Comments on: Explorer.exe 100% CPU usage after login (webcpl.dll)

by: Anti-Halo

Thu, 26 Jun 2008 13:09:18 +0000

I am by know means an expert and the explorer.exe using 100% cpu was driving me crazy. I used a free utility called PROCMON and found that explorer was using all it’s cpu trying to read the files “wnl32.dll & wnl32.dll.dll”. Apparently these are malware files, but AdAware and SpyBot did not clean them out. Finally I used ComboFix (which is a powerful and potentially dangerous to your system) and the problem is fixed. This is where I found the information and is more detailed.
http://www.bleepingcomputer.com/forums/lofiversion/index.php/t134721.html
I hope this helps some of you.

by: Harry

Fri, 11 Apr 2008 01:55:06 +0000

i had this problem when my wife tried to log on the internet. i think the solution was to reset her defaults. but it has been so long ago can anybody tell me if this was the fix? I only ask because i upgraded from NIS 2007 to 2008 (running XP) and now MY CPU usage runs at 100% and locks the computer. I am on her account right now. tried taliking to Norton folks, but they said it was the computer’s fault - didn’t have any issues until i went to NIS 2008.

any thoughts???

by: Robis

Mon, 31 Mar 2008 00:08:27 +0000

I first time noticed, the explorer.abuser was downloades some porno video file, every time i was trying delete explorer.exe pop up with 99% … but i cant delete in standard mode so i go in safe mode and same thing even cant rename if u make but im not new with that and always work for me reneme like .exe or .bat at the end and after that rename is succesful and can delete… ewido and antivirus progs dont find anything, dont waste time if u have something like i have.. wish u luck ;)

by: Christian

Tue, 15 Jan 2008 21:12:24 +0000

you guys kick *ss! my wife picked up this gebyx.dll and google led me here. i’da been clueless w/out you guys. thanks!!!

by: bob

Thu, 13 Sep 2007 20:20:53 +0000

I am having an identical problem as described at the top of this page. Problem exists on multiple laptops (but not desktops) at my company.

Sometimes after restarting the problem will not come back. Every time a user shuts down and turns laptop back on the problem exists — explorer.exe is at 0-3% until you try to open my computer or windows explorer. then it just hangs at 99%

I ran Process Explorer and found that BrowseUI.dll!ordinal138 is the culprit thread.

Here is the stack for that thread:

ntoskrnl.exe+0×48f3
ntoskrnl.exe!ZwYieldExecution+0xb0f
ntdll.dll!KiFastSystemCallRet
WININET.dll!InternetTimeFromSystemTimeA+0×1bbc
WININET.dll!InternetCanonicalizeUrlW+0×180
SHDOCVW.dll!Ordinal174+0×2d
BROWSEUI.dll!Ordinal136+0×26680
BROWSEUI.dll!Ordinal136+0×126e2
BROWSEUI.dll!Ordinal136+0×12cb0
BROWSEUI.dll!Ordinal138+0×555e
BROWSEUI.dll!Ordinal138+0×5a33
BROWSEUI.dll!Ordinal136+0×1444e
SHDOCVW.dll!Ordinal147+0×17ae
BROWSEUI.dll!Ordinal113+0×28c9
BROWSEUI.dll!Ordinal103+0×1672
BROWSEUI.dll!Ordinal138+0×6e68
USER32.dll!GetDC+0×6d
USER32.dll!GetDC+0×14f
USER32.dll!DefWindowProcW+0×184
USER32.dll!CallNextHookEx+0×1a3
ntdll.dll!KiUserCallbackDispatcher+0×13
USER32.dll!CreateWindowExW+0×2a7
USER32.dll!CreateWindowExW+0×33
SHLWAPI.dll!Ordinal55+0×5f
BROWSEUI.dll!Ordinal138+0×7833
BROWSEUI.dll!Ordinal138+0×7b45
kernel32.dll!GetModuleFileNameA+0×1b4

Can anyone help?
-Bob

by: chuonthis

Wed, 20 Jun 2007 05:06:38 +0000

Scott, if you can’t find the offending executable that’s holding onto the file, there are a couple of things you can try. The easiest way is probably just to boot up into safe mode and delete the file. In most cases, the file will not load in safe mode. The next easiest is to just try renaming the file. Oftentimes, you can rename an in-use file even though you can’t delete it. If the file isn’t recreated, then reboot and it will fail to load on the next startup since it is a different filename. Then you can delete it.

Also, I found this semi-useful link on Google about the DLL: translated link

by: Scott

Tue, 19 Jun 2007 05:34:58 +0000

Thanks for the great recommendation. Found this site after searching now that my explorer.exe is hanging out at 99% cpu usage.

Ran the Process Explorer app. and when looking at properties, it ended up leading me to a file called checkweb.dll that is hidden deep within my c:\windows\system32\dllcache directory.

Problem is I cant delete it!

it keeps saying the file is in use or write protected. I killed it from Process Explorer and any little file assoc. with checkweb.dll (there were about 5 in the Properties tab of explorer.exe that had checkweb.dll as part of its name).

Any suggestions of how to delete this from my comp so I dont have to kill it on every boot?

Id love to just trash the damn thing.

Thanks

by: hello

Tue, 22 May 2007 05:59:24 +0000

where is Process Properties?

by: amccarl

Fri, 04 May 2007 15:01:08 +0000

Vundofix seems to have fixed my problem.

by: chuonthis

Mon, 30 Apr 2007 21:07:20 +0000

Just in case anyone reads this, it looks like Doug’s DLL (gebyx.dll) is from the Virtumonde or Winfixer spyware. It looks like the popular tool for removing it is VundoFix available here: http://www.atribune.org/content/view/24/2/

If you Google for Virtumonde or Winfixer, you’ll see many links from the reputable anti-virus/spyware companies with removal tools and instructions.