jspencer

hi, yes, thanks so much for the time and effort. I will do a clean reset (hopefully first with all my data in place), but otherwise i do have cloud backup for that already in case i have to wipe the machine, just not an image backup. Going forward, i will first be sure system restore is on (it is now, but only after the problem started), get an image backup to USB, and otherwise stay away from pirated software. At the end of the day, not finding a clear source of the problem, or trace of any malware, is frustrating- it always feels better when you know the answer. I'm going to try some of the suggestions on this page: https://thegeekpage.com/fix-corrupted-registry-in-windows-10-solved/ and maybe that will help. Other than that, again, thanks for the effort. I read your post about cleaning up after malware infections and i hope that this particular one wasn't too frustrating on you to try and decipher. Once i have a solution, i will post again...may be a while since i need to keep working before blocking out the time to reset everything.

funny thing, probably not related, but would be a kick if it was - i installed a SolarWinds bandwidth monitor in October, a month before this mess. I can't imagine that the malware that eluded all the best corporate and government network protections was also part of the free offerings from SolarWinds. If it was, certainly would explain how no scans are finding anything. But then again, if it was this hidden spyware, it wouldn't be so obviously screwing up my system.

Maybe what happened is similar to what happened with updates a year ago, at least the symptoms sound familiar. Maybe the installsheild messed up some of the more recent updates such that an old problem came back. https://answers.microsoft.com/en-us/windows/forum/windows_10-start-win_taskbar/unable-to-right-click-task-bar-items-in-windows-10/8d392815-af3e-44c0-a0e6-341e84532baa in other words, an old MS problem that returned coincident with an old program install. now if i could only turn the clock back on updates and restore them, but i think it only goes back so far...

Hi, thanks for the suggestion. def will consider getting a high capacity USB and doing an image backup. kills me that i didnt have system restore in place, just kind of forgot about it and assumed windows 10 was better at fixing itself. Let me think about next steps. Technically, i could do a windows reset with keeping my data, and then just deal with reinstalling all my software, seems like the next best step, considering that none of the others have worked. So strange though, to be as broken as it is for these few programs, but showing no sign of malware, nor no ability for windows to fix itself, even though the tools like sfc, dism, and powershell re-registering would appear to be just the ticket. I hate giving up, seems like you never learn that way, but its getting kind of old at this point. thanks again for humoring me on this, you've gone way beyond the call of duty here. re wer logs and user dumps, the first link didnt offer much insight, the second, not sure what a dump would give me. Is there any way to be able to trace all of the DLLs that get kicked of when something like Calc.exe gets started...i could try to remove/replace them like i did the main twinui.appcore.dll (which def required taking ownership from trusted installer, even in safe mode admin couldnt modify it. cheers

i had to take ownership from Trusted Installer, then i could rename it, and SFC /scannow did repair/replace it. but no difference. tried some other ones that showed up in the WER file, but there's too many to try them all

tried all the suggestions in https://thegeekpage.com/solved-windows-10-calculator-not-working/, again, to no avail. there was a new windows update (December 8, 2020—KB4592449) that went thru the full motions, thought it might do something, but everything is still the same. I tried to see what would happen by renaming the faulting dll twinui.appcore.dll, but it wouldnt let me do it, even from a command prompt in safe mode. The thought was that sfc or dism would see it was missing and replace it. regardless, the date stamp is still older, around the time when i first got the PC a month ago, so it wouldnt appear that it was changed by anything. sigh. at least im still functioning on all aspects except for these microsoft apps, the main start menu, search functions and some odd mouse click failures on the task bar. I know i could reset the PC but so would rather find a true solution.

no issue found in safe mode for dism and sfc

Is this what you are asking for? i found the calc.exe problem, along with many of the others that have been failing. on checking details, seems like most are faulting with twinui.appcore.dll, except for phone, which faulted with mrt100_app.dll. they definitely started on Nov 24th, same time as when i installed corel. The graphic shows 11/24, where it started failing right after a successful install at 11:02 pm. (note, the failure on 11/21 was not related). it says it installed the update manager at that point, which was that installshield program that i think is not good, even if it was in the past, maybe it messed with windows 10. https://www.neuber.com/taskmanager/process/issch.exe.html i saw on one site that you should run SFC /scannow from recovery mode, maybe its not able to find or fix errors in this dll file while in normal mode? calc.exe and others relability error report.zip

thanks, sure is a lot of stuff going on. attached is a log file after running Calc.exe Logfile.zip

Thanks, my thoughts exactly, find a simple program that's not working, like calc.exe. The behavior in Process Explorer is the same as for the other windows apps, like SearchUI and Phone...basically it starts up (green), but the werfault.exe is already in play, and then a second or so later, it all turns red and disappears. So its like theres something in the hosting svchost.exe process that is not allowing it to start? but clearly, that same process is running other apps, and the whole thing has lots more instances it can keep tapping. considering that so much else is running fine, one would think there is a magic bullet solution to this, no? re smartbyte, i gather that can cause issues around connectivity, but i didn't see any issues relating to apps crashing. My speed is ok, i am on a cell phone hotspot, which maybe is the target they made that program for.

(dupe w attachments )so ran MBST and rebooted, no problems found. then ran FRSTEnglish.exe that downloaded with the MBST program did actually run on the machine, attached are the log files. I noticed in the addition.txt that there was a block on a strange looking EXE file in the temp folder: Controlled Folder Access blocked C:\Users\jwalt\AppData\Local\Temp\{EE61B842-065E-46D1-A896-01D79931C510}\{64D4E1DA-8D7D-4209-92BF-D26453A19570}.exe from making changes to memory. when i tried to open the folder in Explorer, it wouldnt let me in, even with admin rights and taking ownership. But the cmd line did allow it, but there was nothing there. I deleted all the files in the temp folder, including this odd one, am rebooting now. Addition.txt FRST.txt

so ran everything, no problems found. the FRSTEnglish.exe that downloaded with the MBST program did actually run on the machine, attached are the log files. I noticed in the addition.txt that there was a block on a strange looking EXE file in the temp folder: Controlled Folder Access blocked C:\Users\jwalt\AppData\Local\Temp\{EE61B842-065E-46D1-A896-01D79931C510}\{64D4E1DA-8D7D-4209-92BF-D26453A19570}.exe from making changes to memory. when i tried to open the folder in Explorer, it wouldnt let me in, even with admin rights and taking ownership. But the cmd line did allow it, but there was nothing there. I deleted all the files in the temp folder, including this odd one, am rebooting now.

Hi, thanks again for your continued support. Windows troubleshooter found no issues with search. The service itself runs ok, there was a 900mb edb file that had recent timestamps on it. I set the reset flag in the registry, and restarting the indexer is now creating a clean index slowly. I did the disablebingsearch test, am rebooting now to see. after that, will run the MBST tool. I did notice that FRST.exe popped up as one of the installation files when i ran the MBST install, will be interesting to see if that runs ok under the MBST program. As far as I tried before, it would not run at all on my machine. Booting now...

hi, i have had malwarebytes installed since i first got the computer, thanks, have used it for many years. Which is why i thought I was ok after scanning the download. its possible its not malware, but just a screwup on the installshield program that kept Corel draw updated, but because it was circa 2007 it messed with Windows Update. On different forums, people seemed to have similar problems with Windows apps not working that have symptoms like mine, but there wasn't any real solution other than reinstall/reset windows. Nothing like chasing red herrings (i have tried the different re-register apps procedures, like the powershell Get-AppxPackage -allusers | foreach {Add-AppxPackage -register “$($_.InstallLocation)appxmanifest.xml” -DisableDevelopmentMode} routine). I guess resetting windows is my next move, since it doesn't appear that there is any virus on the system, thanks for helping to confirm that. I always look for the actual fix vs the resetting from scratch, and figured windows 10 would have known how to heal itself using the SFC and DISM routines, but I guess we are still not there yet. What is really weird is how almost everything still functions ok, except for basic windows apps like calc or search, or the start menu, or the right click on task bar items...I've never seen anything like it. I have been able to still work on the computer just fine, figuring out different workarounds (even using the cmd line search to find files!) BTW, windows update reports that it is still waiting to update to v2004, which apparently is not supported using my computer's hardware (it's a new Dell Inspiron 7791) I will try a few more things before resetting, but if I have to do that, I will let you know what happens. Thanks again for your support.

Hi, thanks again for continuing to find other ways to scan the system. attached is my TMC1.arn file after a full scan as directed. I noticed the Protexis licensing service running from the program files(86)/common files directory. As per search, this is related to the Corel Draw program i tried to install, so it makes sense it is there (along with a 2006 datestamp on the file). the original installshield directory was renamed to XXX_installshield_XXX, so any of those programs are not running (see registry entries that are still calling for them). Also, to be clear, i did try and run a keygen crack on the corel installation, which does scan as a Riskware.tool.CK program by malware bytes, so it clearly could be a source, but theres no indication on how to fix any resulting problem if we can't detect them. I mean, if it was doing anything active, it would show up in scans, or if it broke some windows file, then SFC or DISM should have been able to detect fix? TMC1.zip