Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite
1

I have a Windows 64 bit Pro laptop with Intel Core 55 processor. I noticed that whenever I start my system, explorer.exe has a CPU spike consistently consuming 24-30% CPU all the time even if there are no explorer windows. I ran Process Explorer and double-clicked to look at the thread stack. SHLWAPI.dll!SHRegGetUSValueW seems to consume all the CPU. How do i find the cause further?

share|improve this question
The function simply retrieves a registry value - you should look at the call stack to see what's calling it every so often. I would suspect some explorer extension doing this. But your question is rather a debugging question - I believe you should be served better over on stackoverflow – syneticon-dj Oct 9 '11 at 8:52
To much for me, before I am going to try and figure out what a schuZelgap and a ShlingWrp is :-) I am certannly going to task end some processes to see when it stops first. Then I would hop into Safe mode, where an explorer and browser still functions, and see if it is still there. Then put both values into Google, and see that the whole universe has a (different) problem with them. Attempt to find out what Program is hooked or attached or riding off the explorer or Browser or messenger like that. by Stopping stuff. – Psycogeek Oct 9 '11 at 13:15

migrated from serverfault.com Oct 9 '11 at 9:55

1 Answer

up vote 0 down vote

You can use procmon.exe with a filter for the thread you've identified as spiking (the TID) and see more detail what that thread's doing.

As @syneticon-dj mentions in his comment, it's accessing a registry value.

I have similar behavior (same CPU spike, same culprit on the call stack), and I've identified several registry accesses that appear to be related to some network shares I've mapped as drives that are marked as "reconnect at logon."

For instance, I've mapped \\machine\c$\ as my X: drive, and I see these corresponding accesses:

RegOpenKey (SUCCESS): HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##machine#c$

RegQueryValue (NAME NOT FOUND): HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##machine#c$\_LabelFromReg

RegCloseKey (SUCCESS): HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##machine#c$

I know I'd previously opened a few files (in Notepad++) from that drive by browsing with explorer.exe and using the context menu's "Edit with Notepad++" command.

Oddly, though, I also have other shares mapped and files open currently and am not seeing the same registry accesses for those shares.

Despite closing all files and no longer having the Explorer window open to that drive, I was still seeing the registry accesses.

Once I hit the red X to close the Explorer window, I never saw any more registry accesses from that thread. That's despite the same explorer.exe process remaining alive according to Process Explorer, and the same TID (still showing SHLWAPI.dll!SHRegGetUSValueW+0x1a4 as the start address) still existing (in a Wait:UserRequest state).

If anyone can provide more commentary on what I'm seeing here, I'd love the input. I'm especially confused by the registry access only occurring for one of the shares I have mapped. Also, I would have expected the explorer process to terminate when I closed the window, but that did not happen (it sometimes does). Reopening Explorer from the taskbar "pin" results in a fresh Explorer window from the original explorer.exe process (same PID and start time).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.