Event viewer says it's winlogon sending "The shell stopped unexpectedly and Explorer.exe was restarted"