locked
50% CPU usage explorer.exe @ ntdll.dll!RtlDecodePointer+0x9b RRS feed

  • Question

  • I get 100% CPU usage on one core when I try to open folders with large files inside, I always wonderes why. The problem disappears when I disable the thumbnail function of the explorer. But I like the way you can preview pictures and other stuff in folders.

    Now I investigated that problem:

    Process Explorer shows it is the thread ntdll.dll!RtlDecodePointer+0x9b causing the cpu load and process monitor showed me that in my case the explorer wants to access this huge 4GB packed file.... For what? to create a thumbail from it?
    It's not only a problem with this file I also have a USB HDD and as soon as I plug it in and want to access it the same problem occurs. Probably there is another huge file on it.

    Is there a way to tell explorer.exe to not investigate huge files? Or only create thumbnails from certain extensions? In my case a huge .dat file is causing the problem.

    I know I can work around that problem by turing of the thumbnail function, but then I lose this feature with all my pics too.
    Thursday, June 19, 2008 8:56 AM

All replies

  • Hi Sapphirine, i've spent 2 days researching the same problem.

    It turns out it's a certain file in that folder that is causing this (as you have identified) and one of the filters you have installed which generates the thumbnails might be at fault.

    For me it was CyberLink's thumbnailer as part of Acer Arcade that Acer (though I believe it is also installed with some HP machines) installed with the laptop and the file was in a subdirectory that Vista was accessing to try and generate a thumbnail.

    See http://blogx.co.uk/Comments.asp?Entry=779 for more information. By following the steps on my website you might further diagnose your issue. Please direct all replies to my blog as I'm more likely to notice replies there.
    Thursday, January 1, 2009 5:44 PM
  • I'm seeing this same CPU usage but doesn't appear to be related to any thumbnail. Might be Tortoise SVN but I killed the process for that. It only spikes when I'm building, when files are being created/added/removed. I see the following stack, which doesn't give me much to go on. Have indexing turned off as well.

    ntdll.dll!KiFastSystemCallRet
    ADVAPI32.dll!RegEnumKeyW+0x452
    ADVAPI32.dll!RegEnumKeyW+0x397
    ADVAPI32.dll!RegOpenKeyExW+0x123
    ADVAPI32.dll!RegOpenKeyExW+0x1b
    ole32.dll!ReadClassStm+0x674
    ole32.dll+0x1f95
    BROWSEUI.dll!Ordinal105+0x5be
    BROWSEUI.dll!Ordinal105+0x903
    BROWSEUI.dll!Ordinal105+0x885
    BROWSEUI.dll!Ordinal105+0x847
    BROWSEUI.dll!Ordinal105+0x540
    BROWSEUI.dll!DllGetClassObject+0x5926
    BROWSEUI.dll!DllGetClassObject+0x5d87
    BROWSEUI.dll!DllGetClassObject+0x5edd
    SHLWAPI.dll!Ordinal476+0x156
    ntdll.dll!TpSetWait+0x149
    ntdll.dll!RtlDecodePointer+0x32a
    kernel32.dll!BaseThreadInitThunk+0x12
    ntdll.dll!RtlInitializeExceptionChain+0x63
    ntdll.dll!RtlInitializeExceptionChain+0x36

    Thursday, April 30, 2009 2:55 PM