Explorer.exe eating all CPU, how to to detect culprit

64-bitprocess-explorerwindows 7windows-explorerx86-64

Windows 7 64bit.

I am using ProcessExplorer from Sysinternals, and it says, that the offending call is

ntdll.dll!RtlValidateHeap+0x170

however, the call stack towards the entry is always different, so it's hard for me to track the problem. Maybe it's a mal-programed trojan, causing exceptions in Explorer.exe, but that is only a wild speculation.

Explorer.exe is then consuming 25% (a core on a dual core). Killing the process makes the task bar go away, respawning from task manager, and half a minute later it's again eating all CPU cycles.

Best Answer

Use SysInternal's sister program, Process Monitor, to see what it's actually doing.