explorer.exe consuming 100% CPU after resuming from hibernation

Hello,

For the last months, I repeatedly have the problem that sometimes (every 2nd or 3rd time) after resuming from hibernation, in a few cases also after disconnecting from the Internet, one or more instances of explorer.exe are consuming 100% CPU, but never the shell instance.

I tried figuring out what it was doing, but I was unsuccessful so far.

Here is a stack of the thread which consumed most of the CPU:

0, ntoskrnl.exe!KiDeliverApc+0x166
1, ntoskrnl.exe!KiSwapThread+0x31f
2, ntoskrnl.exe!KiCommitThreadWait+0x129
3, ntoskrnl.exe!ExpWaitForResource+0x29f
4, ntoskrnl.exe!ExEnterPriorityRegionAndAcquireResourceExclusive+0x1ad
5, win32k.sys!EnterCritAvoidingDitHitTestHazard+0x13
6, win32k.sys!NtUserMessageCall+0x28
7, ntoskrnl.exe!KiSystemServiceCopyEnd+0x13
8, user32.dll!NtUserMessageCall+0xa
9, user32.dll!SendMessageWorker+0x168
10, user32.dll!SendMessageW+0xfb
11, ExplorerFrame.dll!CNscTree::_TreeInvalidateItemInfo+0xd0
12, ExplorerFrame.dll!CNscTree::_EnumBackgroundDone+0xb4a14
13, ExplorerFrame.dll!CNscTree::OnQIUpdateEnumDone+0x93
14, ExplorerFrame.dll!CNscEnumQueueItem::Dispatch+0xcf
15, ExplorerFrame.dll!CTaskLock::DispatchQueueItem+0xc5
16, ExplorerFrame.dll!CNscTree::_SubClassTreeWndProc+0x118
17, ExplorerFrame.dll!CNscTree::s_SubClassTreeWndProc+0x5f
18, comctl32.dll!CallNextSubclassProc+0xe0
19, comctl32.dll!MasterSubclassProc+0xa2
20, user32.dll!UserCallWinProcCheckWow+0x149
21, user32.dll!DispatchMessageWorker+0x1a7
22, AppVEntSubsystems64.dll!VirtualizeCurrentThread+0x1e492
23, ExplorerFrame.dll!CExplorerFrame::FrameMessagePump+0xe3
24, ExplorerFrame.dll!BrowserThreadProc+0x5e
25, ExplorerFrame.dll!BrowserNewThreadProc+0x3a
26, ExplorerFrame.dll!CExplorerTask::InternalResumeRT+0x12
27, ExplorerFrame.dll!CRunnableTask::Run+0x114
28, shell32.dll!CShellTaskThread::ThreadProc+0x2a3
29, shell32.dll!CShellTaskThread::s_ThreadProc+0x2f
30, SHCore.dll!StrRetToBSTR+0x19f
31, kernel32.dll!BaseThreadInitThunk+0x22
32, ntdll.dll!RtlUserThreadStart+0x34

I was hoping I could identify a rogue shell extension or something similar, but I didn't find any such evidence so far.

In case you need this information, this is a list of my shell extensions/copy hooks/context menu handlers/drag&drop handlers (without duplicates):

+ " SkyDrivePro1 (ErrorConflict)"	"Microsoft OneDrive for Business Extensions"	"Microsoft Corporation"	"c:\program files\microsoft office 15\root\vfs\programfilesx64\microsoft office\office15\grooveex.dll"	"12.11.2014 01:13"
+ "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}"	""	"Apache Software Foundation"	"c:\program files (x86)\openoffice 4\program\shlxthdl\shlxthdl.dll"	"20.09.2013 12:50"
+ "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}"	""	"Apache Software Foundation"	"c:\program files (x86)\openoffice 4\program\shlxthdl\shlxthdl_x64.dll"	"20.09.2013 12:41"
+ "7-Zip"	"7-Zip Shell Extension"	"Igor Pavlov"	"c:\program files\7-zip\7-zip32.dll"	"18.04.2011 19:34"
+ "7-Zip"	"7-Zip Shell Extension"	"Igor Pavlov"	"c:\program files\7-zip\7-zip.dll"	"18.04.2011 19:35"
+ "ANotepad++64"	"ShellHandler for Notepad++ (64 bit)"	""	"c:\program files (x86)\notepad++\nppshell_06.dll"	"12.05.2014 10:49"
+ "Ath_CopyHook"	"Bluetooth File Transfer Plugin"	"QualcommAtheros"	"c:\program files (x86)\bluetooth suite\folderviewimpl.dll"	"25.09.2013 10:58"
+ "Atheros"	"Atheros Bluetooth Module"	"QualcommAtheros"	"c:\program files (x86)\bluetooth suite\btvappext.dll"	"25.09.2013 10:58"
+ "DropboxExt"	"Dropbox Shell Extension"	"Dropbox, Inc."	"c:\users\david\appdata\roaming\dropbox\bin\dropboxext64.24.dll"	"24.06.2014 01:32"
+ "DropboxExt1"	"Dropbox Shell Extension"	"Dropbox, Inc."	"c:\users\david\appdata\roaming\dropbox\bin\dropboxext.24.dll"	"24.06.2014 01:31"
+ "FTShellContext"	"Atheros Bluetooth Module"	"QualcommAtheros"	"c:\program files (x86)\bluetooth suite\shellcontextext.dll"	"25.09.2013 10:58"
+ "GDContextMenu"	"Google Drive shell extension"	"Google"	"c:\program files (x86)\google\drive\contextmenu64.dll"	"16.01.2015 01:57"
+ "GDriveBlacklistedOverlay"	"Google Drive shell extension"	"Google"	"c:\program files (x86)\google\drive\googledrivesync64.dll"	"16.01.2015 01:56"
+ "igfxcui"	"igfxpph Module"	"Intel Corporation"	"c:\windows\system32\igfxpph.dll"	"09.09.2013 18:26"
+ "LockHunterShellExt"	"LockHunter Explorer Extension"	"Crystal Rich Ltd"	"c:\program files\lockhunter\lhshellext32.dll"	"25.03.2009 08:53"
+ "LockHunterShellExt"	"LockHunter Explorer Extension"	"Crystal Rich Ltd"	"c:\program files\lockhunter\lhshellext64.dll"	"28.04.2009 10:21"
+ "PDF Shell Extension"	"PDF Shell Extension"	"Adobe Systems, Inc."	"c:\program files (x86)\common files\adobe\acrobat\activex\pdfshell.dll"	"11.05.2013 10:34"
+ "PushbulletCtx"	""	""	"File not found: :/Program Files (x86)/Pushbullet/pushbullet_ctx.DLL"	""
+ "RecuvaShellExt"	"Recuva shell extensions"	"Piriform Ltd"	"c:\program files\recuva\recuvashell64.dll"	"14.03.2014 12:41"
+ "SD360"	"360 Total Security"	""	"c:\program files (x86)\360\total security\menuex64.dll"	"12.01.2015 03:55"
+ "SourceGearDiffMergeShellExtension32"	"SourceGear DiffMerge ShellExtension 32"	"SourceGear LLC"	"c:\program files (x86)\sourcegear\common\diffmerge\sourcegeardiffmergeshellextension32.dll"	"23.10.2013 19:15"
+ "SourceGearDiffMergeShellExtension64"	"SourceGear DiffMerge ShellExtension 64"	"SourceGear LLC"	"c:\program files\sourcegear\common\diffmerge\sourcegeardiffmergeshellextension64.dll"	"23.10.2013 19:17"
+ "StartMenuExt"	"Start Menu Helper Extension"	"IvoSoft"	"c:\windows\syswow64\startmenuhelper32.dll"	"20.04.2014 18:17"
+ "StartMenuExt"	"Start Menu Helper Extension"	"IvoSoft"	"c:\windows\system32\startmenuhelper64.dll"	"20.04.2014 18:16"
+ "WinRAR32"	"WinRAR shell extension"	"Alexander Roshal"	"c:\program files\winrar\rarext32.dll"	"02.12.2014 11:07"
+ "WinRAR"	"WinRAR shell extension"	"Alexander Roshal"	"c:\program files\winrar\rarext.dll"	"02.12.2014 11:07"
+ "WinSCPCopyHook"	"Drag&Drop shell extension for WinSCP (64-bit)"	"Martin Prikryl"	"c:\program files (x86)\winscp\dragext64.dll"	"14.08.2013 12:22"

I you have any clue what might be going, I would be very happy to hear it. It's really annoying, as I have to kill explorer.exe and thereby close all my folder windows when this happens.

Thank you!

Best regards,
David Trapp


  • Edited by CherryDT 15 hours 2 minutes ago
February 2nd, 2015 3:42pm

David

Have you tried running a windows performance recorder trace?  It MAY provide a different view of things for you

In order to diagnose your problem we need to run Windows performance toolkit the instructions for which can be found in this wiki If you have any questions feel free to ask
Please run the trace when you are experiencing the problem

Free Windows Admin Tool Kit Click here and download it now
February 2nd, 2015 3:59pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics