Jump to content

WIndows system apps crashing, mouse clicks odd, but virus scans clean


Recommended Posts

Is this what you are asking for?  i found the calc.exe problem, along with many of the others that have been failing.  on checking details, seems like most are faulting with twinui.appcore.dll, except for phone, which faulted with mrt100_app.dll.  they definitely started on Nov 24th, same time as when i installed corel.  The graphic shows 11/24, where it started failing right after a successful install at 11:02 pm.  (note, the failure on 11/21 was not related).  it says it installed the update manager at that point, which was that installshield program that i think is not good, even if it was in the past, maybe it messed with windows 10.  https://www.neuber.com/taskmanager/process/issch.exe.html  

i saw on one site that you should run SFC /scannow from recovery mode, maybe its not able to find or fix errors in this dll file while in normal mode?

 

calc.exe and others relability error report.zip

Link to post
Share on other sites

tried all the suggestions in https://thegeekpage.com/solved-windows-10-calculator-not-working/, again, to no avail.  there was a new windows update (December 8, 2020—KB4592449) that went thru the  full motions, thought it might do something, but everything is still the same.  

I tried to see what would happen by renaming the faulting dll twinui.appcore.dll, but it wouldnt let me do it, even from a command prompt in safe mode.  The thought was that sfc or dism would see it was missing and replace it.  regardless, the date stamp is still older, around the time when i first got the PC a month ago, so it wouldnt appear that it was changed by anything.  

sigh.  at least im still functioning on all aspects except for these microsoft apps, the main start menu, search functions and some odd mouse click failures on the task bar.  I know i could reset the PC but so would rather find a true solution.  

Link to post
Share on other sites

  • Root Admin

Please see if the following helps any for those WER logs

https://docs.microsoft.com/en-us/windows/deployment/upgrade/windows-error-reporting

Also, check and see if Application Dump is setup
https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps

 

Link to post
Share on other sites

  • Root Admin
1 hour ago, jspencer said:

i had to take ownership from Trusted Installer, then i could rename it,  and SFC /scannow did repair/replace it.  but no difference.  tried some other ones that showed up in the WER file, but there's too many to try them all

In general from RE one shouldn't need to take ownership like that. The Admin account in most cases can override permissions, but in some cases I think you are correct. There is a tool that can help do that regardless, but it's not currently updated for the latest version of Windows and can be a very dangerous tool if used improperly.

 

Link to post
Share on other sites

  • Root Admin

Do you have a FULL image backup of the system to an external USB drive?

Macrium Reflect has a free version that can do a full system image backup. That way we could get a bit more aggressive and explore other options too.

Backup Software
https://forums.malwarebytes.org/index.php?/topic/136226-backup-software


Macrium Reflect discussion
https://forums.malwarebytes.com/topic/264011-backup-files-software-which-one-to-choose-2020/?tab=comments#comment-1408188

 

Link to post
Share on other sites

Hi, thanks for the suggestion.  def will consider getting a high capacity USB and doing an image backup.  kills me that i didnt have system restore in place, just kind  of forgot about it and assumed windows 10 was better at fixing itself.  Let me think about next steps.  Technically, i could do a windows reset with keeping my data, and then just deal with reinstalling all my software, seems like the next best step, considering that none of the others have worked.  So strange though, to be as broken as it is for these few programs, but showing no sign of malware, nor no ability for windows to fix itself, even though the tools like sfc, dism, and powershell re-registering would appear to be just the ticket.  I hate giving up, seems like you never learn that way, but its getting kind of old at this point.  thanks again for humoring me on this, you've gone way beyond the call of duty here.  

re wer logs and user dumps, the first link didnt offer much insight, the second, not sure what a dump would give me.  

Is there any way to be able to trace all of the DLLs that get kicked of when something like Calc.exe gets started...i could try to remove/replace them like i did the main twinui.appcore.dll  (which def required taking ownership from trusted installer, even in safe mode admin couldnt modify it.

cheers :)

Link to post
Share on other sites

Maybe what happened is similar to what happened with updates a year ago, at least the symptoms sound familiar.  Maybe the installsheild messed up some of the more recent updates such that an old problem came back.  https://answers.microsoft.com/en-us/windows/forum/windows_10-start-win_taskbar/unable-to-right-click-task-bar-items-in-windows-10/8d392815-af3e-44c0-a0e6-341e84532baa  

in other words, an old MS problem that returned coincident with an old program install.   now if i could only turn the clock back on updates and restore them, but i think it only goes back so far...

 

Link to post
Share on other sites

funny thing, probably not related, but would be a kick if it was - i installed a SolarWinds bandwidth monitor in October, a month before this mess.  I can't imagine that the malware that eluded all the best corporate and government network protections was also part of the free offerings from SolarWinds.  If it was, certainly would explain how no scans are finding anything.  But then again, if it was this hidden spyware, it wouldn't be so obviously screwing up my system.  

Link to post
Share on other sites

  • Root Admin

Registry corruption can certainly account for the issues and would also explain why a new user account did not fix the issue either. Normally a new user account fixes these odd issues too.

Generally speaking a DMP file would not help as it's designed to work when a program hangs or crashes to the point it either creates the dump file or you for it while it's running.

I'm not saying it's not possible to try to track it down and fix it but we're not a training school either so we don't have unlimited time to go through all the possibilities when a reinstall of Windows from scratch is done in 15 minutes. Then installing your apps and customizing is perhaps a day. We've already spent nearly a month on this.

The complexity of finding, preventing, and cleanup from malware
https://forums.malwarebytes.com/topic/130154-the-complexity-of-finding-preventing-and-cleanup-from-malware/

Then, going forward, having external backups is very important as one cannot rely on System Protection from Windows 10 to come to the rescue all the time either.

Backup Software
https://forums.malwarebytes.org/index.php?/topic/136226-backup-software


Macrium Reflect discussion
https://forums.malwarebytes.com/topic/264011-backup-files-software-which-one-to-choose-2020/?tab=comments#comment-1408188

 

 

Link to post
Share on other sites

hi, yes, thanks so much for the time and effort.  I will do a clean reset (hopefully first with all my data in place), but otherwise i do have cloud backup for that already in case i have to wipe the machine, just not an image backup.  Going forward, i will first be sure system restore is on (it is now, but only after the problem started), get an image backup to USB, and otherwise stay away from pirated software.  

At the end of the day, not finding a clear source of the problem, or trace of any malware, is frustrating- it always feels better when you know the answer. 

I'm going to try some of the suggestions on this page: https://thegeekpage.com/fix-corrupted-registry-in-windows-10-solved/  and maybe that will help.  

Other than that, again, thanks for the effort.  I read your post about cleaning up after malware infections and i hope that this particular one wasn't too frustrating on you to try and decipher.  

Once i have a solution, i will post again...may be a while since i need to keep working before blocking out the time to reset everything.  

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.