4

A C# application I developed writes 300 small (1k) files to a local filesystem (NTFS). During that time explorer.exe uses up to 100% CPU time.

Things I already sorted out:

  • Assured that no explorer windows are open displaying the target folder
  • Excluded indexing for the target folder
  • Expluded indexing for that complete drive
  • Stopped and disabled the services "Windows Search" (SearchIndexer.exe)

All of this with no effect.

When I use Systinternals ProcessExplorer I see one busy thread of explorer.exe that states most of the time:

ntdll.dll!RtIFreeUnicodeString+0x1370

And its stack look like this:

0  msvcrt.dll!memcpy+0x8a
1  SHELL32.dll!Ordinal755+0x75c
2  SHELL32.dll!PathYetAnotherMakeUniqueName+0x35316
3  SHELL32.dll!ExtractIconExW+0xed8
4  SHELL32.dll!ExtractIconW+0x98e5
5  SHELL32.dll!SHChangeNotification_Lock+0x4179
6  SHELL32.dll!DAD_SetDragImage+0x1018
7  SHELL32.dll!DAD_SetDragImage+0x11ef
8  SHCORE.dll!GetProcessReference+0x3f
9  ntdll.dll!RtlDestroyHeap+0x317
10 ntdll.dll!RtlFreeUnicodeString+0x17d5
11 KERNEL32.DLL!BaseThreadInitThunk+0xd
12 ntdll.dll!RtlUserThreadStart+0x34

What is explorer.exe doing here? Is there a direct dependency between the filesystem and the explorer? And how can I prevent this behaviour?

9
  • There's no UI thread. Writing happens in an own thread. However, the problem also manifests in the corresponding UnitTest, that just generated all these files
    – Seven
    Apr 19, 2016 at 13:48
  • You could use a tool like Process Explorer to find out what the busiest threads of Explorer.exe are actually doing. Apr 19, 2016 at 13:51
  • @Axel Kemper: I add some output of ProcessExplorer. At position 5 it says "SHChangeNotification_Lock". Is explorer notifying some processes about each new file?
    – Seven
    Apr 19, 2016 at 14:06
  • 1
    Are you initiallizing and freeing a "string" or other object inside a loop? Are you able to allow a doevents call every nth iteration?
    – Yorik
    Apr 19, 2016 at 14:15
  • antivius is off? no other programs with filesystem hooks that might be reading the file?
    – Keltari
    Apr 19, 2016 at 15:20

1 Answer 1

4

Thanks to all your comments. I was able to track down the consumed CPU time to Windows Defender which was notified about new files by explorer.exe

Excluding some relevant directories there helped.

The thing that puzzled me was the fact that the CPU was consumed by explorer, not by defender... Otherwise it would have been more obvious

1
  • Apps can ask explorer to monitor a directoryfor changes. That's probably why Explorer got involved. May 2, 2016 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.