{"id":11,"date":"2006-01-12T16:32:12","date_gmt":"2006-01-12T23:32:12","guid":{"rendered":"http:\/\/www.chuonthis.com\/tips\/?p=11"},"modified":"2006-01-12T16:42:47","modified_gmt":"2006-01-12T23:42:47","slug":"explorerexe-100-cpu-webcpldll","status":"publish","type":"post","link":"https:\/\/chuonthis.com\/tips\/2006\/01\/12\/explorerexe-100-cpu-webcpldll\/","title":{"rendered":"Explorer.exe 100% CPU usage after login (webcpl.dll)"},"content":{"rendered":"

Explorer.exe started using 100% CPU about 5 minutes after login. The user had run Spybot<\/a>, Ad-Aware<\/a>, and Trend Micro<\/a> scans and nothing showed up. I took a look at the startup items with msconfig and couldn’t find anything myself. I first ran Process Explorer<\/a> and couldn’t find anything obvious that was hooked into explorer.exe that would cause the problem (moral of the story: I didn’t know how to use Process Explorer). I ran TCPView<\/a> and noticed that at login, explorer.exe was trying to connect to an intercage.com IP address (which didn’t respond to pings). As soon as the TCP connection died, explorer.exe CPU usage jumped to 100%. If I end-tasked explorer.exe and re-ran it, it wouldn’t try to make the connection again and it would never use 100% CPU again. If I booted up without a network connection, everything was okay. Once I connected though, explorer.exe would try to make the TCP connection with the mysterious IP again.<\/p>\n

After tons and tons of troubleshooting (Filemon<\/a>, Regmon<\/a>, SFC, etc.) and searching for solutions (“explorer.exe 100% cpu”, “explorer.exe 99% cpu”, “explorer.exe 90% cpu”, “explorer.exe syn_start”, “explorer.exe close_wait”, “OMG!”), I took a deeper look at Process Explorer’s features. I thought all I could do with the program was look at (and close) the open handles of a process with the main window but if you right-click on a process and go to Process Properties, there’s also a useful Threads tab. In this tab, I was able to find a thread which was created by (right?) webcpl.dll and was using 100% CPU. I was able to kill the thread and voila! Explorer.exe was acting normal again. I found the culprit in %windir%\\system32. I opened the file up in Notepad and I found a reference to the IP that TCPView showed. I deleted the file, found one reference in the registry to the DLL, and deleted that (probably should’ve unregistered it instead?).<\/p>\n

Now everything is happy. Explorer.exe is no longer trying to connect to the IP and it doesn’t use up the CPU. I searched for more information about the DLL but all I could find was a forum thread<\/a> about Panda Antivirus detecting it as the Downloader.GRG trojan and not being able to delete it. Panda’s site<\/a> didn’t have much information about it though. Oh well.<\/p>\n","protected":false},"excerpt":{"rendered":"

Explorer.exe started using 100% CPU about 5 minutes after login. The user had run Spybot, Ad-Aware, and Trend Micro scans and nothing showed up. I took a look at the startup items with msconfig and couldn’t find anything myself. I first ran Process Explorer and couldn’t find anything obvious that was hooked into explorer.exe that would cause the problem (moral… Continue reading Explorer.exe 100% CPU usage after login (webcpl.dll)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-11","post","type-post","status-publish","format-standard","hentry","category-computers","entry"],"_links":{"self":[{"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/posts\/11","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/comments?post=11"}],"version-history":[{"count":0,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/posts\/11\/revisions"}],"wp:attachment":[{"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/media?parent=11"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/categories?post=11"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/tags?post=11"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}