I have a Windows 64 bit Pro laptop with Intel Core 55 processor. I noticed that whenever I start my system, explorer.exe has a CPU spike consistently consuming 24-30% CPU all the time even if there are no explorer windows. I ran Process Explorer and double-clicked to look at the thread stack. SHLWAPI.dll!SHRegGetUSValueW seems to consume all the CPU. How do i find the cause further?
migrated from serverfault.com Oct 9 '11 at 9:55
This question came from our site for professional system and network administrators.
I've done a rudimentary analysis and it seems that it's SearchIndexer.exe that's calling the shots. (it seems to be doing the hard labor for SearchIndexer.exe which is active at the same time)
You can use
As @syneticon-dj mentions in his comment, it's accessing a registry value.
I have similar behavior (same CPU spike, same culprit on the call stack), and I've identified several registry accesses that appear to be related to some network shares I've mapped as drives that are marked as "reconnect at logon."
For instance, I've mapped
RegQueryValue (NAME NOT FOUND):
I know I'd previously opened a few files (in Notepad++) from that drive by browsing with explorer.exe and using the context menu's "Edit with Notepad++" command.
Oddly, though, I also have other shares mapped and files open currently and am not seeing the same registry accesses for those shares.
Despite closing all files and no longer having the Explorer window open to that drive, I was still seeing the registry accesses.
Once I hit the red X to close the Explorer window, I never saw any more registry accesses from that thread. That's despite the same explorer.exe process remaining alive according to Process Explorer, and the same TID (still showing
If anyone can provide more commentary on what I'm seeing here, I'd love the input. I'm especially confused by the registry access only occurring for one of the shares I have mapped. Also, I would have expected the explorer process to terminate when I closed the window, but that did not happen (it sometimes does). Reopening Explorer from the taskbar "pin" results in a fresh Explorer window from the original explorer.exe process (same PID and start time).