Win 10, Windows Problem Reporting & Explorer Freezing every night

Guys since about a week or two (after the big Windows 10 update in October) I have been having an issue with my Samsung laptop where it freezes at exactly 01:07 AM every night, if I am still on my computer.


I have not installed anything new nor unusual over the past month. This issue has been frustrating me and puzzling me for the last two weeks. Finally last night I closed almost all applications and waited until 01:07 AM to take some photos from the Windows Process Messenger.


Sorry for the weird tint in my photos. That's FLUX running. I forgot to quit that before taking photos.


It turns out at exactly 01:07 AM there are hundreds of instances of "wermgr.exe" "Windows Problem Reporting" suddenly starting to run and then closing.
https://imgur.com/a/o64FL


The CPU is showing between "100%" - "110%" utilization when this happens.
https://imgur.com/a/84qvB


Perhaps most importantly, explorer.exe seems to be the main culprit? It's showing Threads "834 running" starting at 01:07 AM.
https://imgur.com/a/ve5Tp


I don't know if it's just because of the recent Windows updates because nobody else seems to be having this issue. Also, somehow the recent Windows update seemed to have automatically automatically 'fixed' an issue that I was having before the update with font size and readability. I'm afraid of having to go back to how it was before (that may be a Samsung issue).


My laptop is the 2017 top of the line Samsung 15" ultrabook.. just FYI. It's got 16 GB RAM, 7th gen i7 processor.

Lets found out if Wermgr.exe is located in the C:\Windows\System32 folder.

Open the Command Prompt as a administrator by typing cmd.exe into Start Menu.

Execute following command:

Code:

Dir  /s  /b  /a C:\Wermgr.exe | Clip

Above command output will be copied to Windows clipboard at your next post right click empty spot and select Paste.


Scan with Autoruns

Please download Autoruns by Sysinternals and save the file to your desktop.

• Right-click on the AutoRuns.exe icon and select Run as Administrator to start the tool.
• It is important that you do not use your machine while the tool is running.
• Wait patiently until the tool finishes its scanning. You will be notified with the Ready message in the lower left corner upon completion.
• Go to File menu and select Save.
• Make sure that the Save as type option is set to AutoRuns Data (*.arn) and the place to save will be your desktop. Name it somehow that you'll be able to identify it.

Please attach the file to your next post.
To attach it:

• After typing in your message, click More reply options instead of Post.
• below the post preview and the post editor, you should be able to see Attach files option - please click Choose file.
• in the pop-up window navigate to the desktop. Choose the one previously mentioned and attach it.

If the file will be to big to attach it (it may happen), then please host it on a Dropbox account or a site like mediafire.com, providing me the link to the uploaded file.

C:\Windows\System32\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.16299.15_none_4362de087708af13\wermgr.exe
C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.16299.15_none_4db7885aab69710e\wermgr.exe


for the .arm file... I get an error when I try to upload it.. yes, it's an "invalid file"

You need to place the .arn file into zip archive then you should able to upload the zip file.

FreeBooter said:

You need to place the .arn file into zip archive then you should able to upload the zip file.

Thank you for that quick explanation. Okay, I just added to a RAR and adding to this reply. Thank you!

I stayed awake last night on my laptop until 1:07 AM (I'm an expat living in Taiwan) to wait for the computer to freeze again to try to collect a bit more info. I'm not a computer expert, so this was the most information that I could collect.

I'm hoping this info will provide some clues to the experts out there who can help me solve this weird problem.

From Event Viewer (happening at 1:07 AM):
"The description for Event ID 32768 from source GeneStor cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.If the event originated on another computer, the display information had to be saved with the event.The following information was included with the event: [GeneStor] Fdo_EvtDeviceD0Entry: EnterElement not found"

and

"An account was successfully logged on.Subject: Security ID: SYSTEM Account Name: LAPTOP-IBU1LNC2$ Account Domain: WORKGROUP Logon ID: 0x3E7Logon Information: Logon Type: 5 Restricted Admin Mode: - Virtual Account: No Elevated Token: YesImpersonation Level: ImpersonationNew Logon: Security ID: SYSTEM Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000}Process Information: Process ID: 0x2ec Process Name: C:\Windows\System32\services.exeNetwork Information: Workstation Name: - Source Network Address: - Source Port: -Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0This event is generated when a logon session is created. It is generated on the computer that was accessed.The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.The impersonation level field indicates the extent to which a process in the logon session can impersonate.The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested."

and

"Fault bucket , type 0Event Name: WindowsNonFatalSuspectedDeadlockResponse: Not availableCab Id: 0Problem signature:P1: 2P2: UnknownP3: Geolocation.dllP4: GetGeopositionOperationImplP5: 420000P6: Windows:evices::Geolocation::GetGeopositionOperationImpl::InitializeAndStartP7: P8: P9: P10: Attached files:These files may be available here:C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_2_f2d98841ee2bcd5605336a51b6717816 48283_00000000_16070609Analysis symbol: Rechecking for solution: 0Report Id: 646d8b24-eb66-4905-b870-1ee99dc98d0fReport Status: 4Hashed bucket:"


I'm also attaching more screenshots of what started to happen with my CPU at 1:07 AM.

upup

I have check the Autoruns log and i did not notice any scheduled task that will freeze your computer at given time.

Try disabling the Windows Error Reporting service:

Press the Windows key + R to open a Run box.

Type services.msc

Press Enter.

Scroll down to the Windows Error Reporting service. Double-click it, Stop it and Disable it.

FreeBooter said:

I have check the Autoruns log and i did not notice any scheduled task that will freeze your computer at given time.

Okay, I'll try this first.

Do you have any idea what could be causing the error in the first place? I mean, which app or Windows service, etc? If I could take out the "root cause" I think that would be the next step.
Try disabling the Windows Error Reporting service:

Press the Windows key + R to open a Run box.

Type services.msc

Press Enter.

Scroll down to the Windows Error Reporting service. Double-click it, Stop it and Disable it.

[QUOTE=FreeBooter;1204695]I have check the Autoruns log and i did not notice any scheduled task that will freeze your computer at given time.

Okay, I'll try this first.

Do you have any idea what could be causing the error in the first place? I mean, which app or Windows service, etc? If I could take out the "root cause" I think that would be the next step.

I think its Windows Error Reporting service causing high CPU usage which could be the reason your computer freeze.