Explorer.exe causing excessive page file usage

[JFA]

About two days ago my computer started loading and responding very slowly. I
had a look in Task Manager to determine what process was causing the
problem. I found that explorer.exe was running with over 450M of memory and
page faults over 400K and counting. On the Performance tab, page file usage
was maxed out at 1.32G. The computer is a 1.6GHz P4 with 512M of memory, a
1G fixed size page file, and two hard drives, running XP SP2. I tried
moving the page file with no success. Explorer.exe is difficult to kill,
when I end the process the desktop shuts down but it holds on to the memory
and page file. I discovered that I can kill it using Process Explorer
(procexp.exe) from Sysinternals. I also discovered that I can return to
normal operation if I kill the initial instance of explorer using Task
Manager and while it's deciding if it wants to quit, start another instance
of explorer. Then when I finally beat the initial instance to death using
process explorer, it settles down and behaves with the second instance
running normally. Until the next restart.

There is nothing relevant in the event logs and I can't find anything
pertinent in the knowledgebase ot Google. I suspect a corrupted system file.
Any suggestions on how to fix this problem short of re-imaging would be
appreciated.

 

[Mak]

That sounds like a problem caused by third party explorer shell extension(s)
(providing that you don't have malware). (What changed 2 days ago? What
software did you install?)
1. check for viruses and malware.
2. re-check for viruses and malware.
3. ensure that you have only one explorer.exe, it should be located in
%windir% and a copy located in \system32\dllcache.

4. to narrow down your search, see if this utility can be of any help
http://www.nirsoft.net/utils/shexview.html (disclaimer: I've never used it)
BTW, you can close explorer by going |Start|Shutdown|hold Ctrl+Alt+Shift
while clicking on 'Cancel'

And.. Task Manager has no way of showing *page file usage*. What TM displays
as PF usage in XP and Mem usage in Win2k is commit charge total. (Someone at
Microsoft TM team makes bad decisions.) ProcessExplorer has this label
right.
To see page file usage use System Monitor tool. |Start|Run|Perfmon| in
Performance object Paging file, add counter %usage. Displayed result is a
percentage of your current allocated page file size.