How to diagnose a hang when creating a new folder in explorer.exe
- by Jack Ukleja
I have been having some issues with explorer.exe hanging when I create a new folder.
If I use Analyse Wait Chain in the Resource Monitor it says "One or more threads of explorer.exe are waiting to finish network I/O".
When I look at the offending thread in Process Explorer it reveals nothing interesting:
ntdll.dll!ZwWaitForMultipleObjects+0xa
KERNELBASE.dll!GetCurrentThread+0x36
kernel32.dll!WaitForMultipleObjectsEx+0xb3
USER32.dll!PeekMessageW+0x1cd
USER32.dll!MsgWaitForMultipleObjectsEx+0x2a
USER32.dll!MsgWaitForMultipleObjects+0x20
SHELL32.dll!SHAppBarMessage+0x41e
SHELL32.dll!DragAcceptFiles+0x2a3c
SHELL32.dll!DragAcceptFiles+0x2a4f
SHELL32.dll!Ordinal211+0x124
SHELL32.dll!SHChangeNotification_Unlock+0x12f4
USER32.dll!GetSystemMetrics+0x2b1
USER32.dll!IsDialogMessageW+0x19b
USER32.dll!IsDialogMessageW+0x1e1
ntdll.dll!KiUserCallbackDispatcher+0x1f
USER32.dll!PeekMessageW+0xba
USER32.dll!PeekMessageW+0x89
SHELL32.dll!SHChangeNotification_Unlock+0xd9f
SHELL32.dll!Ordinal885+0x1407
SHLWAPI.dll!SHRegGetUSValueW+0x306
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x21
While I was looking at the explorer.exe threads I did notice a fair few that talk about ETW (Event Tracing for Windows) so obviously explorer.exe uses tracing.
So I decided to try and user TraceView.exe to try and listen in on the explorer.exe traces.
The problem is TraceView requires some difficult-to-come-by stuff... either pdbs, or CTL files, and .TMF files. I tried using the explorer.pdb that comes with the Windows SDK but that did not work. I do not see explorer.exe in the "named providers". And I have no idea where to locate the ctl or .TMF files for explorer.exe.
So the question is: Is there a way to view the ETW trace messages from explorer?
Or shall I just not bother and go back to the age old technique of disabling every explorer extenion one-by-one in the hope its one of them. (Prefer the former as I like to get to the bottom of things!!)