After resolving a "group policy error" by resetting my password to my windows 10 desktop, after login I get a flashing dark grey screen with a partially populated task bar and a mouse cursor. nothing on the task bar works, but I can get to the task manager.
Steps I have taken so far:
disabled all services to perform a "clean boot"
cleared out the temp files.
Initially I noticed that Malware bytes was showing up in the task manager alone, but since switching to clean boot that was no longer running. (I have de-installed it anyway).
In the event log I see the following error:
Log Name: Application
Source: Application Error
Date: 2017-11-21 10:14:14 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: DESKTOP-RAMM34P
Description:
Faulting application name: explorer.exe, version: 10.0.16299.15, time stamp: 0x66e02565
Faulting module name: twinui.dll, version: 10.0.16299.15, time stamp: 0x427d4a3c
Exception code: 0x80270233
Fault offset: 0x000000000046df09
Faulting process id: 0xe14
Faulting application start time: 0x01d3633ff9c0c9cf
Faulting application path: C:\WINDOWS\explorer.exe
Faulting module path: C:\WINDOWS\system32\twinui.dll
Report Id: 58d4f652-b0cd-4175-98d1-afeea1a2c7f0
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-11-22T03:14:14.983011400Z" />
<EventRecordID>16201</EventRecordID>
<Channel>Application</Channel>
<Computer>DESKTOP-RAMM34P</Computer>
<Security />
</System>
<EventData>
<Data>explorer.exe</Data>
<Data>10.0.16299.15</Data>
<Data>66e02565</Data>
<Data>twinui.dll</Data>
<Data>10.0.16299.15</Data>
<Data>427d4a3c</Data>
<Data>80270233</Data>
<Data>000000000046df09</Data>
<Data>e14</Data>
<Data>01d3633ff9c0c9cf</Data>
<Data>C:\WINDOWS\explorer.exe</Data>
<Data>C:\WINDOWS\system32\twinui.dll</Data>
<Data>58d4f652-b0cd-4175-98d1-afeea1a2c7f0</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
followed by:
Fault bucket 120846877780, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: explorer.exe
P2: 10.0.16299.15
P3: 66e02565
P4: twinui.dll
P5: 10.0.16299.15
P6: 427d4a3c
P7: 80270233
P8: 000000000046df09
P9:
P10:
Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4729.tmp.WERInternalMetadata.xml
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_explorer.exe_3ccda2b1a2744dceef7e8c824619af31db48b8a8_e2eb9052_0f594987
Analysis symbol:
Rechecking for solution: 0
Report Id: f6e3c9cf-cb96-4f11-b4a6-3cf98acbac2d
Report Status: 268439552
Hashed bucket: 2344e17f1cb6fb26b6187619f00b9571
then:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: explorer.exe
P2: 10.0.16299.15
P3: 66e02565
P4: twinui.dll
P5: 10.0.16299.15
P6: 427d4a3c
P7: 80270233
P8: 000000000046df09
P9:
P10:
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_3ccda2b1a2744dceef7e8c824619af31db48b8a8_e2eb9052_000949e5
Analysis symbol:
Rechecking for solution: 0
Report Id: 99e0c03b-cc6b-4de8-be8b-3826e9d18d11
Report Status: 4100
Hashed bucket:
then finally:
- <Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="
Microsoft-Windows-Winlogon" Guid="
{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="
Winlogon" />
<EventID Qualifiers="
16384">1002</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="
2017-11-22T03:14:14.811117800Z" />
<EventRecordID>16200</EventRecordID>
<Correlation />
<Execution ProcessID="
0" ThreadID="
0" />
<Channel>Application</Channel>
<Computer>DESKTOP-RAMM34P</Computer>
<Security />
</System>
- <EventData>
<Data>explorer.exe</Data>
</EventData>
</Event>
The SFC and SURT/DISM scans ran cleanly.
The following is the SFCFix log:
SFCFix version 3.0.0.0 by niemiro.
Start time: 2017-11-21 22:27:26.253
Microsoft Windows 10 Build 16299 - amd64
Not using a script file.
AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.
Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2017-11-21 22:27:44.676
----------------------EOF-----------------------
the CBS folder is attached.
Any assistance would be appreciated.
Thanks
JD
