Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Every so often I seem to get very high CPU usage from explorer.exe. I'll be working happily for a while, then suddenly my PC grinds to a halt. I used Procmon.exe to see what was going on, and what I can see is lots of IRP_MJ_* messages accessing files on a network share:

Explorer spending CPU cycles looking at network files

This is one folder with a bunch of folders and occasionally I need to copy some files out of that share to somewhere else. Some of the less used folders have been zipped up to save space, and it seems to be these zipped folders that Explorer is accessing.

This occurs even after I close all my Explorer windows - I wondered if a shell extension was causing it so I opened a few events to look at the stacks but didn't see anything out of the ordinary.

CPU stacks of an IRP_MJ_CREATE event

As you can see, this is all Microsoft stuff - I also used signtool to verify EXPLORERFRAME.dll and zipfldr.dll just in case. Any ideas on why Explorer might feel the need to do this would be appreciated.

My OS is Windows 2008 R2 SP1 x64.

Thanks

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I suspect the problem is with Windows' built-in support for making zip files appear to be folders. In previous versions it could be turned-off as described in the Windows Annoyances article titled How do I turn off Compressed Folders (built-in support for ZIP files) in Windows Vista and XP? -- which may still apply.

share|improve this answer
    
I'd kind of come to the same conclusion (and actually seen that same article). I don't quite understand why Explorer feels the need to examine that collection of zips in particular (or why you can't disable this without deleting COM entries from the registry but that's a separate issue). I might delete those entries though and see if it helps... –  JohnL Aug 9 '12 at 12:04
    
@JohnL: Save the registry entries before you delete them so you can restore them if it doesn't help. –  martineau Aug 9 '12 at 12:41
    
Well, yeah! Interestingly, the registry permissions for those keys were messed up and administrators only had read rights to them. I had to force ownership in order to delete them. That probably hints at a deeper issue –  JohnL Aug 9 '12 at 12:51

Could it be your antivirus? I can recall having a similar issue when I was experimenting with two antivirus products side by side on my machine two years ago. Try disabling your antivirus, only enable firewall to shield yourself from the network and see how it goes.

share|improve this answer
    
It's possible I suppose. I'm not using two antivirus products - we have SEP by corporate decree. Using 2 at once is usually a bad idea anyway because they end up killing each other. Were the AV products trying to scan the files on the network? –  JohnL Aug 9 '12 at 12:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.