Problem:CPU @ 100% once I open "My Documents"

Dave Van Ronk

My CPU maxes only when I open my documents...The script responsible is ntdll.dll!rtlAllocateHeap+0x18c

Im pretty sure I'm virus free as spyboy and Mcafee have found zilch.

Has anyone had this experience?

funk-you

Moved to C&T.

OP, what processes are spiking when you open the folder. Do you have any mapped folders in MD?

-Funk

practice

Have you got auto updates on. Read somewhere that auto updates can cause this.
Can you use task manager and see what is running so high a usage.

ressem

You're running XP?
You got that information from Process Explorer, right clicking on explorer and seeing this as the thread that was eating up your CPU?

That line isn't a process. It's a memory allocation routine in a thread being called by some unknown process. This process is presumably something that's hooked into explorer (e.g. all those shell handlers that are used when you right click).

In process explorer, under the explorer.exe section, is the high CPU under a rundll32.exe entry? If so if you hover the mouse over the entry then it'll list the target program that rundll is being used to run.

PogMoThoin

To start, uninstall McAfee and get a better free alternative, give your pc a whole new lease of life. McAfee is a hog

ronkmonster

Try run this
http://www.bleepingcomputer.com/download/anti-virus/combofix

Can remove some stuff that malwarebytes can't find.

Dave Van Ronk

ressem wrote: »

You're running XP?
You got that information from Process Explorer, right clicking on explorer and seeing this as the thread that was eating up your CPU?

That line isn't a process. It's a memory allocation routine in a thread being called by some unknown process. This process is presumably something that's hooked into explorer (e.g. all those shell handlers that are used when you right click).

In process explorer, under the explorer.exe section, is the high CPU under a rundll32.exe entry? If so if you hover the mouse over the entry then it'll list the target program that rundll is being used to run.

Thanks for all the help guys...

I've attached a screenshot of this problem.

As you can see, i've real trouble trying to identify the spike culprit.

Dave Van Ronk

funk-you wrote: »

Moved to C&T.

OP, what processes are spiking when you open the folder. Do you have any mapped folders in MD?

-Funk

Hi Funk,

All I can see is that explorer.exe goes through the roof as soon as I open "My Documents"..I go to process explorer and suspend the threat but then this disables MD.I have no mapped folders that I'm aware of. A really strange situation that i've never encountered before.The web is flush with this problem but no solution I've found yet. I can open my pictures and my music folders no probs, but for some reason, MD is a no-no.

ressem

Ok select that entry, then click on the 'stack' button below.

This should list the trail of threads that lead to this ntdll being called.
If you provide this list then we might be able to find the item at fault.

Dave Van Ronk

ressem wrote: »

Ok select that entry, then click on the 'stack' button below.

This should list the trail of threads that lead to this ntdll being called.
If you provide this list then we might be able to find the item at fault.

~Ok I clicked stack and got the screenshot below:

I then suspended and resumed the threat and got this:

ntkrnlpa.exe!KiUnexpectedInterrupt+0x8d
ntkrnlpa.exe!PsLookupThreadByThreadId+0x4abc
ntkrnlpa.exe!KiDeliverApc+0xb3
hal.dll+0x2c35
AviSplitter.ax+0xfc05
AviSplitter.ax+0x37f4

Not sure what this avisplitter is about...Is this the culprit?

ronkmonster

Do you have a codec pack installed?

Dave Van Ronk

ronkmonster wrote: »

Do you have a codec pack installed?

Pretty sure I do as I've never had an issue with viewing/editing video files before..

SickBoy

If you have thumbnail view set change it to list view and see if it changes anything. If this resolves it then you have a codec issue.

ronkmonster

Try removing it and installing the latest version.
They tend to install extra utilities along with the codecs

Razzuh

Hi,
Do you have video files? It sounds to me like a media preview problem. It'll happen when you view the folder as thumbnails or if you click on a problem file (or it's the first file in the folder). Windows tries to take a small image capture from video files to display in the sidebar on the left. Issues like yours occur when a codec is unsupported or a file is corrupted (maybe a partial download). I've included options for image preview below, but it's almost certain to be the media preview that's the problem.

Try this:
1) Open a command window (Start->Run, type in 'cmd' hit enter) In the window that opens type these commands to turn on and off media preview (it's seperate for images and video)

2) To remove image preview, type this and hit enter:
regsvr32 /u shimgvw.dll

3) To restore image preview, type this and hit enter :
regsvr32 shimgvw.dll

4) To remove media preview, type this and hit enter :
regsvr32 /u shmedia.dll

5) To restore media preview, type this and hit enter :
regsvr32 shmedia.dll

I don't think you'll miss media preview if you turn it off, the thumbnail for videos is the first frame of a video which is usually all black. The only thing you might miss is stuff like the 'length' for audio and video files and tags like 'artist' 'title' etc. that you will no longer be able to see for media files in explorer, because they're part of the same service.

ressem

Rather than disabling all media previews, it should be possible to do a search for avisplitter.ax under program files. What directory is it uninstalled under (k-lite?) and can that program be uninstalled/ upgraded?

Otherwise open a command window as administrator, cd to that directory.
then

regsvr32 /u avisplitter.ax

Or if you open autoruns from sysinternals, it may appear in the list under the 'explorer' tab in which case you can deselect it.

Dave Van Ronk

Turns out it was this recently installed program called Format Factory that was the problem. I searched for the avisplitter.ax file and found him in the Format Factory folder. I changed the extension to .bax and hey presto..prob solved.

Thanks for all the help guys in solving this...Back in business:D

Dave Van Ronk

PogMoThoin wrote: »

To start, uninstall McAfee and get a better free alternative, give your pc a whole new lease of life. McAfee is a hog

The NUIG University IT department here has free McAfee antivirus for students, so i've always used it.

...A bit off topic but what antivirus do you use?

PogMoThoin

Dave Van Ronk wrote: »

The NUIG University IT department here has free McAfee antivirus for students, so i've always used it.

...A bit off topic but what antivirus do you use?

If you don't mind paying for one, Nod32
http://www.eset.ie/
Its very easy on system resources and its detection rates are great. It also doesn't nag. Its what I use myself on all 3 pc's

For free I'd recommend Avast
http://www.avast.com/en-eu/index
They will make you register with your email and will try to tempt you buy the paid version but read on through the small print and see the option for the free version