Windows Explorer Periodically Hangs with High CPU Utilization

So my PC at work has been giving me trouble this week. Every so often things would just sort of hang for several seconds. Sometimes it would be when I tried to open an email message in Outlook, sometimes when I was working with a web application in IE, sometimes when killing the screen saver after being away from my desk. There just wasn’t any rhyme or reason to it. One thing I did notice was that each time it happened, the Windows Explorer process, explorer.exe, would be consuming 99 – 100% of the CPU.

My first fear was that Windows had been infected by some nefarious bit of code. I checked the system with a couple virus scanners and anti-spyware tools, but found nothing. I tried using Windows XP’s restore points to roll back to a time before this problem starting happening. All that did was screw up Visual Studio 2005 (which I then had to repair). I tried uninstalling that last couple of applications I had installed. I tried disabling IE add-ons. Nothing helped.

Finally I tried to make some sense of what was going on inside explorer.exe when it was gobbling up CPU cycles by using the Visual Studio debugger and Sysinternals’ Process Explorer. There were enough clues there that led me to think that whatever was happening was centered around the Windows desktop folder. Hmmm. Desktop. I had set my desktop to hide all icons months ago (FYI: right-click the desktop, click “Arrange Icons by”, and then uncheck “Show Desktop Icons) in an effort to unclutter things (and I got tired of fighting every little app that feels it’s important enough to put itself on my desktop). So, I made the desktop icons visible again to see what was there.

Bazillions of files. Covering both my displays and then some. XML files. I knew immediately where they had come from. The application I maintain and support has an option to save the XML requests/responses to and from the server. Where does it save them? To your “working directory”. Where’s the working directory? By default, the Windows desktop. Ugh. I had enabled this logging months ago and forgot to turn it off. It appears that things hit critical mass this week and was causing Explorer to choke (explorer.exe runs the XP desktop, taskbar, and start menu as well as the file explorer).

Things got much faster after nuking all those files. I also checked the utilization of the MFT using defrag c: -a -v and since it was over 90%, I ran this batch file to expand it a bit:

c:
md c:MFT-folder
md C:MFT-files
cd c:MFT-folder
FOR /L %%f in (1,1,5000) do md %%f
cd C:MFT-files
FOR /L %%f in (1,1,50000) do echo Creating files >%%f
cd c:
rd /s c:MFT-folder
rd /s C:MFT-files

It’s usually best to do this after defragging the drive. Basically, you’d like there to always be some space available in the MFT so you don’t have to wait for Windows to expand it, and if you use this method with Windows defrag it will also help prevent the MFT from becoming fragmented.

2 thoughts on “Windows Explorer Periodically Hangs with High CPU Utilization”

  1. I defragged my hdd and the C:\$mft was the only file left that was fragmented.
    After running your batch file it seemed that it was more fragmented, 2 increased to 3.
    Did I perhaps do something wrong? What does the MFT file do? Is it the MBR?
    Thanks for your advice.

  2. The MFT is the GÇ£Master File TableGÇ¥. ItGÇÖs like the FAT (File Allocation Table) used in the GÇ£old daysGÇ¥ of DOS, Windows 3.x, and Windows 9x.

    The idea of the batch file is to grow the MFT so there is space available in it as new files are added to the drive and so that it remains fairly contiguous. Your system can become slower when Windows grows the MFT unexpectedly (because it ran out of space) and the MFT can become badly fragmented if the drive is fragmented because Windows may allocate non-contiguous GÇ£chunksGÇ¥ to grow the MFT. So the idea is to control when the MFT grows – when you notice that it is over 90-95% utilized after performing a full defrag.

    There probably wasnGÇÖt enough contiguous space on your drive to grow the MFT without creating a new fragment. The Windows defragger often does not completely defrag drives, and I don’t think it can defragment the MFT. ThereGÇÖs at least one commercial product that claims to be able to – GÇ£Partition ManagerGÇ¥ (http://www.partition-manager.com/). I have no experience with it, however.

Comments are closed.