Excessive CPU usage by explorer.exe

[anantchowdhary]

Im sry to say that a tmp file again having an Nmudp initialization function takes over and again the CPU usage shoots up!Pls help!

 

[robphy]

Write a batch file wth pskill, which runs from the Startup folder.
However, I think it's worth it to track down the cause.
Using tcpview, does it connect to an external network port?

 

[anantchowdhary]

err...i duno how to check...shud i post another screenshot of TCPVIEW?

thnx

 

[robphy]

err...i duno how to check...shud i post another screenshot of TCPVIEW?

thnx

use tcpview.exe http://www.microsoft.com/technet/sysinternals/utilities/TcpView.mspx
or possibly the TCP/IP tab in procexp.exe http://www.microsoft.com/technet/sysinternals/Utilities/ProcessExplorer.mspx

(You could use paint or something to trim down to screenshot to just the relevant portion.)

 

[anantchowdhary]

I would be grateful to you if u cud teach me how to make a batchfile to kill a thread

thnx

 

[robphy]

This will kill the program called badfile.tmp.

open notepad
type in:

C:\path_to_pskill\pskill.exe C:\path_to_badfile\badfile.tmp

(customize the above for the correct paths)

save as kill_tmp.bat (or whatever you want with a .bat extension)
copy that .bat file [or a shortcut to that .bat file] into your Startup directory.

 

[neurocomp2003]

isn't explorer.exe the one program that runs the active desktop?

 

[anantchowdhary]

yes it is the program that runs the desktop

 

[anantchowdhary]

I tried out using pskill...but it still duznt help :'(.Ive put the BAT file in the correct place as when i start windows i get a few DOS screens.

 

[robphy]

Sorry to hear that.
Sounds like an unfriendly program.

I'm still waiting on the results on the networking info from tcpview in order to track down the source of the problem rather than trying to periodically swat it down (with pskill or something else).

 

[anantchowdhary]

Here is the screenshot:
http://img2.freeimagehosting.net/uploads/085bd06152.jpg

 

[robphy]

anantchowdhary,
Sorry. Nothing in that screenshot suggests what is going on with that thread.

If "nmudp" really does refer to a Delphi component,
it would seem strange to somehow be part of Vista.
I wonder what would turn up from a search through all of your files for "nmudp" as a word or phrase within the file. I'm not sure how well the windows search function will work...since I suspect that you'll mainly be looking for a binary file.

 

[anantchowdhary]

I checked up the TCP/IP tab of the thread using Process explorer.It does not show any connections.
Also the tmp file is non active for a while and then suddenly starts using up much of the CPU

 

[BoredNL]

rename the file in safe mode, then create a blank text file with notepad. Save the file in the directory with the same name as the .tmp file. Right click on the file, and check "read only." Then reboot to see what happens.

You might have gotten some spyware, adware, trojan, or virii which is causing this. I wouldn't know though.

Try downloading "Spybot - Search & Destroy." Run a scan to see if it picks it up. Then you can try "Adaware SE Personal," "Windows Defender," an anti-virus program such as "Avast". I really don't know what this program is.

This would be a lot easier if I could just log into your computer and have a look at it. If you trust me enough, you can get http://www.tightvnc.com/" which you can set up to allow me to remote control your computer (only when you run the program, and you see anything that I'm doing). The only reason why I suggest this is because there's a million things this .tmp file could be and it's a bit tough to have you trying all sorts of things on the forum. If you would like to go for it though, send me a private message and I can give you my AIM or yahoo screen name. (or maybe we could just figure it out on AIM or yahoo sometime)

 

[anantchowdhary]

Ofcourse ill trust u...ill try the things u suggested...thnx a ton

 

[anantchowdhary]

rename the file in safe mode, then create a blank text file with notepad. Save the file in the directory with the same name as the .tmp file. Right click on the file, and check "read only." Then reboot to see what happens.

You might have gotten some spyware, adware, trojan, or virii which is causing this. I wouldn't know though.

Try downloading "Spybot - Search & Destroy." Run a scan to see if it picks it up. Then you can try "Adaware SE Personal," "Windows Defender," an anti-virus program such as "Avast". I really don't know what this program is.

This would be a lot easier if I could just log into your computer and have a look at it. If you trust me enough, you can get http://www.tightvnc.com/" which you can set up to allow me to remote control your computer (only when you run the program, and you see anything that I'm doing). The only reason why I suggest this is because there's a million things this .tmp file could be and it's a bit tough to have you trying all sorts of things on the forum. If you would like to go for it though, send me a private message and I can give you my AIM or yahoo screen name. (or maybe we could just figure it out on AIM or yahoo sometime)

I tried out the suggestions given above.But another file named suaD1B7.tmp
gets created.

 

[BoredNL]

hmm.. strange.

I'm not sure if TightVNC will run properly on windows Vista, but we can give it a try. If not, I can still help you out a lot better if we speak in real time on AIM or Yahoo Instant messenger.

You need to find out what is creating these .tmp files and running them. In Process Explorer, make sure "Tree view" is on and then select the process you are talking about. Take a screenshot and display it here. It should show you what is running the file.

 

[BoredNL]

oh hey, check it out. I found some video lectures about removing malware. You might find this to be useful.

http://www.microsoft.com/emea/itsshowtime/sessionh.aspx?videoid=359

edit: You have to use Internet Explorer to play these videos btw. The page loads incorrectly in Firefox.

 

[ladhani]

Constant high cpu due to explorer.exe -> solution

I'm not sure that explorer.exe can be stopped. explorer.exe definitely should not be using 60% of your CPU time though. I would suggest verifying that your Windows installation has the most recent updates.

I am afraid this does happen in Windows Vista!

Suddenly my Vista computer had a very bad performance and everything started to work
very slowly, especially windows mail.

The Task manager showed that CPU was constantly at 50% - 80% even if I was
not doing anything and let the computer untouched for a few hours.

Most of the CPU time was taken by explorer.exe.

After trying many things and struggeling with this issue for many many hours,
I slowly got some idea.

Appearently something under water goes wrong with your user profile and the search
index settings of the files in your USER folder. Vista tries to index stuff in this folder
and gets completely crazy. It keeps on trying and trying and eating up most of
your CPU time (explorer.exe).

The only lasting working solution, I found was to make a completely new User Account.
After making the new User Account, you can only copy a limited number of stuff
from your original User Account. Some stuff when copied to your new User Account
will again make your new User Account go crazy.

Also, I turned off the search indexing for the new User Account, including all subfolders.

Here is what I did:


SOLUTION:

* Backup your original User Account, Mails and any other critical files.

* Make a new user and make an extra help account (for example called: admin with Administrator rights).

* Make sure that the search indexing for the new User folder is TURNED OFF
(via properties of the folder -> Advanced)

* Manually and carefully only copy back stuff you really need.

* Use Command line with Administrator rights to copy User stuff step by step.
The moment you see the CPU getting crazy again, delete the last User stuffs you just copied.



To restore your e-mails:

1 - copy the e-mail folder to another partition in folder mail2 (for example: f:/mail2).
2 - in the new user login, set the archive folder of Windows mail to f:/mail.
3 - delete f:/mail and rename f:/mail2 to f:/mail (BE CAREFULL! make sure you have a backup).


It's quite a headacke, but it will bring down your CPU to 2% - 10% when you are idle.

 

[mlbuie]

Vista Ultimate 64 bit here. Quad Core 2.4 GHz, 8GB ram (I do video and graphics editing and multitrack hard-disk recording ... plus play a couple games )

All 4 processors, 0% utlization. (I had turned indexing off)
Open Explorer window ... spike, then back near zero.
Open a folder ... just about any folder:

At least two of my processors moved to 40, 50, 60, 70, then 80% utilization.
(average overall CPU, 40% to 50%)

Click in a specific folder, sometimes it would stop. It seemed to be most prevalent when I rolled up a set of subfolders or hovered over one about to open it.

This worked for me, 100% verifiable.

If you want a faster way to pinpoint the corrupt file, use the Microsoft tool Process Monitor:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

First, recreate the problem causing explorer to use 100% CPU utilization. Then open up the Process Monitor tool and it will show explorer infinitely trying to do a file operation.
It will show you the exact file it's trying to read over and over again.

I'd searched all over ... registry entries, avi file searches, etc, to no avail.

Used this Procmon.exe. Sure there were lots of processes. But, suddenly it escalated 10 or 20-fold. At least two of my processors moved to 40, 50, 60, 70, then 80% utilization. I scrolled to bottom (latest entries) and scanned thru list to see that over an over three files continually coming up as not found.

In this folder:
C:\Users\YOUR_NAME_HERE\AppData\Roaming\Microsoft\Windows\Network Shortcuts\

I had three shortcuts in there:

- My Web Sites on MSN
- images on www.oneofmysites.net[/URL]
- images on [PLAIN]www.oneofmysites.org[/URL]

I'm not sure how I inadvertently created these Network shortcuts ... and I haven't researched how this folder is legitimately used or what I may have done wrong there. All I know is this:

[B]Take these shortcuts out, CPU utilization goes to zero[/B] (or 1% to 2% with indexing on)
[B]Put them back in, problem recurs[/B] (this is repeatable behavior)

I hope my post helps someone. :smile: