Solved explorer.exe ist running with 97% CPU

albert39 · Nov 25, 2010

Situation: Vista Home Basic. After deinstalling a programm (with some mysterious effects at the screen) the system (and the system start) slows down. The Taskmanager shows that explorer.exe runs with 97% CPU exploitation. Opening the Windows Explorer shows an empty, transparent screen.

When I start Vista in "Safety Mode" (starting with F8), all ist o.k. !!

I have deactivated step by step all services and all start programs (with msconfig), until only the processes run like in the Safety Mode, but again: Safety Mode is o.k., with normal Windows start: explorer.exe runs with 97% immediately after the start.

Because I can not open the Windows Explorer, I can not load test-programs. Also I can not access[FONT=&quot] ntbtlog.txt .

After all this, what could be the reason of the explorer.exe, running with nearly 100%?

Thank you for your help.

Albert
[/FONT]

tom982 · Nov 25, 2010

Hello albert39 and welcome to the forums :party:

There are several possible causes of this occurance, for example a virus or a corrupted file etc. So let's try and solve these two first:

1. Can you download and install Malwarebyte's Anti-Malware? You may need to boot in safe mode to install this. Run a full scan (may take a few hours depending on the number of files you have) and upload the log for us.

2. Can you download HiJackThis and run a scan and upload the log file for us. (Preferably needs to be done not in safe mode because I would like to see the running processes.

3. Run a SFC scan:

1. Open the start menu
2. In the search box, type cmd
3. Right click on command prompt and select Run as administrator
4. In command prompt, type:

sfc /scannow

5. Let it run and let me know if it finds any Integrity Violations

And can you let us know a bit more about your problem:

How long has it been like this?
Did you change anything at the time of the problem starting?
What is the spec of your computer?

Thanks,

Tom

richc46 · Nov 25, 2010

Tom is giving good advice
Give priority to a full antivirus scan and a full updated scan with malwarebytes.
Malware or virus should be taken care of as soon as possible.
That HijackThis should also be on the priority list.

niemiro · Nov 26, 2010

The only other thing I can think of is a dodgy context menu poorly coded, which then takes up a lot of CPU, but we can come to that later.

albert39 · Nov 26, 2010

Thank you Tom.

This is the Laptop of a friend. I should repair it, because I have some more klowledge, but rather with XP.

@1: avast internet protection was always running, updated and therefore I assume that a virus is not the reason.

How long has it been like this?
Did you change anything at the time of the problem starting?

It starts a week ago after deinstalling a program (the name is unknown, it had anything to do with encrypting passwords. My friend told me that during the deinstallation process the screen shows strange effects)

What is the spec of your computer?

Acer Aspire 5315 (2 years old, location: Austria/Europe), Intel Celeron 550, RAM 3GB, HDD 160 GB. C:/ (System and User-Data) D:/ (empty).

Vista Home Basic, German, OEM.

Backups and Recovery-Points were never made.

Because of CPU 100% the computer is almost blocked. When I open the Windows-Explorer, I only see an empty, transparent or black window. I can access some items at the desktop, but no program at the start-menu. I can execute cmd.exe from the "Execute-Window" (Win + R), but not in administer mode.

therefore sfc/scannow or loading HiJackThis is (at present) not possible.

For a System Recovery I have to save the user-data (all in C:\user\username\) but I can access this data only in Safety Mode.

My question: Is it possible to access a USB-Stick or an external HDD in the Safety Mode, and if yes, HOW?

Thanks for your help.

Albert

tom982 · Nov 26, 2010

albert39 said:
@1: avast internet protection was always running, updated and therefore I assume that a virus is not the reason.

This doesn't necessarily mean that it isn't a virus because a well coded virus will either avoid or remove virus protection.

As for the problem with running things, do you have a Vista installation disc that we could perform a repair from?

And just to clarify with the other two helping you here, I want to tell you what I have in mind just to check it:

[IGNORE THIS ALBERT]

Not in any particular order:

1. Repair from an installation disc
2. If Albert isn't able to access an installation disc, then download the Vista Recovery Disc and run an SFC from that
3. Scan with AVG rescue CD
4. As a last resort, but some problems simply can't be fixed, reinstall windows

Let me know what you think and about any additions

Tom

tom982 · Nov 26, 2010

albert39 said:
My question: Is it possible to access a USB-Stick or an external HDD in the Safety Mode, and if yes, HOW?

Albert

Not that I know of, because Safe Mode is designed so that only the bare essentials (main drivers etc.) are run. The other two here may correct me though...

Tom

albert39 · Nov 26, 2010

Hello Tom!

I don't know why, but suddenly the computer recognized the USB-Stick in Safety Mode. I made (in Safety mode) a connection (German: Verknüpfung) at the desktop to cmd.exe and started it in administrator mode. sfc/scannow found corrupted files which couldn't be repaired.
I repeted sfc/scannow in Safety Mode and again corrupted files were found. The CBS.log is attached.

Because I have found the way to start a program from the desktop: Would HiJackThis give you better informations? Or is now a system recovery the final solution?

Greeting from Austria

Albert

Just now I read your recent post (it came during writing my post).

As for the problem with running things, do you have a Vista installation disc that we could perform a repair from?

The owner of the Laptop has no Vista-DVD. The system recovery should be made from the hidden partition. But another friend has an Vista-Ultimate-DVD. I could organize it tomorrow. In the meantime I have saved all personal data. Do you see a possibility to repair the system with this DVD?

tom982 · Nov 26, 2010

albert39 said:
Hello Tom!

I don't know why, but suddenly the computer recognized the USB-Stick in Safety Mode. I made (in Safety mode) a connection (German: Verknüpfung) at the desktop to cmd.exe and started it in administrator mode. sfc/scannow found corrupted files which couldn't be repaired.
I repeted sfc/scannow in Safety Mode and again corrupted files were found. The CBS.log is attached.

Because I have found the way to start a program from the desktop: Would HiJackThis give you better informations? Or is now a system recovery the final solution?

Greeting from Austria

Albert

Just now I read your recent post (it came during writing my post).

As for the problem with running things, do you have a Vista installation disc that we could perform a repair from?

Click to expand...

The owner of the Laptop has no Vista-DVD. The system recovery should be made from the hidden partition. But another friend has an Vista-Ultimate-DVD. I could organize it tomorrow. In the meantime I have saved all personal data. Do you see a possibility to repair the system with this DVD?

Hello Albert,

I don't full know how to analyse a CBS log, but at the end it says "Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired" which seems to be good.

I would like you to run HiJackThis for me please and upload the log for us before we can continue with your assistance.

And another thing, is the Vista Installation DVD 32-bit?

Tom

niemiro · Nov 26, 2010

Well done! I have just looked at your CBS.log. Nicely snipped! There are no problems there. The only thing detected is settings.ini, but it is safe to ignore this. See here for more details: The SFC.exe command reports Settings.ini file errors in the CBS.log file after you add gadgets to the Windows Vista Sidebar by using the Sysprep tool and an Autounattend.xml file

albert39 · Nov 27, 2010

Hi Tom, Hi Niemiro.

The system is running now again with nearly all services and start programs acitivated. The explorer.exe still runs with 97% und CPU 100%.

I enclose the hijackthis.log. HiJackThis.exe ran well in spite of the explorer problem.

And another thing, is the Vista Installation DVD 32-bit?

I have no DVD at present. I should get it today. The system type is 32 bit.

Greetings

Albert

niemiro · Nov 27, 2010

Have just looked at your HiJackThis log. No malware as far as I can see, and I can see pretty well

tom982 · Nov 27, 2010

albert39 said:
Hi Tom, Hi Niemiro.

The system is running now again with nearly all services and start programs acitivated. The explorer.exe still runs with 97% und CPU 100%.

I enclose the hijackthis.log. HiJackThis.exe ran well in spite of the explorer problem.

And another thing, is the Vista Installation DVD 32-bit?

Click to expand...

I have no DVD at present. I should get it today. The system type is 32 bit.

Greetings

Albert

Ok then, thanks for that and let us know when you get your hands on the DVD.

Tom

niemiro said:
Have just looked at your HiJackThis log. No malware as far as I can see, and I can see pretty well

Thanks for doing this Rich, you have far more experience (and knowledge)than me with this

albert39 · Nov 27, 2010

Now I have got the Vista-DVD. Informations on the DVD: Windows Vista ultimate, 32-Bit-Software, "Includes Windows Anytime Upgrade" "Suitable for sale with a new PC" (translated from German).

Control-Panel --> System shows: Windows Vista Home Basic, c 2007, Service Pack 2,
Windows Activation: Product ID 98572-OEM-7332166-xxxxx (the label at the bottom of the laptop shows another code)

I have never repaired a Windows system. I see 2 possibilities: repair of the system or a new installation (where all installed programs will be lost).

In another forum I found the information that repair is not possible, when the DVD does not include the service pack (and this is surely the case with a DVD from 2007).

I am sure you have more experiences and ask again for your help. (Isn't there a tutorial for this case?)

Albert

Some additonal remarks:
After loading the desktop the HDD-monitor continues blinking. It never stops.
I have loaded the tool Process-Explorer from Sysinternals which shows much more details than the Taskmanager. It shows also the explorer.exe running with <90% and properties --> threads shows SHLWAPI.dll with cycles delta > 1.000.000 and ntdll.dll with cycles delta > 900.000.000 !!

tom982 · Nov 28, 2010

albert39 said:
Now I have got the Vista-DVD. Informations on the DVD: Windows Vista ultimate, 32-Bit-Software, "Includes Windows Anytime Upgrade" "Suitable for sale with a new PC" (translated from German).

Control-Panel --> System shows: Windows Vista Home Basic, c 2007, Service Pack 2,
Windows Activation: Product ID 98572-OEM-7332166-xxxxx (the label at the bottom of the laptop shows another code)

I have never repaired a Windows system. I see 2 possibilities: repair of the system or a new installation (where all installed programs will be lost).

In another forum I found the information that repair is not possible, when the DVD does not include the service pack (and this is surely the case with a DVD from 2007).

I am sure you have more experiences and ask again for your help. (Isn't there a tutorial for this case?)

Albert

Some additonal remarks:
After loading the desktop the HDD-monitor continues blinking. It never stops.
I have loaded the tool Process-Explorer from Sysinternals which shows much more details than the Taskmanager. It shows also the explorer.exe running with <90% and properties --> threads shows SHLWAPI.dll with cycles delta > 1.000.000 and ntdll.dll with cycles delta > 900.000.000 !!

So the computer has Vista SP2 installed, and the DVD only has SP1 installed?

Tom

albert39 · Nov 28, 2010

Hi Tom!

So the computer has Vista SP2 installed, and the DVD only has SP1 installed?

How can I see, whether the DVD contains any SP? The content you will find in the attachment.

Perhaps a new information could help: Please read the additional remark of my last post: Futher I have loaded the "Process Monitor" and see that the explorer.exe continously "CreateFile" und "CloseFile". The path is mostly C:\programs. Because I have not much experience with the Process Monitor: how can I find the process, which steady creates/closes a file?

Albert

tom982 · Nov 29, 2010

albert39 said:
Hi Tom!

So the computer has Vista SP2 installed, and the DVD only has SP1 installed?

How can I see, whether the DVD contains any SP? The content you will find in the attachment.

Perhaps a new information could help: Please read the additional remark of my last post: Futher I have loaded the "Process Monitor" and see that the explorer.exe continously "CreateFile" und "CloseFile". The path is mostly C:\programs. Because I have not much experience with the Process Monitor: how can I find the process, which steady creates/closes a file?

Albert

It should say on the DVD box what service pack it is, although it probably doesn't have a service pack included with the disc.

I'm no expert with Process Explorer so I can't really help you there.

Right now we can have a go at solving your problem:

You may have to do the following in safe mode:

1. Open the start menu and type appwiz.cpl into the search box and run it:

2. Then I want you to click on View installed updates in the column on the left:

It may look a little different because I'm running Windows 7.

3. Then scroll down and find Service Pack for Microsoft Windows (KB948465) and Service Pack for Microsoft Windows (KB936330) and uninstall them:

Tip

YOU MUST UNINSTALL Service Pack for Microsoft Windows (KB948465) BEFORE YOU UNINSTALL THE OTHER ONE

Then reboot your computer and post back to confirm that this has worked

Tom

albert39 · Nov 29, 2010

Thank you Tom!

I believe your strategy is to remove the SPs, then to repair the system with the DVD and finally install SP2 again. Am I right?

I "solved" it with another strategy:

It seems the problem (100% CPU because of a crazy explorer.exe) appears very often. I found in different foren many different suggestions and I tried some of them (but of course not a new installation).
This one worked: Explorer.exe using 100% of my Windows Vista PC

and this discussion led me to process explorer and process monitor:

100 % CPU load in Explorer.Exe - SHLWAPI.dll!Ordinal629+0x161

I understand the difference between removing a symptom and real solution. My method removed the symptom and your method obviously goes to the basics of the problem (surely corrupted files, as the sfc showed).
But after 3 days (unpaid) work I was pleased to get this laptop running again, anyhow.

Many thanks for your help

Albert

tom982 · Nov 29, 2010

albert39 said:
Thank you Tom!

I believe your strategy is to remove the SPs, then to repair the system with the DVD and finally install SP2 again. Am I right?

I "solved" it with another strategy:

It seems the problem (100% CPU because of a crazy explorer.exe) appears very often. I found in different foren many different suggestions and I tried some of them (but of course not a new installation).
This one worked: Explorer.exe using 100% of my Windows Vista PC

and this discussion led me to process explorer and process monitor:

100 % CPU load in Explorer.Exe - SHLWAPI.dll!Ordinal629+0x161

I understand the difference between removing a symptom and real solution. My method removed the symptom and your method obviously goes to the basics of the problem (surely corrupted files, as the sfc showed).
But after 3 days (unpaid) work I was pleased to get this laptop running again, anyhow.

Many thanks for your help

Albert

Great news

I'm glad that the problem has been resolved and if you have any further questions then feel free to ask - it's what were here for

Tschüs

Tom

Solved explorer.exe ist running with 97% CPU

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

Banned

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

٩(͡๏̯͡๏)۶

My Computer

Attachments

My Computer

٩(͡๏̯͡๏)۶

My Computer

Banned

My Computer

Attachments

My Computer

Banned

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

Attachments

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer