Explorer is bloated

Evan Patton · Jun 19, 2004

Maybe this is supposed to happen, but i'm not sure. My
Explorer.exe uses 60 MB of RAM on average. Is there any
way to fix this?

Evan

Gerry Cornell · Jun 20, 2004

Evan

Your question prompted me to look at what my Explorer.exe was "using". A number of applications are dependent are explorer.exe as you could see if you used Process Explorer.

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

However, unless you discover that spyware is implicated I am not sure whether you need to be bothered by 60 mb usage as RAM is there to be used. Look at the processes using explorer.exe and ask questions about any components you are not sure about.

--

~~~~~~

Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

~~~~~~~~~~~~~~~~~~~~~~~~

m scorfield · Jun 21, 2004

my explorer was also bloated and for some reason tieing up 100% of the cpu
with little running on it. This is the log from process explorer at the time
it was really slow. Is this normal?

Process: explorer.exe Pid: 1644

Type Name
Desktop \Default
Directory \Windows
Directory \BaseNamedObjects
Directory \KnownDlls
Event \BaseNamedObjects\userenv: User Profile setup event
Event \BaseNamedObjects\crypt32LogoffEvent
Event \BaseNamedObjects\ShellReadyEvent
Event \BaseNamedObjects\HPlugEjectEvent
Event \BaseNamedObjects\mixercallback
Event \BaseNamedObjects\hardwaremixercallback
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File C:\Documents and Settings\sparkymark\Desktop
File C:\Documents and Settings\All Users\Desktop
File C:\Documents and Settings\sparkymark\Local Settings\Application
Data\Microsoft\CD Burning
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File \Device\NamedPipe\ntsvcs
File C:\Documents and Settings\sparkymark\Start Menu
File C:\Documents and Settings\sparkymark\Cookies\index.dat
File \Device\KsecDD
File C:\Documents and Settings\All Users\Start Menu
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File \Device\Tcp
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File \Device\Tcp
File \Device\Ip
File \Device\Ip
File \Device\Ip
File C:\Documents and Settings\sparkymark\Application
Data\Microsoft\Internet Explorer\Quick Launch
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File \Device\KSENUM#00000001\{9B365890-165F-11D0-A195-0020AFD156E4}
File C:\Documents and Settings\sparkymark\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File C:\Documents and Settings\sparkymark\Local
Settings\History\History.IE5\index.dat
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File C:\Documents and Settings\sparkymark\Favorites\Links
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File \Device\WMIDataDevice
File C:\Documents and Settings\sparkymark\PrintHood
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
File \Dfs
File C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
File D:\RESCUE PACK 2
File C:\Documents and Settings\sparkymark
File
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
..10.0_x-ww_f7fb5805
Key HKCU\Software\Classes
Key HKCU\Software\Microsoft\Plus!\Themes\Apply
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCR\http\shell
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKLM
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Key HKCU\Software\Microsoft\Windows\ShellNoRoam
Key HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Key HKCU\Software\Microsoft\Windows\Shell
Key HKCU\Software\Classes
Key HKU
Key HKCU\Software\Classes
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCR\CLSID
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKLM\SOFTWARE\Microsoft\Windows\Shell
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCR\Applications\vlc.exe
Key HKCU\Software\Classes
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700
-EF1F-11D0-9888-006097DEACF9}\Count
Key
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780
-7743-11CF-A12B-00AA004AE837}\Count
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage
Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters
Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters
Key HKCU
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKLM\SYSTEM\Setup
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Key HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\2\Shell
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Microsoft\Internet Explorer\TypedURLs
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCU\Software\Classes
Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\World Full
Access Shared Parameters
Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Key HKCR
Key HKCU\Software\Classes
Key HKCU\Software\Classes
Key
HKCU\Software\Microsoft\Windows\ShellNoRoam\DUIBags\ShellFolders\{F3364BA0-6
5B9-11CE-A9BA-00AA004AE837}
Key HKCU\Software\Classes
Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
Key HKCU\Software\Classes
Key HKCR
Key HKCU\Software\Classes
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKU
Key HKCR
Key HKU
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKCR\CLSID
Key HKCR
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKU
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKCR\CLSID
Key HKCU\Software\Classes
KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent
Mutant
\BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-1123561945-1202660629-854245
398-1003
Mutant
\BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-1123561945-1202660629-8542453
98-1003
Mutant
\BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-1123561945-1202660629-854
245398-1003
Mutant
\BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-1123561945-1202660629-854
245398-1003
Mutant
\BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-1123561945-1202660629-8542453
98-1003
Mutant
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1123561945-1202660629-
854245398-1003MUTEX.DefaultS-1-5-21-1123561945-1202660629-854245398-1003
Mutant
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1123561945-1202660629-
854245398-1003MUTEX.DefaultS-1-5-21-1123561945-1202660629-854245398-1003
Mutant \BaseNamedObjects\WininetStartupMutex
Mutant \BaseNamedObjects\_!MSFTHISTORY!_
Mutant \BaseNamedObjects\c:!documents and settings!sparkymark!local
settings!temporary internet files!content.ie5!
Mutant \BaseNamedObjects\_SHuassist.mtx
Mutant \BaseNamedObjects\ZonesCounterMutex
Mutant \BaseNamedObjects\ZonesCacheCounterMutex
Mutant \BaseNamedObjects\WininetConnectionMutex
Mutant \BaseNamedObjects\c:!documents and settings!sparkymark!cookies!
Mutant \BaseNamedObjects\c:!documents and settings!sparkymark!local
settings!history!history.ie5!
Mutant \BaseNamedObjects\MidiMapper_modLongMessage_RefCnt
Mutant
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1123561945-1202660629-
854245398-1003MUTEX.DefaultS-1-5-21-1123561945-1202660629-854245398-1003
Mutant \BaseNamedObjects\MidiMapper_Configure
Mutant \BaseNamedObjects\MSCTF.Shared.MUTEX.AL
Mutant
\BaseNamedObjects\MSCTF.GCompartListMUTEX.DefaultS-1-5-21-1123561945-1202660
629-854245398-1003
Mutant \BaseNamedObjects\WininetProxyRegistryMutex
Mutant \BaseNamedObjects\MSCTF.Shared.MUTEX.AFD
Mutant \BaseNamedObjects\ExplorerIsShellMutex
Mutant \BaseNamedObjects\MSCTF.Shared.MUTEX.AL
Mutant \BaseNamedObjects\ShimCacheMutex
Port \RPC Control\OLE7563E30F7E3643389BC6DC522315
Section
\BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-1123561945-1202660629-85424
5398-1003
Section \BaseNamedObjects\WDMAUD_Callbacks
Section \BaseNamedObjects\UrlZonesSM_sparkymark
Section \BaseNamedObjects\C:_Documents and
Settings_sparkymark_Cookies_index.dat_81920
Section \BaseNamedObjects\C:_Documents and Settings_sparkymark_Local
Settings_Temporary Internet Files_Content.IE5_index.dat_49152
Section \BaseNamedObjects\C:_Documents and Settings_sparkymark_Local
Settings_History_History.IE5_index.dat_16384
Section \BaseNamedObjects\mmGlobalPnpInfo
Section \BaseNamedObjects\WDMAUD_Path_Size
Section
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1123561945-1202660629-
854245398-1003SFM.DefaultS-1-5-21-1123561945-1202660629-854245398-1003
Section \BaseNamedObjects\MSCTF.Shared.SFM.AL
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.MC.HNEEB
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.EE.CNEOD
Section
\BaseNamedObjects\MSCTF.GCompartListSFM.DefaultS-1-5-21-1123561945-120266062
9-854245398-1003
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.JC.HNEEB
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.NC.HNEEB
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.OC.HNEEB
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.KC.HNEEB
Section \BaseNamedObjects\MSCTF.Shared.SFM.AFD
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.LC.HNEEB
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.AD.HNEEB
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.PC.HNEEB
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.ID.MGILD
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.BE.CNEOD
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.GD.MGILD
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.AE.CNEOD
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.DE.CNEOD
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.JD.MGILD
Section \BaseNamedObjects\MSCTF.Shared.SFM.AL
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.HD.MGILD
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.KD.MGILD
Section \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.AL.CE.CNEOD
Section \BaseNamedObjects\ShimSharedMemory
Section \BaseNamedObjects\__R_000000000007_SMem__
Semaphore \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore \BaseNamedObjects\PowerProfileRegistrySemaphore
Semaphore \BaseNamedObjects\shell.{6D5313C0-8C62-11D1-B2CD-006097DF8C11}
Semaphore \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
Semaphore \BaseNamedObjects\shell.BitBucket.NumDeleters
Semaphore \BaseNamedObjects\shell.BitBucket.GlobalDirtyCount
Semaphore \BaseNamedObjects\shell.{090851A5-EB96-11D2-8BE4-00C04FA31A66}
Thread explorer.exe(1644): 1648
Thread explorer.exe(1644): 168
Thread explorer.exe(1644): 176
Thread explorer.exe(1644): 184
Thread explorer.exe(1644): 192
Thread explorer.exe(1644): 244
Thread explorer.exe(1644): 244
Thread explorer.exe(1644): 1348
Thread explorer.exe(1644): 404
Thread explorer.exe(1644): 536
Thread explorer.exe(1644): 1572
Thread explorer.exe(1644): 1736
Thread explorer.exe(1644): 3388
Thread explorer.exe(1644): 3380
Token NT AUTHORITY\SYSTEM
Token KING-QSD5J3JDYI\sparkymark
WindowStation \Windows\WindowStations\WinSta0
WindowStation \Windows\WindowStations\WinSta0

Evan

Your question prompted me to look at what my Explorer.exe was "using". A
number of applications are dependent are explorer.exe as you could see if
you used Process Explorer.

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

However, unless you discover that spyware is implicated I am not sure
whether you need to be bothered by 60 mb usage as RAM is there to be used.
Look at the processes using explorer.exe and ask questions about any
components you are not sure about.

--

~~~~~~

Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

~~~~~~~~~~~~~~~~~~~~~~~~

Gerry Cornell · Jun 22, 2004

That is a formidable list. Whilst I recognise some of the entries there are a number I have not seen before. I have to say, however, that I am no expert on interpreting such a list.

How are you with regard to checking for viruses and spyware. Do you have a Firewall installed?

You should update your virus definitions and run full anti-virus scan. If you do not have anti-virus programme installed you can run a free scan from the internet. Try this link:
http://housecall.trendmicro.com/housecall/start_corp.asp

Spyware causes many problems. If not installed download Adaware and update Reference file from http://www.lavasoftusa.com/support/download/
and use it to remove parasites.

If you are still encountering unexplained processes after trying these measures then you might look at trying other more sophisticated spyware tools.

--

~~~~~~

Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

~~~~~~~~~~~~~~~~~~~~~~~~

m scorfield · Jun 24, 2004

Thank's - i have a virus free , ad free machine according to avg /trend
housecall and spybot search and destroy. i used hijackthis to lop out some
stuff that seems unnecessary , and also installed RC2 of the service pack 2
for win xp and everything seems to be running along quite merrily now.
Incidentally , I came across a discussion elsewhere that says if explorer is
using 100 % of the cpu it may be because the temporary internet files cache
index.dat is corrupt , and by deleting this , it speeds up again.
That is a formidable list. Whilst I recognise some of the entries there are
a number I have not seen before. I have to say, however, that I am no expert
on interpreting such a list.

How are you with regard to checking for viruses and spyware. Do you have a
Firewall installed?

You should update your virus definitions and run full anti-virus scan. If
you do not have anti-virus programme installed you can run a free scan from
the internet. Try this link:
http://housecall.trendmicro.com/housecall/start_corp.asp

Spyware causes many problems. If not installed download Adaware and update
Reference file from http://www.lavasoftusa.com/support/download/
and use it to remove parasites.

If you are still encountering unexplained processes after trying these
measures then you might look at trying other more sophisticated spyware
tools.

--

~~~~~~

Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

~~~~~~~~~~~~~~~~~~~~~~~~

Gerry Cornell · Jun 25, 2004

You need to ensure whenever you scan for virus or spyware that you have the latest definitions remembering that these are changing nearly every day.

There are a number of reasons why Explorer can be using 100% of the CPU processor. I am not sure about the accuracy of the report you quote. I believe I read the same message. What is true is that many users have found that turning off the Indexing service gives a performance boost. It eliminates something frequently running in the background and taking "resources" needed for other operations.

Check your setting for the Indexing Service. Start, Administrative Tools, Services, Indexing
Service. The default setting is Manual. Check that it is not running. More information here:
http://www.blackviper.com/WinXP/service411.htm#Indexing_Service

You can have too many programmes running in the background. Close programmes/windows after
use. Check whether all the programmes loading when Windows is started are really necessary.
http://aumha.org/a/loads.htm

~~~~~~

Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~

Explorer is bloated

Evan Patton

Gerry Cornell

m scorfield

Gerry Cornell

m scorfield

Gerry Cornell