fresh HJT
kitty500cat,
Thanks for joining in.
- Ran HJT
- fixed entry you referenced (yes, it was there)
- rebooted
- ran fresh HJT and attached it
I agree with your thought the problem is related to a software issue of some sort. How do I isolate the problem? I wonder if the explore.exe file is corrupt, or if that happens to be the one eating CPU usage only because it is open. In other words, any open application is eating CPU usage, so the high CPU usage on explorer.exe is a symtom, not the problem. Still, in order to rule it out, I have been wondering if I should replace the explorer.exe file. What do you think?
Roy
I almost forgot the most important thing. The CPU usage has not improved. Still 11% explorer.exe and 4% task manager.exe.
When I run Process Monitor, the following 9 lines keep repeating continuously:
7378 1:07:15.3898193 AM Explorer.EXE 1340 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Linkage\Bind SUCCESS Type: REG_MULTI_SZ, Length: 132, Data: \Device\{DE0FFF0F-625E-41E2-821C-885989DB4024}, \Device\NdisWanIp
7379 1:07:15.3938388 AM Explorer.EXE 1340 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Linkage\Bind SUCCESS Type: REG_MULTI_SZ, Length: 132, Data: \Device\{DE0FFF0F-625E-41E2-821C-885989DB4024}, \Device\NdisWanIp
7387 1:07:15.5072602 AM Explorer.EXE 1340 RegOpenKey HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE0FFF0F-625E-41E2-821C-885989DB4024} SUCCESS Desired Access: Read
7388 1:07:15.5096666 AM Explorer.EXE 1340 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE0FFF0F-625E-41E2-821C-885989DB4024}\EnableDHCP SUCCESS Type: REG_DWORD, Length: 4, Data: 1
7389 1:07:15.5136968 AM Explorer.EXE 1340 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE0FFF0F-625E-41E2-821C-885989DB4024}\LeaseObtainedTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1184473772
7392 1:07:15.6255741 AM Explorer.EXE 1340 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE0FFF0F-625E-41E2-821C-885989DB4024}\LeaseTerminatesTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1184525336
7393 1:07:15.6295721 AM Explorer.EXE 1340 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE0FFF0F-625E-41E2-821C-885989DB4024}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.1.1
7394 1:07:15.6334997 AM Explorer.EXE 1340 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE0FFF0F-625E-41E2-821C-885989DB4024}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.1.1
7395 1:07:15.7086749 AM Explorer.EXE 1340 RegCloseKey HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE0FFF0F-625E-41E2-821C-885989DB4024} SUCCESS
What is this process that explorer.exe keeps opening?