Taskbar+ Notification icons+Defender: Problems!

Terry Pinnell wrote:

Andy Burns wrote:

You could try creating a new user, logging in as that and seeing if the
problems persist ...

If it did not display the problem, what's the next step?

Copy all the files, bookmarks, address books, etc
across to c:\users\newaccount
grant permissions to the new account, and delete the old one ...

Paul wrote:

Terry Pinnell wrote:

I used an empty external 2TB USB HD as destination for my Macrium image,
so the answer now is probably no. (But how would I have made that a boot
drive anyway?)

Any thoughts on the non-working Apps? How to get them all back?

I'm not Superman - I don't have the golden touch.

I would be as baffled by all this as you are.
Even if I was sitting in front of the machine, this OS is
a hulking monster of complexity, and my analytical skills
are only as good as my understanding of the component parts.

No single component immediately stands out as a candidate
for repair/tweaking. The display manager is running, but
something important underneath is borked, and I don't know
what until some breadcrumbs (like from Event Viewer) wave
hello to me. And you know how much "noise" is in there.

*******

You could re-use the external drive.

But, you need a way to prepare it.

From the current broken OS, you'd use "shrink"
on the backup partition. You need to make enough
room, so the restored partition(s) can fit.

Then, you can do the restore at your leisure.

If it wasn't actual malware, you could restore the
partitions inside the MRIMG, one partition at a time.
In the Restore dialog, you drag and drop the restore C
next to the backup partition. After the Restore is
complete, you drag and drop the Recovery partition
next to the restored C: . You work "a brick at a time",
subject to the limits on how many partitions you can
have on a drive. The three shown in the picture, fit
within the limit of four primary partitions on an MSDOS
partitioned disk. If your materials are GPT, the diagram
will look different. I don't have a lot of experience with
GPT setups. (GPT is used for quick experiments here, then
discarded.)

+------+--------------------------------+-------------------------------------+----------+ - -
| MBR | (Shrunk down backup partition) | Restored C: with Active (boot) Flag | Recovery |
+------+--------------------------------+-------------------------------------+----------+ - -

OK, shut down. Remove the internal drive to avoid
surprises. Leave the external drive connected.

Boot the Macrium Emergency Boot CD and use the
"Boot Repair" option from the menu.

Macrium will query you, by placing a list of candidate
partitions in the dialog. There should be only
one showing at this time. Hopefully it points
to the C: partition.

Windows boot relies on the Active (boot) flag.
That is how the code in the MBR, figures out
where the winload.exe and the BCD and \boot
are located.

On Windows 7, a partition called System Reserved
might have the boot flag. And it might contain the
\boot and BCD and so on. It's possible for a number
of modern Windows OSes to be split on two partitions.
(The two-partition split was intended to support
Bitlocker encryption of the entire C: , leaving System
Reserved boot materials unencrypted.)

My Win10 today appears to use one partition, but it
has an excessive number of "Recovery Partitions", which
should not figure into the boot process as such.

The Macrium boot repair should be able to:

1) Reload the MBR boot code.
2) Reload the partition boot sector in C:
3) Randomly assign GUIDs to the partitions. The GUIDs might
actually be stored in the Registry on C: . Making new GUID
values, prevents collisions with other hard drives.
4) Recompute the BCD boot information. By only having the
target disk present, there is zero chance of "entangling"
the wrong disk drive(s).

Once the Boot repair is done, closing Macrium
will reboot the machine. I either park the machine
by entering the BIOS, or park it by pressing F8
for the popup boot menu. Both of those options
seem to leave the hard drive in a safe state.

Now, I turn off the power, move the external drive
inside the machine.

Note: This is only practical if the external is in a
removable case, so you can move the drive
inside the machine. Then boot, and enjoy.

It is possible to "restore-by-parts" and cook up a
bootable image. You could do it...

Paul


After peering again into the murky depths of Event Viewer, my focus is
on the following. Hope it might spark some insights. Googling of
backgroundTaskHost has so far given me none.
https://www.dropbox.com/s/xirgo4i4dk...st-1.jpg?raw=1
https://www.dropbox.com/s/9ttxz692zd...rror.jpg?raw=1

Terry, East Grinstead, UK

Terry Pinnell wrote:
Andy Burns wrote:

Terry Pinnell wrote:

After many hours of research (not counting last night's dreams) I'm
still hopelessly lost.
You could try creating a new user, logging in as that and seeing if the
problems persist ...


Yep, but from my last post:
"4. Amongst many avenues of pursuit this morning I could change user
account to 'local account'. Last time I did that years ago it solved a
problem but left me with it in my main account, so don't see much point
in wasting time."

If it did not display the problem, what's the next step?


Terry, East Grinstead, UK

Switching to an empty account for a moment, potentially
tells you whether the problem "follows" the account
or the problem "follows" the system.

The question remains though, what to do with the information.

*******

Some people are quite comfortable copying portions
of one profile to another. This sounds like work :-)

I'm willing to believe they become comfortable, if
it means the original account is not getting damaged.

On the one hand, you could "keep" the empty user registry portion
of a new account, and import the data portion to go with it.

If you copied the entire profile, using the "Copy To..."
in System : Advanced : User Profiles : Copy To , wouldn't
that just cause the problem to come back ? I presume
"Copy To..." exists as a means to do name changes.

I checked mine (the "Copy To") in Windows 10, and
the first problem is the listed size is wrong. It
could be missing the AppData chunk in its math,
but that might only approximately correlate
with the amount shown. There's really no situation
in Windows any more, where a size agrees with what
you might have expected (you have 70GB of data, and
a File Explorer window actually reads "70GB"). It's
like winning the lottery. Never seems to happen.

There are commercial tools for profile movement,
and their marketing department seem to be able to
spot questions and post their commercial blurb
pretty damn quick. So when you see a tool mentioned
over and over again, that's marketing monkeys.

Paul

On Thu, 01 Nov 2018 12:25:49 +0000, Terry Pinnell
wrote:

After peering again into the murky depths of Event Viewer, my focus is
on the following. Hope it might spark some insights. Googling of
backgroundTaskHost has so far given me none.
https://www.dropbox.com/s/xirgo4i4dk...st-1.jpg?raw=1
https://www.dropbox.com/s/9ttxz692zd...rror.jpg?raw=1

TIP: When using Event Viewer, remember to use the "Filter Current Log.."
function over in the Application pane on the right side of the screen.
You can greatly reduce the noise and the murkiness.

For example, start with putting a check mark in the Critical box, then
click OK. Hopefully, you don't have any events in the Critical category,
so go back to Filter Current Log and add a check to the Error box, then
click OK. Now you're seeing just the Error type of events, without all
of the noise of the Information events. When you see an interesting
event and you want to see other events of the same type, go back to
Filter Current Log and type the Event ID in the relevant box, then click
OK. Now you're seeing just this one type of event, and you'll be in a
better position to judge whether it's a new condition or it's been
existing long before your current problem started, for example.

Any time you go to Event Viewer, Filter Current Log is your best friend.

Char Jackson wrote:

On Thu, 01 Nov 2018 12:25:49 +0000, Terry Pinnell
wrote:

After peering again into the murky depths of Event Viewer, my focus is
on the following. Hope it might spark some insights. Googling of
backgroundTaskHost has so far given me none.
https://www.dropbox.com/s/xirgo4i4dk...st-1.jpg?raw=1
https://www.dropbox.com/s/9ttxz692zd...rror.jpg?raw=1

TIP: When using Event Viewer, remember to use the "Filter Current Log.."
function over in the Application pane on the right side of the screen.
You can greatly reduce the noise and the murkiness.

For example, start with putting a check mark in the Critical box, then
click OK. Hopefully, you don't have any events in the Critical category,
so go back to Filter Current Log and add a check to the Error box, then
click OK. Now you're seeing just the Error type of events, without all
of the noise of the Information events. When you see an interesting
event and you want to see other events of the same type, go back to
Filter Current Log and type the Event ID in the relevant box, then click
OK. Now you're seeing just this one type of event, and you'll be in a
better position to judge whether it's a new condition or it's been
existing long before your current problem started, for example.

Any time you go to Event Viewer, Filter Current Log is your best friend.

Thanks, appreciate those handy tips.

Terry, East Grinstead, UK

Success!

Pleased to report that the problems with Taskbar, Tray icons,
Notification icons and MS 'Metro' Apps all appear to have been fixed ;-)

In an elevated Powershell window I used:
Get-AppXPackage | Foreach {Add-AppxPackage -DisableDevelopmentMode
-Register "$($_.InstallLocation)\AppXManifest.xml"

Whether that 'fix' also solves the torrent of Event errors remains to be
seen. I'm not going to risk looking for a while. That troubleshooting
cost me the best part of two days

I've saved an SR of the cleaned up system, FWIW (I no longer much trust
that facility) and deleted all previous ones.

Now I'll setup my second Macrium image, with a schedule.

Thanks to all, especially Paul, for all the help.

Terry, East Grinstead, UK

Terry Pinnell wrote:
Success!

Pleased to report that the problems with Taskbar, Tray icons,
Notification icons and MS 'Metro' Apps all appear to have been fixed ;-)

In an elevated Powershell window I used:
Get-AppXPackage | Foreach {Add-AppxPackage -DisableDevelopmentMode
-Register "$($_.InstallLocation)\AppXManifest.xml"

Whether that 'fix' also solves the torrent of Event errors remains to be
seen. I'm not going to risk looking for a while. That troubleshooting
cost me the best part of two days

I've saved an SR of the cleaned up system, FWIW (I no longer much trust
that facility) and deleted all previous ones.

Now I'll setup my second Macrium image, with a schedule.

Thanks to all, especially Paul, for all the help.

Terry, East Grinstead, UK


Reinstalling them was enough ?

I'm shocked.

So it could have been one of the databases then.

Have you needed to do a CHKDSK lately on the SSD ?

Paul

Paul wrote:

Terry Pinnell wrote:

Success!

I'm shocked.
I *almost* recommended that command, as I remember it fixed missing
start tiles on a whole classroom of machines (after the 1511 upgrade?)
but it seemed too random to be worth suggesting ...

Andy Burns wrote:
Paul wrote:

Terry Pinnell wrote:

Success!

I'm shocked.
I *almost* recommended that command, as I remember it fixed missing
start tiles on a whole classroom of machines (after the 1511 upgrade?)
but it seemed too random to be worth suggesting ...

But that problem was supposed to be fixed.

Or something.

The display manager and desktop environment on this OS,
is entirely too creaky.

It's even possible, by reinstalling the Apps, that some
malware got flushed. Even though the Apps are supposed
to be signed.

And for the reinstall to work, those XML manifests would
have to be undamaged. How does the system fluff those up ?

Paul

Paul wrote:

Terry Pinnell wrote:
Success!

Pleased to report that the problems with Taskbar, Tray icons,
Notification icons and MS 'Metro' Apps all appear to have been fixed ;-)

In an elevated Powershell window I used:
Get-AppXPackage | Foreach {Add-AppxPackage -DisableDevelopmentMode
-Register "$($_.InstallLocation)\AppXManifest.xml"

Whether that 'fix' also solves the torrent of Event errors remains to be
seen. I'm not going to risk looking for a while. That troubleshooting
cost me the best part of two days

I've saved an SR of the cleaned up system, FWIW (I no longer much trust
that facility) and deleted all previous ones.

Now I'll setup my second Macrium image, with a schedule.

Thanks to all, especially Paul, for all the help.

Terry, East Grinstead, UK


Reinstalling them was enough ?

I'm shocked.

So it could have been one of the databases then.

Have you needed to do a CHKDSK lately on the SSD ?

Paul

No, CHKDSK was still on the dwindling 'try this too' list.

I still haven't rebooted since problem resolution. But I have two
Macrium images standing by. I dusted off an oldish 2TB WD Elements on
which to accumulate them. Now wondering if it would be prudent to back
THOSE up...

Terry, East Grinstead, UK

Terry Pinnell wrote:
Paul wrote:

Terry Pinnell wrote:
Success!

Pleased to report that the problems with Taskbar, Tray icons,
Notification icons and MS 'Metro' Apps all appear to have been fixed ;-)

In an elevated Powershell window I used:
Get-AppXPackage | Foreach {Add-AppxPackage -DisableDevelopmentMode
-Register "$($_.InstallLocation)\AppXManifest.xml"

Whether that 'fix' also solves the torrent of Event errors remains to be
seen. I'm not going to risk looking for a while. That troubleshooting
cost me the best part of two days

I've saved an SR of the cleaned up system, FWIW (I no longer much trust
that facility) and deleted all previous ones.

Now I'll setup my second Macrium image, with a schedule.

Thanks to all, especially Paul, for all the help.

Terry, East Grinstead, UK

Reinstalling them was enough ?

I'm shocked.

So it could have been one of the databases then.

Have you needed to do a CHKDSK lately on the SSD ?

Paul

No, CHKDSK was still on the dwindling 'try this too' list.

I still haven't rebooted since problem resolution. But I have two
Macrium images standing by. I dusted off an oldish 2TB WD Elements on
which to accumulate them. Now wondering if it would be prudent to back
THOSE up...

Terry, East Grinstead, UK


I would not conclude the problem is fixed, until you've
tried at least one reboot, and seen whether some Startup
item is damaging stuff. If you have a backup in hand, you
should be able to carry out that test.

*******

I don't know about you, but I haven't had a complete
hard drive failure in years. What I find, is some
drives are showing "Reallocations". Which hints
there might be surface problems inside the drive.
But I've had some drives in that state for 3-5 years,
and they still haven't died.

I used to have trouble with Maxtors, but the drives that
died in about 24 hours from "first click", those were
40GB drives. Failures before that, was a head lock
that failed on a 32550N (2GB) hard drive. The head lock
caused the arm to be ground into the platter, leaving
a gouge mark :-) Neat :-) They don't do head locks
like that any more, so there is nothing to fear
on modern drives.

You can fret about Ransomware if you want, and plan
a zillion disk drive copies to give some protection
against attacks of that sort.

But for hardware failures, I've been pretty lucky here.

My drive with the "most hours" on it, is a 500GB Seagate
with 42000 hours. And it has no Reallocations showing
so far, and the benchmark transfer curve still looks
good. I have copies of that drive in my backup collection.
The drive will likely outlast them :-)

Paul

Paul wrote:

I still haven't rebooted since problem resolution. But I have two
Macrium images standing by. I dusted off an oldish 2TB WD Elements on
which to accumulate them. Now wondering if it would be prudent to back
THOSE up...

Terry, East Grinstead, UK


I would not conclude the problem is fixed, until you've
tried at least one reboot, and seen whether some Startup
item is damaging stuff. If you have a backup in hand, you
should be able to carry out that test.


Pleased to report all OK after a reboot.

Terry, East Grinstead, UK