explorer.exe cpu spikes and eating memory

[Traddles]

hi all, I've got a problem. whenever I try to do anything with explorer.exe (like browse files and folders or delete something) explorer.exe will spike up to 99% usage of my cpu and will stay there for a long time (obviously this locks up my whole system). Also, as I leave windows on it slowly eats more and more of my memory. here is my hijackthis log:


Logfile of HijackThis v1.98.2
Scan saved at 4:07:07 AM, on 6/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\system32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cmd.exe
C:\djgpp\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://r.office.microsoft.com/r/rlidOfficeUpdate?clid=1033
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CleanMyPC Popup Blocker - {7A9BC6B1-7F27-47c6-A66D-13582E81E537} - C:\Program Files\CleanMyPC Popup Blocker\CleanBHO.dll
O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} - C:\Program Files\CleanMyPC Popup Blocker\CleanBar.dll
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gaim] C:\Program Files\Gaim\gaim.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = houghton.edu
O17 - HKLM\Software\..\Telephony: DomainName = houghton.edu
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = houghton.edu
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll




any ideas? I'm going absolutly nuts :dead:
thanks for any help

 

[RealBlackStuff]

Your HJT is well out of date.

Go to this post here first, and follow the instructions EXACTLY, especially about UPDATING and HJT-location.
How to remove Begin2Search/Coolwebsearch and Other Nasties

Then see How to post your Hijackthis log-files as an attachment.

While you are at it, UNinstall and delete anything to do with:
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

 

[iamthekings]

Explorer.exe drains PC power by robbing the CPU of everything it is worth!

Hi,

I am new here, but I came here looking for a "fix" for the problem mentioned in my subject heading.

I suffered from this malady for about a week, until by chance I stumbled upon something.

I had downloaded some thing (not inappropriate by anymeans) and unbeknownst to me, it was bogging the processor down because of some problem with the file. The file was a video that whe I tried running, windows media player (10) and all its updates could not run... so, being the googler I am I went in search of a fix for that... I found a file called G-spot. It is a cool little file and it helped me on one file to find the correct codec. When I tried running it on this other file, however, it stopped responding.

This got me thinking... so I put two and two together and got 4... I tried to delete the offending file. It would not allow that. It said it was being used by another program... (HUH???)

Well, I knew I had no viruses and malware on my PC. I have fully updated versions of 3 malware detection tools (not only the freebie ones) and fully updated AV and maintenance software.

I was baffled! (remember, at this point I did not suspect this offending file of creating my explorer problem.)

I ran chkdsk and as usual the results of the boot-time scan went by so fast I didn't catch a thing..... BUT... that didn't change a thing.

OK... Back to the file.

I could not delete this thing.... I tried shutting down, rebooting and immediately bringing that file up to delete. That too was NOT happenin'!

So then I thought.. DAMN! the program accesssing it MUST be explorer!

so I backed out of that folder after transferring all files BUT that one to another folder. I deleted the folder and viola... no worries!

Previous to this I had reduced my hardware acceleration (graphics) a notch. I also went through MIcrosoft's Knowledge base and did what they suggested as far as turning off the really "cool" XP effects. While these steps increased the speed at which things ran, they did not fix the problem.

My suggestion to anyone who had a fully functional system before this started happening...

1) Organize. Put all of your video files in one folder. MP3s in another... etc.
2) understand that you may not necessarily have to re-boot to get rid of the cpu "glut" that explorer starts. When I backed out of the folder that containted the offending file in it... my cpu would continue on having a fit. So, from task manager (which I left open and still do as of now, to monitor things) I ended the explorer.exe process... (one thing to do that makes things easier. Under the "processes" tab... click on the column heading "cpu" this will list the programs in order of their CPU usage. If it is inverted, click it again and it will flip it around. This makes the following steps easier to accomplish.) DO NOT CLOSE TASK MANAGER as you will be using it frequently. Then go to the applications tab and click on "new task." THen type in eplorer.exe... it should restart.
3) IF you are still in the directory with the offending program / file, it will go right back up to 100%. If you are not, it may run just fine...
4) SO... just play around moving to different folders, seeing if there is one folder that causes problems. (resetting explorer as described in "2)."
5) Now... once you find the little bugger (putting it nicely) you need to decide what to do with it. If you cannot do without the program then you need to fix it, or have it fixed... OR try copying the file elsewhere and see if the problem persists in that new location.

I ran SFC to try to see if I had a Microsoft problem and this yielded nothing for me.

See if this works if you want... But do so at your own risk. I am not responsible for you taking on "fixes" that are not from "official" tech support.

Peace!

 

[aircraftcarryur]

Weird you should mention the undeletable file. I deleted it and my system resources returned to normal. The way to delete those files is to access it via the command prompt and delete the fule thru it using the "del" command. You may have to put the file name in quotes if it has some weird chars in it

 

[iamthekings]

Command prompt

Ah yes.. the text way of doing it.... The weird characters are what keeps me away from what I used to do in the first Place (DOS and GWBASIC). With the allowable lengths of files now being 255 characters... you will run into it.

Thanks for the direction. In my case I was ok doing it the way I did, but I can see how for others that would not have been feasible.