Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Windows 7 64bit.

I am using ProcessExplorer from Sysinternals, and it says, that the offending call is

ntdll.dll!RtlValidateHeap+0x170

however, the call stack towards the entry is always different, so it's hard for me to track the problem. Maybe it's a mal-programed trojan, causing exceptions in Explorer.exe, but that is only a wild speculation.

Explorer.exe is then consuming 25% (a core on a dual core). Killing the process makes the task bar go away, respawning from task manager, and half a minute later it's again eating all CPU cycles.

share|improve this question
    
I suspect a DLL that isn't releasing resources for some reason. What plugins do you have installed? –  user3914 Sep 16 '12 at 18:29
1  
It's most likely a shell extension. You can use autoruns to identify all shell extensions. –  David Schwartz Sep 16 '12 at 21:39
add comment

1 Answer

Use SysInternal's sister program, Process Monitor, to see what it's actually doing.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.