• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Windows Update does it again: Disappearing Desktop Icons

Joined
Feb 18, 2009
Messages
1,825 (0.33/day)
Location
Slovenia
System Name Multiple - Win7, Win10, Kubuntu
Processor Intel Core i7 3820 OC@ 4.0 GHz
Motherboard Asus P9X79
Cooling Noctua NH-L12
Memory Corsair Vengeance 32GB 1333MHz
Video Card(s) Sapphire ATI Radeon RX 480 8GB
Storage Samsung SSD: 970 EVO 1TB, 2x870 EVO 250GB,860 Evo 250GB,850 Evo 250GB, WD 4x1TB, 2x2TB, 4x4TB
Display(s) Asus PB328Q 32' 1440p@75hz
Case Cooler Master CM Storm Trooper
Power Supply Corsair HX750, HX550, Galaxy 520W
Mouse Multiple, Razer Mamba Elite, Logitech M500
Keyboard Multiple - Lenovo, HP, Dell, Logitech
Hello

After I updated a ton of security updates with care to only update the certain critical ones no anything else.


The hardcoded icons have disappeared during reboot, those icons that you drag out of start menu and it automatically creates it, and the network icon that you right-click in the start menu and select "show on desktop"

But there was also a freeze during the update process, when rebooted it re-do the stuff that it does at boot so i think it was fine , but the icon thing happend, it always has to be something.

I so hate the windows update, I haven't updated for half a year and now i did a manual careful update and I think i will never do it again for win7 EVER on this PC.

Icons keep disappearing after a certain period of days while several sessions passed. Let's say every 5 days or a week, 3 times now. I want to have my system stuff out like Control panel, add remove programs, all the sys stuff.


EDIT: Exact icons are "network" "sound" and "programs and features"

Found something it can be certain settings for icon cleanup

http://social.technet.microsoft.com.../thread/ada5d392-2af7-43c3-9191-08baf63f0098/

Stupid updates messing with my settings:mad:
 
Last edited:
Joined
Dec 2, 2009
Messages
3,351 (0.64/day)
System Name Dark Stealth
Processor Ryzen 5 5600x
Motherboard Gigabyte B450M Gaming rev 1.0
Cooling Snowman, arctic p12 x2 fans
Memory 16x2 DDR4 Corsair Dominator Pro
Video Card(s) 3080 10gb
Storage 2TB NVME PCIE 4.0 Crucial P3 Plus, 1TB Crucial MX500 SSD, 4TB WD RED HDD
Display(s) HP Omen 34c (34" monitor 3440x1440 165Hz VA panel)
Case Zalman S2
Power Supply Corsair 750TX
Mouse Logitech pro superlight, mx mouse s3, Razer Basiliskx with battery
Keyboard Custom mechanical keyboard tm680
Software Windows 11
Benchmark Scores 70-80 fps 3440x1440 on cyberpunk 2077 max settings
Do you have a program called "infrarecorder" installed?
 
Joined
Feb 18, 2009
Messages
1,825 (0.33/day)
Location
Slovenia
System Name Multiple - Win7, Win10, Kubuntu
Processor Intel Core i7 3820 OC@ 4.0 GHz
Motherboard Asus P9X79
Cooling Noctua NH-L12
Memory Corsair Vengeance 32GB 1333MHz
Video Card(s) Sapphire ATI Radeon RX 480 8GB
Storage Samsung SSD: 970 EVO 1TB, 2x870 EVO 250GB,860 Evo 250GB,850 Evo 250GB, WD 4x1TB, 2x2TB, 4x4TB
Display(s) Asus PB328Q 32' 1440p@75hz
Case Cooler Master CM Storm Trooper
Power Supply Corsair HX750, HX550, Galaxy 520W
Mouse Multiple, Razer Mamba Elite, Logitech M500
Keyboard Multiple - Lenovo, HP, Dell, Logitech

qubit

Overclocked quantum bit
Joined
Dec 6, 2007
Messages
17,866 (3.00/day)
Location
Quantum Well UK
System Name Quantumville™
Processor Intel Core i7-2700K @ 4GHz
Motherboard Asus P8Z68-V PRO/GEN3
Cooling Noctua NH-D14
Memory 16GB (2 x 8GB Corsair Vengeance Black DDR3 PC3-12800 C9 1600MHz)
Video Card(s) MSI RTX 2080 SUPER Gaming X Trio
Storage Samsung 850 Pro 256GB | WD Black 4TB | WD Blue 6TB
Display(s) ASUS ROG Strix XG27UQR (4K, 144Hz, G-SYNC compatible) | Asus MG28UQ (4K, 60Hz, FreeSync compatible)
Case Cooler Master HAF 922
Audio Device(s) Creative Sound Blaster X-Fi Fatal1ty PCIe
Power Supply Corsair AX1600i
Mouse Microsoft Intellimouse Pro - Black Shadow
Keyboard Yes
Software Windows 10 Pro 64-bit
Couple of things:

Disappearing icons during normal use is not something that Windows tends to do, so there's a problem somewhere on your system.

Leaving Windows Update for so long is asking for problems. Set the updater to download critical updates, but install only when you say so. This way, Windows will be kept up to date and the updates will be a lot smaller, reducing the chance of something going wrong.

So, what's infrarecorder?
 
Joined
Feb 18, 2009
Messages
1,825 (0.33/day)
Location
Slovenia
System Name Multiple - Win7, Win10, Kubuntu
Processor Intel Core i7 3820 OC@ 4.0 GHz
Motherboard Asus P9X79
Cooling Noctua NH-L12
Memory Corsair Vengeance 32GB 1333MHz
Video Card(s) Sapphire ATI Radeon RX 480 8GB
Storage Samsung SSD: 970 EVO 1TB, 2x870 EVO 250GB,860 Evo 250GB,850 Evo 250GB, WD 4x1TB, 2x2TB, 4x4TB
Display(s) Asus PB328Q 32' 1440p@75hz
Case Cooler Master CM Storm Trooper
Power Supply Corsair HX750, HX550, Galaxy 520W
Mouse Multiple, Razer Mamba Elite, Logitech M500
Keyboard Multiple - Lenovo, HP, Dell, Logitech
Icons disappeared after the update, i know it was one of te 80+ updates

The link i found on msdn is to audit the events that accounts do and i will hunt down which process does it. But they say this issue happens on monday, YES today is thursday and I was only logged in yesterday in morning for a short time and not again until today.

Damn you microsoft.

EDIT: I've set up the auditing for deleting and when it happens again it will trace what did it, need to wait a week or so.
 
Last edited:
Joined
Feb 18, 2009
Messages
1,825 (0.33/day)
Location
Slovenia
System Name Multiple - Win7, Win10, Kubuntu
Processor Intel Core i7 3820 OC@ 4.0 GHz
Motherboard Asus P9X79
Cooling Noctua NH-L12
Memory Corsair Vengeance 32GB 1333MHz
Video Card(s) Sapphire ATI Radeon RX 480 8GB
Storage Samsung SSD: 970 EVO 1TB, 2x870 EVO 250GB,860 Evo 250GB,850 Evo 250GB, WD 4x1TB, 2x2TB, 4x4TB
Display(s) Asus PB328Q 32' 1440p@75hz
Case Cooler Master CM Storm Trooper
Power Supply Corsair HX750, HX550, Galaxy 520W
Mouse Multiple, Razer Mamba Elite, Logitech M500
Keyboard Multiple - Lenovo, HP, Dell, Logitech
AHA Found it

Code:
A handle to an object was requested.

Subject:
	Security ID:		MUSTANG-PC7\Administrator
	Account Name:		Administrator
	Account Domain:		MUSTANG-PC7
	Logon ID:		0x33aa6

Object:
	Object Server:		Security
	Object Type:		File
	Object Name:		C:\Users\Administrator\Desktop\Network.lnk
	Handle ID:		0x228

Process Information:
	Process ID:		0x137c
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe

Access Request Information:
	Transaction ID:		{00000000-0000-0000-0000-000000000000}
	Accesses:		DELETE
				READ_CONTROL
				WRITE_DAC
				WRITE_OWNER
				SYNCHRONIZE
				ACCESS_SYS_SEC
				ReadData (or ListDirectory)
				WriteData (or AddFile)
				AppendData (or AddSubdirectory or CreatePipeInstance)
				ReadEA
				WriteEA
				Execute/Traverse
				DeleteChild
				ReadAttributes
				WriteAttributes
				
	Access Reasons:		DELETE:	Granted by	D:(A;ID;FA;;;LA)
				READ_CONTROL:	Granted by Ownership
				WRITE_DAC:	Granted by Ownership
				WRITE_OWNER:	Granted by	D:(A;ID;FA;;;LA)
				SYNCHRONIZE:	Granted by	D:(A;ID;FA;;;LA)
				ACCESS_SYS_SEC:	Not granted
				ReadData (or ListDirectory):	Granted by	D:(A;ID;FA;;;LA)
				WriteData (or AddFile):	Granted by	D:(A;ID;FA;;;LA)
				AppendData (or AddSubdirectory or CreatePipeInstance):	Granted by	D:(A;ID;FA;;;LA)
				ReadEA:	Granted by	D:(A;ID;FA;;;LA)
				WriteEA:	Granted by	D:(A;ID;FA;;;LA)
				Execute/Traverse:	Granted by	D:(A;ID;FA;;;LA)
				DeleteChild:	Granted by	D:(A;ID;FA;;;LA)
				ReadAttributes:	Granted by	D:(A;ID;FA;;;LA)
				WriteAttributes:	Granted by	D:(A;ID;FA;;;LA)
				
	Access Mask:		0x11f01ff
	Privileges Used for Access Check:	SeBackupPrivilege
	Restricted SID Count:	0

WmiPrvSe.exe ... definitely from a windows update! What the heck are they messing with my stuff!

I haven't found anything about removing shortcuts but i found some stuff about CPU spikes that's quite popular mainstream problem.

A quick google search confirmed my assumption that this was the Windows Management Instrumentation (WMI) host process. In short, WMI can be used to query for system information, like processor usage, running processes, who is logged on, and all sorts of other information. The WMI host process runs WMI queries for any other process making them, so WmiPrvSE.exe was not itself the culprit, it was simply an intermediary.

Seems like some stuff can run through this program, still why on earth would windows allow someone else to delete stuff like that.

The site suggest taking a look at Process Explorer from sysinternals to find what's behind wmiprvse.exe

Upd:
Well actually this is Windows Management Instrumentation service (winmgmt) and has one vital service it depends upon that i use for my HDDs not showing as removable drives by using #Intel Rapid Storage Technology" application just to run in background, i will disable the intel service from running and will keep an eye on this for another week to see if it happens, all other services you see in picture such as IpHelper, Security Center are disabled.



If there's someone doing it, it's WmiPrvSe it self, and it's make sense cause of the update. Fuck you microsoft.

I would simply disable this whole service but I don't know what is and i see it has some stuff for other apps that rely on it but that's microsoft's wording, i can find out if i really need this.

UPD:
Aha something about it - looks useless to me but we'll see, hopefully nothing critical will stop working.
http://msdn.microsoft.com/en-us/library/aa394582(v=vs.85).aspx

Also the process that issued this delete was PID: 0x137c (i've tried to convert from hex to dec in Regedit but it throwed out an unknonw 4988)
 
Last edited:
Joined
Apr 21, 2010
Messages
5,731 (1.13/day)
Location
West Midlands. UK.
System Name Ryzen Reynolds
Processor Ryzen 1600 - 4.0Ghz 1.415v - SMT disabled
Motherboard mATX Asrock AB350m AM4
Cooling Raijintek Leto Pro
Memory Vulcan T-Force 16GB DDR4 3000 16.18.18 @3200Mhz 14.17.17
Video Card(s) Sapphire Nitro+ 4GB RX 580 - 1450/2000 BIOS mod 8-)
Storage Seagate B'cuda 1TB/Sandisk 128GB SSD
Display(s) Acer ED242QR 75hz Freesync
Case Corsair Carbide Series SPEC-01
Audio Device(s) Onboard
Power Supply Corsair VS 550w
Mouse Zalman ZM-M401R
Keyboard Razor Lycosa
Software Windows 10 x64
Benchmark Scores https://www.3dmark.com/spy/6220813
AHA Found it



WmiPrvSe.exe ... definitely from a windows update! What the heck are they messing with my stuff!

I haven't found anything about removing shortcuts but i found some stuff about CPU spikes that's quite popular mainstream problem.



Seems like some stuff can run through this program, still why on earth would windows allow someone else to delete stuff like that.

The site suggest taking a look at Process Explorer from sysinternals to find what's behind wmiprvse.exe

This may well be some sort of malware that makes it look like it is the WmiPrvSe.exe file, there doesn't seem to be any documented eveidence that this process behaves in the way you have stated (from a quick Google anyway)

Also trojans/viruses and malware can take on the name of Windows services/process/.exe's etc.
 
Joined
Dec 2, 2009
Messages
3,351 (0.64/day)
System Name Dark Stealth
Processor Ryzen 5 5600x
Motherboard Gigabyte B450M Gaming rev 1.0
Cooling Snowman, arctic p12 x2 fans
Memory 16x2 DDR4 Corsair Dominator Pro
Video Card(s) 3080 10gb
Storage 2TB NVME PCIE 4.0 Crucial P3 Plus, 1TB Crucial MX500 SSD, 4TB WD RED HDD
Display(s) HP Omen 34c (34" monitor 3440x1440 165Hz VA panel)
Case Zalman S2
Power Supply Corsair 750TX
Mouse Logitech pro superlight, mx mouse s3, Razer Basiliskx with battery
Keyboard Custom mechanical keyboard tm680
Software Windows 11
Benchmark Scores 70-80 fps 3440x1440 on cyberpunk 2077 max settings
~~~Try reformatting the PC~~~
 
Joined
Feb 18, 2009
Messages
1,825 (0.33/day)
Location
Slovenia
System Name Multiple - Win7, Win10, Kubuntu
Processor Intel Core i7 3820 OC@ 4.0 GHz
Motherboard Asus P9X79
Cooling Noctua NH-L12
Memory Corsair Vengeance 32GB 1333MHz
Video Card(s) Sapphire ATI Radeon RX 480 8GB
Storage Samsung SSD: 970 EVO 1TB, 2x870 EVO 250GB,860 Evo 250GB,850 Evo 250GB, WD 4x1TB, 2x2TB, 4x4TB
Display(s) Asus PB328Q 32' 1440p@75hz
Case Cooler Master CM Storm Trooper
Power Supply Corsair HX750, HX550, Galaxy 520W
Mouse Multiple, Razer Mamba Elite, Logitech M500
Keyboard Multiple - Lenovo, HP, Dell, Logitech
This may well be some sort of malware that makes it look like it is the WmiPrvSe.exe file, there doesn't seem to be any documented eveidence that this process behaves in the way you have stated (from a quick Google anyway)

Also trojans/viruses and malware can take on the name of Windows services/process/.exe's etc.

I will do a scan right now if you want. Malwayrebytes and nod32

But i can tell you that I am right on this one, i've found the msdn thread where the ms guy says about removing shortcuts on particular week day and that's seems to be somewhere in tuesday 20:24 PM is the time it happend now.

The msdn guy said on monday or start of the week so this fits. And it's the msdn guy who said how to track the access, so i had the audit running in event for quite some time now, these audits are seriously tons of them but that's not an issue, i'll delete the log after im done.

The other thing is, it doesn't appear to be virus from my observation, it's at the path location it supposes to be, the processes are double as they should be , one SYSTEM and one NETWORK SERVICE, though the PID i have is in hex so i don't know, there was no 4988 at all just 30 mins after this happend but that's my quick try that probably isn't right, it's probably one of those, i was playing SC2 while it did, alt-tabbing in and out many times for a few hrs.
 
Top