explorer.exe, memory leak

Win7 Pro, 32-bit.

explorer.exe has sprung a slow leak, and it's driving me mad especially
as I'm on 32-bit and only have ~3.5GB available. Eventually I have to
kill and restart it using Task Manager.

I've disabled everything I can using ShellExView, but one problem is
that the right-click menu is context-sensitive, so different options
appear for different file types and it's a pain trying to track them all
down.

Is there an easy way to diagnose this? Google gives me a wild variety
of answers, none of which appeal.

Thanks.

--
(\_/)
(='.'=) systemd: the Linux version of Windows 10
(")_(")

On 02/12/2017 12:01 AM, Mike Tomlinson wrote:

Win7 Pro, 32-bit.

explorer.exe has sprung a slow leak, and it's driving me mad especially
as I'm on 32-bit and only have ~3.5GB available. Eventually I have to
kill and restart it using Task Manager.

I've disabled everything I can using ShellExView, but one problem is
that the right-click menu is context-sensitive, so different options
appear for different file types and it's a pain trying to track them all
down.

Is there an easy way to diagnose this? Google gives me a wild variety
of answers, none of which appeal.

Thanks.



Hi Mike,

Start with the easy stuff first:

1) scan for junkware
https://downloads.malwarebytes.org/file/jrt/


http://www.bleepingcomputer.com/download/adwcleaner/



2) elevate a cmd.exe to administrator and scan for
Windows goofs:

sfc /scannow

This will fix goofs too.

HTH,
-T

Mike Tomlinson wrote:

Win7 Pro, 32-bit.

explorer.exe has sprung a slow leak, and it's driving me mad especially
as I'm on 32-bit and only have ~3.5GB available. Eventually I have to
kill and restart it using Task Manager.

I've disabled everything I can using ShellExView, but one problem is
that the right-click menu is context-sensitive, so different options
appear for different file types and it's a pain trying to track them all
down.

You may not have disabled all shell extensions, especially if they look
like standard ones. [Re]boot Windows into its safe mode. That will not
load any startup programs and also not any non-critical services. One
of those might be loading and be the handler for a shell extension;
i.e., the shell extension points at a handler so see if not loading the
handler resolves the problem.

Also make sure to permanently disable (not necessarily uninstall) any
security software (e.g., anti-virus, firewall, anti-spam, anti-malware,
anti-exploit) before you [re]boot into Windows' safe mode.

En el artículo , T escribió:

1) scan for junkware
https://downloads.malwarebytes.org/file/jrt/

Oh, that looks handy. Thanks.

File System: 6

Successfully deleted: C:\Program Files\mozilla firefox\defaults\pref\itms.js (File)
Successfully deleted: C:\ProgramData\productdata (Folder)
Successfully deleted: C:\Users\mike\AppData\Local\crashrpt (Folder)
Successfully deleted: C:\Users\mike\AppData\Roaming\getrighttogo (Folder)
Successfully deleted: C:\Users\mike\AppData\Roaming\phoenix (Folder)
Successfully deleted: C:\Windows\wininit.ini (File)

Registry: 2

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Search\\SearchAssistan
t (Registry Value)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Search\\SearchAssistan
t (Registry Value)

http://www.bleepingcomputer.com/download/adwcleaner/

I run this regularly, never finds anything, thankfully.

sfc /scannow

which got aborted by the Junkware scanner re-ran it and no problems found.

Thanks for the help.

--
(\_/)
(='.'=) systemd: the Linux version of Windows 10
(")_(")

"Mike Tomlinson" wrote

| 1) scan for junkware
| https://downloads.malwarebytes.org/file/jrt/
|
| Oh, that looks handy. Thanks.

Watch out for that one. I tried MB once out of
curiosity because so many people talk about it.
It listed 10 problems, none of which was
malware. One was that it wanted to delete my
disk imaging software! It's like an idiot yelling
"Fire!". Maybe there's a fire. Maybe there isn't.
You need to go investigate for yourself before
you start swinging the axe.

An easy way to check for shell extensions is
with Autoruns. There's a lot to wade through,
but you can use the Explorer tab to narrow it
down, or you can just look in the company
column for something non-Microsoft.

Also, on the chance that the problem is not
Explorer, you might want to check all the
Autoruns items and also run Process Explorer.

One other note about Process Explorer. You may
already know this, but in case some people don't:

If you select an item in the ProcExplorer window
you can see all files loaded by that process. For
instance, in my case when I select Explorer I see
3 Logitech mouse hook libraries (for providing
special trackball behaviors), 2 DLLs from my
firewall, and a drop handler DLL I wrote myself.
If I have a folder window open then I also see an
Explorer Bar DLL that I wrote myself, along with my
Browser Helper Object DLL that loads the Explorer
bar.

That's an interesting point. Without a folder window
open the Explorer Bar is not loaded. But if I used IE
that would load the Explorer Bar and BHO. Explorer
and IE are so closely tied that I can't prevent loading
by one while still loading in the other. So anytime there
are Explorer problems, IE shouldn't be ruled out. A
shell extension that only shows in IE may still be loading
in Explorer.

Then there are loads of MS DLLs. The average
person will likely also get shell extension DLLs, like
context menu handlers, from software like 7-Zip,
VLC, Libre Office, etc that either load them without
asking or load them by default, unless you uncheck
a box somewhere during install.
Those shell extensions can probably be deactivated
in the autoruns window. In many cases they can also
be stopped by deleting their key under HKCR\*\shellex\.
Though they can also be loading via other classes (file
extensions) under HKCR.

On Sun, 12 Feb 2017 00:17:51 -0800, T wrote:
Hi Mike,

Start with the easy stuff first:

1) scan for junkware
https://downloads.malwarebytes.org/file/jrt/

http://www.bleepingcomputer.com/download/adwcleaner/

Congratulation. You've just told someone to shoot himself on the foot.

"Mayayana" wrote in message news

"Mike Tomlinson" wrote

| 1) scan for junkware
| https://downloads.malwarebytes.org/file/jrt/
|
| Oh, that looks handy. Thanks.

Watch out for that one. I tried MB once out of
curiosity because so many people talk about it.
It listed 10 problems, none of which was
malware. One was that it wanted to delete my
disk imaging software! It's like an idiot yelling
"Fire!". Maybe there's a fire. Maybe there isn't.
You need to go investigate for yourself before
you start swinging the axe.

An easy way to check for shell extensions is
with Autoruns. There's a lot to wade through,
but you can use the Explorer tab to narrow it
down, or you can just look in the company
column for something non-Microsoft.

Also, on the chance that the problem is not
Explorer, you might want to check all the
Autoruns items and also run Process Explorer.

Definitely check the items found before letting any anti-malware etc program
delete or uninstall what it detects.
That is one of the main reasons those programs have an 'exclusions' part
where you can add to.
Overall, MBAM has been among the best of those programs, but no one program
can find them all and all good ones will occasionally find 'false
positives'.
--
Buffalo

On 02/12/2017 07:12 AM, JJ wrote:
On Sun, 12 Feb 2017 00:17:51 -0800, T wrote:
Hi Mike,

Start with the easy stuff first:

1) scan for junkware
https://downloads.malwarebytes.org/file/jrt/

http://www.bleepingcomputer.com/download/adwcleaner/

Congratulation. You've just told someone to shoot himself on the foot.



Explain

En el artículo , T
escribió:

Explain

I predict a deafening silence.

--
(\_/)
(='.'=) systemd: the Linux version of Windows 10
(")_(")

On 02/12/2017 05:19 PM, Mike Tomlinson wrote:
En el artículo , T
escribió:

Explain

I predict a deafening silence.


Hi Mike,

Did the problem clear up? If not, I have more stuff for
you to try.

:-)

-T

En el artículo , T
escribió:

Did the problem clear up?

No

If not, I have more stuff for
you to try.

If you wouldn't mind (and it might be useful info for others).

At the moment I have Task Mangler open with explorer.exe highlighted and
am watching to see if it's any particular action I take that causes it
to go awry. It /might/ be associated with copying large files to
network shares.

explorer.exe is using 48MB currently; when it goes squiffy it rises to
about 600MB and climbs slowly.

Thanks.

--
(\_/)
(='.'=) systemd: the Linux version of Windows 10
(")_(")

On 02/12/2017 11:50 PM, Mike Tomlinson wrote:
En el artículo , T
escribió:

Did the problem clear up?

No

If not, I have more stuff for
you to try.

If you wouldn't mind (and it might be useful info for others).

At the moment I have Task Mangler open with explorer.exe highlighted and
am watching to see if it's any particular action I take that causes it
to go awry. It /might/ be associated with copying large files to
network shares.

Well then, copy something large and see what happens.

First, disable your anti virus, then copy.

Then , try it again with your anvi virus enabled.


explorer.exe is using 48MB currently; when it goes squiffy it rises to
about 600MB and climbs slowly.

Thanks.