Explorer.exe Excessive Memory Usage

[Saraband]

i have no idea why explorer.exe is usage such a large amount of memory. system is clean. xpsp2. only 2 programs run at startup. any ideas ?

[puntoMX]

Cashing, but I never get mine more then 21MB , I think you have a virus or something there...

Post your SERVICES.MSC list here and we could see if there is any thing in it that makes EXPLORER.EXE that big....

[Saraband]

These Windows services are started:

COM+ Event System

Cryptographic Services

DCOM Server Process Launcher

DHCP Client

Distributed Link Tracking Client

Event Log

Logical Disk Manager

NetVeda Safety.Net

Network Connections

Network Location Awareness (NLA)

Plug and Play

Protected Storage

Remote Procedure Call (RPC)

Security Accounts Manager

Shell Hardware Detection

System Event Notification

Task Scheduler

Themes

Windows Audio

Windows Management Instrumentation

Wireless Zero Configuration

[epic]

http://vil.nai.com/vil/stinger/

more or less you have a virus.

[Saraband]

but i've already run stinger and nod32 and symantec corp...

[puntoMX]

There is no strange service there as far as I can see, your explorer.exe should not get up to that 100MB. Realy, I think you have a virus there, or you used some strange reg tweaks?

Also, I have a strange one here, R.EXE is remaking his self all the time in c:\... Virus scanners should remove it BC it´s know as a virus but it´s nor removing nor reporting it...

So, it could be that some how it not seen as a virus... .

[epic]

did you run them in safe mode?

try your norton boot disk before windows boots.

[MCT]

if u have nod32, right click it, & scan it with nod32 (r.exe) if u choose 2 clean it? it may get rid of it? of give u the option 2 remove it safely?

[puntoMX]

Nope, R.EXE will come back, it´s not found in a REG KEY so it should be build in a DLL...

Anyway, it´s not helping Saraband out...

[Saraband]

i don't have r.exe anywhere. i ran fprot in DOS mode and the DOS version of bitdefender. no infection. i think i'll go back to last week's ghost image. thanx anyway guyz for help...

[epic]

Gave it more thought. Download filemon.exe from Sysinternals.com

After you run filemon.exe it will show you what resources explorer is accessing and causing it to use excessive resources. If explorer is using the suggested amount of resources, as you noted, filemon.exe will display those results (most of the time).

More then likely explorer is attempting to access a shortcut or program that you had deleted but the registry does not see that it has been removed and see's it as a valid entry.

Run a regcleaner to remove invalid registry keys.

[Saraband]

interesting thought...& i think u hit on something. although itz explorer, not Internet Explorer thatz the trouble, i am almost certain that installing internet download manager+crack is what screwed things up - it makes some pretty extensive changes to things. anyway, i restored from a ghost image. all is aok now

[epic]

Thanks for the correction, didnt notice I had placed IE in there. Pure habit I guess. You knew what I was talking about though.

Psst.. just a secret.. dont download cracks or pirated software. May help with future headaches