Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 64 bit Pro laptop with Intel Core 55 processor. I noticed that whenever I start my system, explorer.exe has a CPU spike consistently consuming 24-30% CPU all the time even if there are no explorer windows. I ran Process Explorer and double-clicked to look at the thread stack. SHLWAPI.dll!SHRegGetUSValueW seems to consume all the CPU. How do i find the cause further?

share|improve this question

migrated from Oct 9 '11 at 9:55

This question came from our site for system and network administrators.

The function simply retrieves a registry value - you should look at the call stack to see what's calling it every so often. I would suspect some explorer extension doing this. But your question is rather a debugging question - I believe you should be served better over on stackoverflow – syneticon-dj Oct 9 '11 at 8:52
To much for me, before I am going to try and figure out what a schuZelgap and a ShlingWrp is :-) I am certannly going to task end some processes to see when it stops first. Then I would hop into Safe mode, where an explorer and browser still functions, and see if it is still there. Then put both values into Google, and see that the whole universe has a (different) problem with them. Attempt to find out what Program is hooked or attached or riding off the explorer or Browser or messenger like that. by Stopping stuff. – Psycogeek Oct 9 '11 at 13:15

I've done a rudimentary analysis and it seems that it's SearchIndexer.exe that's calling the shots. (it seems to be doing the hard labor for SearchIndexer.exe which is active at the same time)

share|improve this answer

You can use procmon.exe with a filter for the thread you've identified as spiking (the TID) and see more detail what that thread's doing.

As @syneticon-dj mentions in his comment, it's accessing a registry value.

I have similar behavior (same CPU spike, same culprit on the call stack), and I've identified several registry accesses that appear to be related to some network shares I've mapped as drives that are marked as "reconnect at logon."

For instance, I've mapped \\machine\c$\ as my X: drive, and I see these corresponding accesses:

RegOpenKey (SUCCESS): HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##machine#c$

RegQueryValue (NAME NOT FOUND): HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##machine#c$\_LabelFromReg

RegCloseKey (SUCCESS): HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##machine#c$

I know I'd previously opened a few files (in Notepad++) from that drive by browsing with explorer.exe and using the context menu's "Edit with Notepad++" command.

Oddly, though, I also have other shares mapped and files open currently and am not seeing the same registry accesses for those shares.

Despite closing all files and no longer having the Explorer window open to that drive, I was still seeing the registry accesses.

Once I hit the red X to close the Explorer window, I never saw any more registry accesses from that thread. That's despite the same explorer.exe process remaining alive according to Process Explorer, and the same TID (still showing SHLWAPI.dll!SHRegGetUSValueW+0x1a4 as the start address) still existing (in a Wait:UserRequest state).

If anyone can provide more commentary on what I'm seeing here, I'd love the input. I'm especially confused by the registry access only occurring for one of the shares I have mapped. Also, I would have expected the explorer process to terminate when I closed the window, but that did not happen (it sometimes does). Reopening Explorer from the taskbar "pin" results in a fresh Explorer window from the original explorer.exe process (same PID and start time).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .