Excessive CPU usage by explorer.exe

[anantchowdhary]

I am using a 2.8Ghz Intel Dual core CPU and I've got Windows Vista

Now...after a start my computer...a thread executes itself .The threads name is
nxaEA8A.tmp...

This uses upto 60% of the CPU acc to Process Explorer

When i kill the thread my CPU usage comes back to normal.

Any ideas on how to prevent the thread from running...or y the thread runs in the first place!

Thnx

 

[russ_watters]

Have you run a virus scan and an AdAware scan?

 

[austriolia]

:-) yes, you can get it with adaware, I used to run into the same problem but with different filename. :-)
You should also pay attention to what other files are running too when this tmp is on. I know this file rotation to consume tiny memories at leisure time...

 

[dimensionless]

I'm not sure that explorer.exe can be stopped. explorer.exe definitely should not be using 60% of your CPU time though. I would suggest verifying that your Windows installation has the most recent updates.

 

[anantchowdhary]

Ive just installed a fresh copy of Windows Vista...But still...i acnt get rid of the problem...and i don't think i hav a virus

 

[russ_watters]

If you don't think you have a virus, that means you probably have a virus (or adware/malware). It means you haven't checked and don't actually know. Run a virus scan and an adware scan.

 

[robphy]

Is your hard-drive light active at the same time as this high-cpu-usage thread?
Might it be indexing your files?

 

[anantchowdhary]

No...the hard drive light(red) duznt blink..Ive also tried a scan but its of no hlp:(

 

[BoredNL]

Did you do a fresh installation (formatting) or did you install without formatting?

Try to locate the file and scan it with an online anti-virus scanner before anything else. If it comes upnd clean, then that doesn't mean it isn't a virus or trojan, because it might be a brand new virus/trojan that isn't recognized yet. I don't know anything about windows Vista, so I don't know if the WinXP way of disabling a file from running is the same. The easiest, but unclean way to stop the file from running at boot up is to simply rename the file (after you've stopped it in Task Manager). I usually add ".disabled" to the end of the file and voila, it won't run anymore. If you forget where the file is, just run a search for "*.disabled" and it'll show up. I don't recommend deleting the file, it might be doing something real.

The following is not a complete way to analyze the problem, because I am short on time right now, but here's are a few things you can try:

I couldn't find any information on "nxaEA8A.tmp." I'm guessing that it is a randomly named file. TMP files can be all sorts of different types of files also, so figuring out what type of file it is could reveal some information about it. The next step would be to figure out what is starting the program and for what purpose. Use http://mark0.net/onlinetrid.aspx" to try and figure out what type of file it is (perhaps it's a .dll file, or an .exe, I don't know).

Next I would say to try to figure out how it is running and what it's behavior is. Window's XP's tools for this include regedit (to look at/modify the startup section of the registry that msconfig doesn't look at), msconfig, and CTRL + ALT, DEL. A previous thread in this forum had some excellent recommendations for much better alternatives which will yield a lot more useful information and I would tell you to use these to gather more information and to track down the source of this file.. But I can't remember what the programs are, what thread they're listed in, and I'm at my g/f's on her laptop so I can't just look at the programs. Hmm.. They might not even work on Windows Vista either.

You might just either have to hang tight, rename the file, or reinstall windows vista. (making sure to do a completely free install, to rule out a virus)

Have you tried just letting it run through to completion though? Perhaps it's a legitimate file.

 

[Manchot]

I think people are missing the obvious. Though I have no personal experience with it, from what I understand, Vista is SLOW (even on most new machines).

 

[ukmicky]

What happens if you rename nxaEA8A.tmp does the machine run ok if so try running it for a few days without it.

 

[Gib Z]

How much RAM do you have might be a reasonable question, 60% of 512 megs typical of a 3 year old 2.8 Ghz computer is more than expected running vista..

 

[anantchowdhary]

No...as soon as i kill the thread...my computer runs pretty well!so i guess there's no prob with my PC.and yea..i formatted my disk and hav installed vista!

 

[chaoseverlasting]

I don't know if this will work on vista, but on xp, if you want to configure the boot up process, you go to run and type in "msconfig". There, on the services/start up tabs, you can configure your system boot settings.

I used to have a virus on my comp that did something similar. Usually, its hackers who jack your comp and make it a part of a global network, I forget what this process is popularly called by.
Anyway, try shutting the internet down, maybe that makes the process inactive. In any case, if you can get msconfig to open up, you can directly force this process to not run.

 

[anantchowdhary]

Ive tried everything.I know abt msconfig and it works on vista.But still its of no help.Would you like a screenshot of the thread as seen on process explorer?

Thnx

 

[BoredNL]

In Windows XP there's three separate ways a file can be run. You will want to check all of these places to see where this file is running from to disable it cleanly. To simply find out where the file is so that you can rename it, use http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx"" or you can do it manually if AutoRuns doesn't work for you.

For manual removal of startup items in Windows XP a startup program/file can be located in:
1. The startup folder in the "Programs" or "All Programs" dropdown folder in the start bar. (You'd disable the file from running by deleting the shortcut or moving it elsewhere)
2. In the msconfig utility, there are the "services" and the "startup" tab (you uncheck the file from running).
3. From the registry (This for both local and all users - I'm not sure if this is the same in windows vista - You would disable the file by deleting the registry key). I'll list a full list below with descriptions for WinXP:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
– these programs automatically start when any user is logged in. It is used for all users on this computer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
– The programs here start only once when any user is logged in and will be removed after the Windows boot process would have finished.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
– The programs here start only once when any user is logged in and will be removed after the Windows boot process would have finished. Also the RunOnceEx registry key does not create a separate processes. The RunOnceEx registry key also support a dependency list of DLLs that remain loaded while either all the sections or some of the sections are being processed.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
– these programs automatically start when the system is loading before the user logs in. It is used for service applications - antivirus, drivers etc. In Windows NT/2000/XP it could be canceled by admin to use other service startup sections. Read more at services startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
– these programs automatically start only once when the system is loading as service application and items are deleted after the Windows boot process have finished.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
– The programs here automatically start when the current user logs in. It is used only for current logoned user.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
– The programs here automatically start only once when the current user logs in and it will be deleted after the Windows boot process would have finished.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
– The programs here automatically will be copied into HKEY_CURRENT_USER\...\Run for every new user account.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
– The programs here automatically will be copied into HKEY_CURRENT_USER\...\RunOnce for every new user account.Well, I hope this helps. :)

Edit: The forum added the spaces in "CurrentVersion" for some reason, they are not there in the registry or in the text I wrote here.

 

[anantchowdhary]

thanks for all the help.But i am referring to a thread run by explorer.exe!

Anyways Ill try out ur recommedations

 

[BoredNL]

It might not be window's explorer, it could be a virus or trojan pretending to be.

Don't rename "c:\windows\explorer.exe"

Explorer is used for a variety of things. You can open files with explorer.exe (such as text files. If I try to open an extremely large file with it, it might behave in the same manner that yours is). You can use the "bring to front" option in Process Explorer to see which window is giving the problem.

 

[BoredNL]

Oh, something else you might find useful:

When using "Process Explorer" locate the instance of explorer that is eating up all your resources, right click on hit, and hit "suspend." This will put the program on hold without closing it. You can resume at any time.

 

[anantchowdhary]

so how will suspend help me in removing that thread forever?

 

[robphy]

Ive tried everything.I know abt msconfig and it works on vista.But still its of no help.Would you like a screenshot of the thread as seen on process explorer?

Thnx

Yes, show a screenshot.

I'm not sure if this is helpful for stopping the process: pskill
http://www.microsoft.com/technet/sysinternals/utilities/pskill.mspx
You could write a small batch file that can be run from the "Start Up" folder.

 

[ukmicky]

when you rename nxaEA8A.tmp and restart your machine does explorer exe create a new file with the same name , if it dosent and your pc is running fast with it renamed then just leave it with its new name so it not accessed anymore and in few weeks or months delete it unless you experience problems..

 

[BoredNL]

You can find out more information about what explorer.exe is running while it is suspended without having to deal with it slowing the computer down at the same time.

It sounds like you might have a startup entry somewhere starting the .tmp file, which is why I said for you to disable that. To find out where the .tmp file is located, you might be able to use the programs I listed to find it easily, or you can just use your windows search to find it. Once you find it, kill the explorer.exe that is causing the problem and rename the .tmp file. Then report back here with the results of doing so. We need to know what happens when you do that to assist you further.

Process Explorer will tell you more information about the .tmp file than CTRL + ALT + Del (Windows Task Manager), such as giving a tree view of processes. You might see that another program is running alongside with the explorer.exe and .tmp file and so identify the program causing the problem.

 

[anantchowdhary]

thnx fr all the help...heres the link to the screenshot...and i can't find the tmp file http://img2.freeimagehosting.net/uploads/d11387a1ad.jpg

 

[robphy]

I think you get the path of the file if you click on "Module" or "Stack"... i forget which.

Googling Nmudp... yields some results that look associated with networking.. in delphi or pascal.
Run tcpview (or possibly study the "TCP/IP" tab) to see if it's connected to an external port.

 

[anantchowdhary]

Thnx a lot.I found the tmp file but i can't delete it even after i kill the thread!

 

[robphy]

What was the path of the .tmp file?

Did you see (using TCPView http://www.microsoft.com/technet/sysinternals/utilities/TcpView.mspx ) if it was connected to an outside network port?

Either http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Handle.mspx or http://ccollomb.free.fr/unlocker/ might help identify what is preventing the deletion and then help free the program and let you delete it. Otherwise, you might have to either reboot, boot to DOS, or boot to linux (via a Knoppix LiveCD) to delete it.

 

[anantchowdhary]

thnx a lot for ur help!

 

[BoredNL]

I have a very easy and simple solution to removing a file that won't go away.

First open notepad. Write the following into notepad (replacing "-directory-" with the actual directory that the .tmp file is in):

@cd -directory-&ren nxaEA8A.tmp nxaEA8A.tmp.disabled

(if the file is located in "c:\windows\system32", then the line should look like this:
@cd c:\windows\system32&ren nxaEA8A.tmp nxaEA8A.tmp.disabled

In notepad, save the file as "c:\rentmp.bat"

Then go to "start", "run" and type in "Regedit". Run the program. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce and right click on the right side of the window. This will open a dropdown menu, hit "new" and select "string value". It looks like you created a file and can change the name. Name it whatever you want then hit enter. Right click on it and hit "Modify." In "value data:" put "C:\rentmp.bat"

Close regedit and reboot your computer. After you've started again, browse to the directory. If the file is gone and you see "nxaEA8A.tmp.disabled" then just delete "C:\rentmp.bat". If it's still there, let us know.

 

[anantchowdhary]

I deleted the file using Safe Mode.Thnx a lot everyone fr ur help!

 

[anantchowdhary]

Im sry to say that a tmp file again having an Nmudp initialization function takes over and again the CPU usage shoots up!Pls help!

 

[robphy]

Write a batch file wth pskill, which runs from the Startup folder.
However, I think it's worth it to track down the cause.
Using tcpview, does it connect to an external network port?

 

[anantchowdhary]

err...i duno how to check...shud i post another screenshot of TCPVIEW?

thnx

 

[robphy]

err...i duno how to check...shud i post another screenshot of TCPVIEW?

thnx

use tcpview.exe http://www.microsoft.com/technet/sysinternals/utilities/TcpView.mspx
or possibly the TCP/IP tab in procexp.exe http://www.microsoft.com/technet/sysinternals/Utilities/ProcessExplorer.mspx

(You could use paint or something to trim down to screenshot to just the relevant portion.)

 

[anantchowdhary]

I would be grateful to you if u cud teach me how to make a batchfile to kill a thread

thnx

 

[robphy]

This will kill the program called badfile.tmp.

open notepad
type in:

C:\path_to_pskill\pskill.exe C:\path_to_badfile\badfile.tmp

(customize the above for the correct paths)

save as kill_tmp.bat (or whatever you want with a .bat extension)
copy that .bat file [or a shortcut to that .bat file] into your Startup directory.

 

[neurocomp2003]

isn't explorer.exe the one program that runs the active desktop?

 

[anantchowdhary]

yes it is the program that runs the desktop

 

[anantchowdhary]

I tried out using pskill...but it still duznt help :'(.Ive put the BAT file in the correct place as when i start windows i get a few DOS screens.

 

[robphy]

Sorry to hear that.
Sounds like an unfriendly program.

I'm still waiting on the results on the networking info from tcpview in order to track down the source of the problem rather than trying to periodically swat it down (with pskill or something else).

 

[anantchowdhary]

Here is the screenshot:
http://img2.freeimagehosting.net/uploads/085bd06152.jpg

 

[robphy]

anantchowdhary,
Sorry. Nothing in that screenshot suggests what is going on with that thread.

If "nmudp" really does refer to a Delphi component,
it would seem strange to somehow be part of Vista.
I wonder what would turn up from a search through all of your files for "nmudp" as a word or phrase within the file. I'm not sure how well the windows search function will work...since I suspect that you'll mainly be looking for a binary file.

 

[anantchowdhary]

I checked up the TCP/IP tab of the thread using Process explorer.It does not show any connections.
Also the tmp file is non active for a while and then suddenly starts using up much of the CPU

 

[BoredNL]

rename the file in safe mode, then create a blank text file with notepad. Save the file in the directory with the same name as the .tmp file. Right click on the file, and check "read only." Then reboot to see what happens.

You might have gotten some spyware, adware, trojan, or virii which is causing this. I wouldn't know though.

Try downloading "Spybot - Search & Destroy." Run a scan to see if it picks it up. Then you can try "Adaware SE Personal," "Windows Defender," an anti-virus program such as "Avast". I really don't know what this program is.

This would be a lot easier if I could just log into your computer and have a look at it. If you trust me enough, you can get http://www.tightvnc.com/" which you can set up to allow me to remote control your computer (only when you run the program, and you see anything that I'm doing). The only reason why I suggest this is because there's a million things this .tmp file could be and it's a bit tough to have you trying all sorts of things on the forum. If you would like to go for it though, send me a private message and I can give you my AIM or yahoo screen name. (or maybe we could just figure it out on AIM or yahoo sometime)

 

[anantchowdhary]

Ofcourse ill trust u...ill try the things u suggested...thnx a ton

 

[anantchowdhary]

rename the file in safe mode, then create a blank text file with notepad. Save the file in the directory with the same name as the .tmp file. Right click on the file, and check "read only." Then reboot to see what happens.

You might have gotten some spyware, adware, trojan, or virii which is causing this. I wouldn't know though.

Try downloading "Spybot - Search & Destroy." Run a scan to see if it picks it up. Then you can try "Adaware SE Personal," "Windows Defender," an anti-virus program such as "Avast". I really don't know what this program is.

This would be a lot easier if I could just log into your computer and have a look at it. If you trust me enough, you can get http://www.tightvnc.com/" which you can set up to allow me to remote control your computer (only when you run the program, and you see anything that I'm doing). The only reason why I suggest this is because there's a million things this .tmp file could be and it's a bit tough to have you trying all sorts of things on the forum. If you would like to go for it though, send me a private message and I can give you my AIM or yahoo screen name. (or maybe we could just figure it out on AIM or yahoo sometime)

I tried out the suggestions given above.But another file named suaD1B7.tmp
gets created.

 

[BoredNL]

hmm.. strange.

I'm not sure if TightVNC will run properly on windows Vista, but we can give it a try. If not, I can still help you out a lot better if we speak in real time on AIM or Yahoo Instant messenger.

You need to find out what is creating these .tmp files and running them. In Process Explorer, make sure "Tree view" is on and then select the process you are talking about. Take a screenshot and display it here. It should show you what is running the file.

 

[BoredNL]

oh hey, check it out. I found some video lectures about removing malware. You might find this to be useful.

http://www.microsoft.com/emea/itsshowtime/sessionh.aspx?videoid=359

edit: You have to use Internet Explorer to play these videos btw. The page loads incorrectly in Firefox.

 

[ladhani]

Constant high cpu due to explorer.exe -> solution

I'm not sure that explorer.exe can be stopped. explorer.exe definitely should not be using 60% of your CPU time though. I would suggest verifying that your Windows installation has the most recent updates.

I am afraid this does happen in Windows Vista!

Suddenly my Vista computer had a very bad performance and everything started to work
very slowly, especially windows mail.

The Task manager showed that CPU was constantly at 50% - 80% even if I was
not doing anything and let the computer untouched for a few hours.

Most of the CPU time was taken by explorer.exe.

After trying many things and struggeling with this issue for many many hours,
I slowly got some idea.

Appearently something under water goes wrong with your user profile and the search
index settings of the files in your USER folder. Vista tries to index stuff in this folder
and gets completely crazy. It keeps on trying and trying and eating up most of
your CPU time (explorer.exe).

The only lasting working solution, I found was to make a completely new User Account.
After making the new User Account, you can only copy a limited number of stuff
from your original User Account. Some stuff when copied to your new User Account
will again make your new User Account go crazy.

Also, I turned off the search indexing for the new User Account, including all subfolders.

Here is what I did:


SOLUTION:

* Backup your original User Account, Mails and any other critical files.

* Make a new user and make an extra help account (for example called: admin with Administrator rights).

* Make sure that the search indexing for the new User folder is TURNED OFF
(via properties of the folder -> Advanced)

* Manually and carefully only copy back stuff you really need.

* Use Command line with Administrator rights to copy User stuff step by step.
The moment you see the CPU getting crazy again, delete the last User stuffs you just copied.



To restore your e-mails:

1 - copy the e-mail folder to another partition in folder mail2 (for example: f:/mail2).
2 - in the new user login, set the archive folder of Windows mail to f:/mail.
3 - delete f:/mail and rename f:/mail2 to f:/mail (BE CAREFULL! make sure you have a backup).


It's quite a headacke, but it will bring down your CPU to 2% - 10% when you are idle.

 

[mlbuie]

Vista Ultimate 64 bit here. Quad Core 2.4 GHz, 8GB ram (I do video and graphics editing and multitrack hard-disk recording ... plus play a couple games )

All 4 processors, 0% utlization. (I had turned indexing off)
Open Explorer window ... spike, then back near zero.
Open a folder ... just about any folder:

At least two of my processors moved to 40, 50, 60, 70, then 80% utilization.
(average overall CPU, 40% to 50%)

Click in a specific folder, sometimes it would stop. It seemed to be most prevalent when I rolled up a set of subfolders or hovered over one about to open it.

This worked for me, 100% verifiable.

If you want a faster way to pinpoint the corrupt file, use the Microsoft tool Process Monitor:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

First, recreate the problem causing explorer to use 100% CPU utilization. Then open up the Process Monitor tool and it will show explorer infinitely trying to do a file operation.
It will show you the exact file it's trying to read over and over again.

I'd searched all over ... registry entries, avi file searches, etc, to no avail.

Used this Procmon.exe. Sure there were lots of processes. But, suddenly it escalated 10 or 20-fold. At least two of my processors moved to 40, 50, 60, 70, then 80% utilization. I scrolled to bottom (latest entries) and scanned thru list to see that over an over three files continually coming up as not found.

In this folder:
C:\Users\YOUR_NAME_HERE\AppData\Roaming\Microsoft\Windows\Network Shortcuts\

I had three shortcuts in there:

- My Web Sites on MSN
- images on www.oneofmysites.net[/URL]
- images on [PLAIN]www.oneofmysites.org[/URL]

I'm not sure how I inadvertently created these Network shortcuts ... and I haven't researched how this folder is legitimately used or what I may have done wrong there. All I know is this:

[B]Take these shortcuts out, CPU utilization goes to zero[/B] (or 1% to 2% with indexing on)
[B]Put them back in, problem recurs[/B] (this is repeatable behavior)

I hope my post helps someone. :smile: