc) when you complete an install?
Do all folders have this issue or is it only ones with many files?
If you have multiple monitors, does it happen on only one of them?
Do you have any devices plugged in (webcam, microphone, external hdd)? 
Have you tried googling the issue (possibly other forums, youtube, etc)?

Share this post


Link to post
Share on other sites
devnulllore    33
On 8/20/2019 at 4:14 PM, Riggers said:

Any errors in Event Viewer directly after it happening?

No

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.