Odd CPU Behaviour

[calc]

I've noticed that sometimes, while trying to interact with a random file or folder, such as trying to delete it, move it or rename it, Explorer.exe steals roughly 25% of my CPU after each attempt (which always results in a hang). I have also noticed that this is particularly true when trying to delete/move/rename any file with the .dat extension.
I've found (using Process Explorer) that the following process thread is the one that uses the 25% CPU:

After killing each ntdll.dll thread, explorer.exe restarts and the CPU is back to normal.
I have also found that the same issue arises after every time I save an image from Google Chrome to my desktop (that is right clicking on an image and clicking 'save image as').
I have run multiple scans for viruses and malware, but neither have returned with any effective results.

My CPU is an AMD Phenom X4 9750 with 2.40GHz.
I also have 4GB of RAM and am using Windows Vista Home Premium, SP 2 32bit.

Any ideas?

 

[richc46]

Welcome
Lets make sure that the most serioius problem is not the cause
Run a full and updated antivirus scan
Download malwarebytes and run a full updated scan.
Report back
I see that you mention that it was already done. Was it updated and full scans?

 

[richc46]

If you feel that you did the scans properly. Try in clean boot and see if that helps to resolve the problem
How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

 

[calc]

I used SUPERAntiSpyware, Malware Bytes and Microsoft Security Essentials, all of which are fully updated, none showing any signs of infection.
I'll try the clean boot and get back to you.

 

[calc]

I tried all three scans again with a clean boot and still no infections have been found.

 

[richc46]

No you used the clean boot incorrectly and you are not doing the scans correctly
Those scans should take about an hour each. Make sure you are doing the full scan a quick scan.
The clean boot is done without the scans. Make a clean boot, if the problem is gone follow procedure to find the cause
Good luck

 

[niemiro]

Hello, and welcome to the Vista Forums!

Please can you go back to those threads, and single click on it, and then click on the Stack button > Copy all, and paste the results here. Please paste about three examples if they differ.

My worry is that it will look something like this:

ntkrnlpa.exe!KeWaitForMultipleObjects+0xabc
ntkrnlpa.exe!KeWaitForSingleObject+0x492
ntkrnlpa.exe!KeTestAlertThread+0x78
ntkrnlpa.exe!KeSetTimerEx+0x78e
ntkrnlpa.exe!KeRemoveQueueEx+0x741
ntkrnlpa.exe!IoSetIoCompletionEx+0x74
ntkrnlpa.exe!PsGetCurrentProcessWin32Process+0x481
ntkrnlpa.exe!ZwQueryLicenseValue+0xbc6
ntdll.dll!KiFastSystemCallRet
kernel32.dll!BaseThreadInitThunk+0x12
ntdll.dll!RtlInitializeExceptionChain+0x63
ntdll.dll!RtlInitializeExceptionChain+0x36

Allow me to point you to this thread: Windows Explorer uses 100%CPU - Bug Report

@Vishal Gupta's answer.

Does that sound possible in this case? I have seen this before, and that was exactly the problem, although it could be a 3rd party extension or application.

Richard

 

[calc]

I purposely tried to create the issue a few times and got 3 ntdll.dll problems (75% CPU usage).
The stacks are as follows:
First ntdll.dll (25%)
magixmpegin.dll!mpegInSeekSampleExisting+0x8b06
magixmpegin.dll!mpegSplitOpenFile+0x1d2
magixmpegin.dll!mpegSplitOpenFile+0x1d2

Second ntdll.dll (25%):
magixmpegin.dll!mpegInSeekSampleExisting+0xd909
magixmpegin.dll!mpegInSeekSampleExisting+0xdf39
magixmpegin.dll!mpegInSeekSampleExisting+0x8b52
magixmpegin.dll!mpegSplitOpenFile+0x1d2
magixspmpeg.ax!DllUnregisterServer+0x2d35

Third ntdll.dll (25%):
magixmpegin.dll!mpegInSeekSampleExisting+0xd90c
magixmpegin.dll!mpegInSeekSampleExisting+0xdf39
magixmpegin.dll!mpegInSeekSampleExisting+0x8b52
magixmpegin.dll!mpegSplitOpenFile+0x1d2
magixspmpeg.ax!DllUnregisterServer+0x2d35
magixspmpeg.ax!DllCanUnloadNow+0x1839
magixspmpeg.ax!DllUnregisterServer+0xc38d
magixspmpeg.ax!DllUnregisterServer+0xc4dd
quartz.dll!DllGetClassObject+0x1336d

That's all from trying to empty the recycle bin while a .dat file that I created in notepad was in the recycle bin. The emptying process would hang, I would be forced to cancel it and the file would still exist in the recycle bin. Normally I would reset the recycle bin in this case, but it's probably not the best solution.

 

[niemiro]

Hello again, calc!

Well, your problem is NOT the standard Vista .zip issue, and is in fact a compatibility issue with codecs from a company called Magix: Music, photo, and video software from the market leader - MAGIX UK

Please can you tell me what Magix software you have installed, and try to update all of it.

Thanks a lot!

Richard

P.S. Do you use this Magix software? Did you pay for it? Would uninstalling it be an option?

 

[calc]

I thought as much.
I think I installed a Magix product quite some time ago, but it was only a trial, and I ended up uninstalling it. But again, that was quite some time ago, and I'm unsure as to when my current problem actually began to occur.

 

[niemiro]

Hello!

Well, the problem is that all of Magix is NOT uninstalled, or there are remnants causing problems. Can you please confirm for me that there is nothing relating to Magix in Uninstall Programs, before I take more "decisive" action.

Thanks a lot!

Richard

 

[Slammer]

Huh. If it is residual Magix software causing an issue (and you can't just use a restore point from before all this madness; that almost always fixes things) I'd reinstall that same trial again (don't worry if it was a timed thing; you won't actually be using it) then use Revo uninstaller or something similar (Revo is just the one I use; no particular reason) to make sure you wipe out everything it put on your computer. Revo Uninstaller - Free software downloads and software reviews - CNET Downloads See if that doesn't fix it for you.

 

[calc]

I happened to find the .dll in a locked folder on my computer somewhere in the program files folder. I deleted it after changing some of the permissions to allow me to delete it and all seems well now. I'll give it a little while before I confirm that everything has been fixed and I'll get back to you.

Thanks for the help guys