99-100% Explorer Processor Usage

[brayogee]

True.

A user reported that "tried to upgrade norton antivirus to norton
internet security via the internet. After the upgrade explorer.exe is
hogging the cpu. It's running at 100%. I removed all norton
applications but still explorer.exe is 100%. There is a second user
configured and that ID doesn't have a problem. In safe mode both id's
work fine. I stop all applications and services in msconfig but it
doesn't help."
Ref: http://www.experts-exchange.com/Operating_Systems/Q_21362128.html

Workaround: Creating a new user

Possible Test Action:

-Add a NEW user group with similar permissions to the one currently
created for users and add a test user.
-Logon to a select PC affected by the freezing as the new user.
-Running the custom application as was the case earlier and monitor if
any 'explorer.exe' 99-100% incidents are reported from this PC with the
new user signed on.

Will also try this to confirm that corrupt user profiles as affected by
an anti-virus update are not at all contributing to the problem.

 

[brayogee]

Update: Using the 'Process Explorer' tool to kill the PccNTMon.exe
process (right clicking -> kill) had no effect on the
'explorer.exe' 99-100% CPU usage.

 

[JS]

Does this mean that OSA is the only suspect remaining?

JS

 

[brayogee]

1. Correction: Turns out that Task Manager was the one used to kill the
PccNTMon.exe
process and not Process Explorer. This action had no effect on the
'explorer.exe' 99-100% CPU usage.
I'm not certain using Process Explorer to do the same will make a
difference. However, I'll update with results of this action as earlier
expected.

2. Disabling of the anti-virus run on affected PCs is meant to be
carried out. If the 'explorer.exe' 99-100% CPU usage still occurs,
OfficeScan as a sole 'entity' will be ruled out.

Investigating the OSA.EXE process will be carried shortly after this.

 

[brayogee]

Disabling of the anti-virus run on four affected PCs by setting them as
'disabled' and ensuring they require 'manual' starts was done.

'explorer.exe' still shot up to 99-100%. OfficeScan as a sole 'entity'
has been ruled out.

 

[JS]

It's possible you may have a Rootkit (a form of virus that is completely
hidden) on your PC.
I'm assuming that the custom application is not installed.

JS

 

[brayogee]

Action Results:
The custom application is installed on all test PCs.
(a). Using 'Process Explorer' to kill 'PccNTMon.exe' - Process/Process
Tree - had no effect on the existing 'explorer.exe' 99-100% CPU usage
problem.
(b). Killing OSA.EXE using 'Process Explorer' had no effect on the
existing 'explorer.exe' 99-100% CPU usage problem
(c). After formatting a PC and reinstalling just the Windows OS, the
custom application and printer drivers, the 99-100% CPU usage problem
still occurred.

Current Solution Drivers:
(a). (Corrupt) User Profiles: The act of creating new windows user
accounts on at least 3 PCs and using these accounts instead of the old
ones has resulted in no incident reported in these PCs for 3 days so
far. This is an improvement from the average 1(one) incident per day.

(b). As indicated, presence of a Rootkit can't be ruled out yet as no
tests on this angle have been carried out.

Solution driver (a) above seems the most plausible cause at this time.

 

[brayogee]

Corrupt User Profiles Update: The act of creating new windows user
accounts on at least 3 PCs and using these accounts instead of the old
ones has resulted in no incident reported in any of these PCs for
6(six) days so
far. This is an improvement from the average 1(one) incident per day
per PC.

It can be concluded that Corrupt User Profiles were the cause of the
'explorer.exe' 99-100% CPU usage.

 

[JS]

Well you solved it, good job tracking it down!

JS

 

[brayogee]

Cheers mate. Thank for being a guiding light along the process.