How to set up procmon filters for explorer.exe hang diagnosis?

klepp0906 · 10 Mar 2020

So I have an awful issue thats plagued me for quite some time. It used to happen very very rarely usually when using some really old software related to ripping media or something. So infrequently that I chalked it up to said software and didnt think about it twice. That very well may have been the case, and this is an entirely different issue that results in the same symptoms.

Now it happens more frequently. I cant ascertain what EXACTLY causes it, but it happens when Im downloading via my browser (chrome)

Explorer.exe will give me the spinning circle of doom and basically I have to click my start menu button or explorer or whatever to get it to finish the crash and reset/reload.

It doesnt happen every time i download, but it happens often enough and usually at the worst times - that its time to tackle.

this is what windows gives me, not much to go on.

How to set up procmon filters for explorer.exe hang diagnosis?-image.png

I figure procmon is my next best step but if i set a filter to process is explorer.exe, that thing populates hard n fast and uses ~25% cpu for as long as it takes me to force a crash/find something i can download repeatedly.

I was hoping to filter it down to the essentials so I can have it running in the background until such a time i need to refer to it.

Ive only used it once or twice before so im not sure what/how to filter down to only what would/could be relevant. Anyone able to point me in the right direction?

FreeBooter · 10 Mar 2020

I think File Explorer extension causing your problem try disabling third-party extensions to see it will resolve the problem.

https://www.nirsoft.net/utils/shexview.html

Fix: Slow Right Click and Explorer Crashes Caused by Shell Extensions >> Winhelponline

dalchina · 10 Mar 2020

Hi, I would be tempted to first try elimination and reach a point where this does not happen.

1. With your current user:
a. Clean boot
b. Disable all MS shell extensions (Shellexview).

- see if the same problem occurs.

If it does, examine the processes running, then the services. Look for 3rd party ones. Use e.g. Autoruns to disable them.

2. Create a new user for test purposes. Log in as that user.
See if the same thing occurs.

When you have reached a point when it does not happen, you have a point of reference for comparison, and a point to work back to your normal configuration step by step, looking to see if the problem recurs.

Procmon: in my limited experience of using it:
a. Ensure as little activity is present on your PC as possible (clean boot, minimal things running).
b. Run a capture with Procmon.
c. Apply filters to eliminate things from the log.
d. Once you have almost nothing of interest remaining, then perform a test whilst capturing.
e. Note the time at which the problem occurs.
f. Examine the log from that time.

Note: I seem to recall there are usage guides published by MS on procmon.

How to set up procmon filters for explorer.exe hang diagnosis?-1.png

klepp0906 · 10 Mar 2020

FreeBooter said:

I think File Explorer extension causing your problem try disabling third-party extensions to see it will resolve the problem.

https://www.nirsoft.net/utils/shexview.html

Fix: Slow Right Click and Explorer Crashes Caused by Shell Extensions >> Winhelponline

yea extensions are the first tree i barked up. and likely where the problem lay. Still i have another pc thats nearly 100% identical in software/extensions/build/etc that it does not happen on.

I cant really force it to happen and so im hoping to catch it with somethinb without having to disable half of what i use my pc for in the interim.

will compare extensions between the two pc's again though and see what if anything stands out.