WinXP explorer.exe looping continuously

explorer.exe is accessing the registry every 2 milliseconds (per Procmon). This is beating up my disk drive something awful. After many restarts, I found that if I don't allow the Network Connection service to start, the problem goes away - but I really need the Network Connection service. Running WinXP SP3 with plenty of RAM and disk space. Here is the loop from Procmon: 4:40:13.3819715 PM Explorer.EXE 2644 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Linkage\Bind SUCCESS Type: REG_MULTI_SZ, Length: 132, Data: \Device\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0}, \Device\NdisWanIp 4:40:13.3820059 PM Explorer.EXE 2644 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Linkage\Bind SUCCESS Type: REG_MULTI_SZ, Length: 132, Data: \Device\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0}, \Device\NdisWanIp 4:40:13.3973115 PM Explorer.EXE 2644 RegOpenKey HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0} SUCCESS Desired Access: Read 4:40:13.3973827 PM Explorer.EXE 2644 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0}\EnableDHCP SUCCESS Type: REG_DWORD, Length: 4, Data: 1 4:40:13.3974204 PM Explorer.EXE 2644 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0}\LeaseObtainedTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1242754444 4:40:13.3974567 PM Explorer.EXE 2644 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0}\LeaseTerminatesTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1242840844 4:40:13.3974905 PM Explorer.EXE 2644 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.1.1 4:40:13.3975238 PM Explorer.EXE 2644 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0}\DhcpServer SUCCESS Type: REG_SZ, Length: 24, Data: 192.168.1.1 4:40:13.3975847 PM Explorer.EXE 2644 RegCloseKey HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F8AC5CA1-DFC8-4EB5-AA92-0A86773FABA0} SUCCESS Any ideas on how to stop this will be very gratefully received. Thanks in advance.

those are DHCP commands…..what happens if you manually configure that Network adapter ? does this happen with other DHCP clients on your network ? or are you the only one ? Have you changed any Registry settings recently ? Have you tried a system Restore to yesterday, (or prior-to the onset of this issue.) ? Tallon41

Tallon4: Thanks for the quick response and good ideas. Network Adapter really doesn't have any configuration properties - Realtek device. I'm using a Verizon supplied cable modem. All the DHCP stuff, like DNS server and IP address are automatic, supplied by (I think) the modem, or downloaded from Verizon. As for when it started - not at all sure, but it has been a while. I was fighting a runaway lsass.exe caused by Terminal Services, fall back reboot probably doesn't go back far enough. As part of the lsass.exe research, I found that the Network Connection service is causing the problem, but I'm not sure why. Another XP machine on the local net has the exact same problem. Thanks again.

Network Adapter really doesn't have any configuration properties - Realtek device.

OK, but I was not refering to the "configure" button in say, the device manager, but instead meant what you refer-to in the following statement.

All the DHCP stuff, like DNS server and IP address are automatic, supplied by (I think) the modem, or downloaded from Verizon.

It is being issued (repeatedly it seems,) by the Verizon device [it is likely a modem/router device;] yet you do not HAVE to use the DHCP server in that device, (which if there are only 2 of you using it, may be malfuntioning and you should call them for replacement anyway.)

If you are able to the reach the internet, with that PC, then go to "Network Connections" [in the control panel,] and find the Local Area Connection icon [if you're on wireless, it will say "wireless Network connection,] right-click it, and choose -status-, then click the -support- tab, then click the -details- button and copy down the following…..[you will see other info than what you need to copy, ignore the other info.]

IP Address: 192.168.4.156
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.4.1
DNS Servers: [removed], [removed]

again, the above is for example only.
Note again that they are 4 groups of digits seperated with periods. The first 3 groups represent the local "network" you are using, while the 4th uniquely id's a particular network appliance or a PC….

Close those windows and go-back to the "network connections" window. Right-click the -Local Area Connection- again, choose
-properties-, when the "local area connection properties" window opens, locate the "this connection uses the following items" box. inside it locate the "Internet protocol TCP/IP" [you may have to scroll-down] entry. Click it, then press the -properties- button. When the "Internet protocol TCP/IP properties" windows opens, change the radio button to
"use the following IP address"

input the same first 3 groups of digits for the IP Address: that you wrote down above. Add 50 to the fourth field and input that figure. eg: using my example above
the IP Address would be
IP Address: 192.168.4.206 [156+50] the only issue might be, if the resulting sum is greater than 254. If it is, then you must lower it below that figure.
Subnet mask: you must input exactly what you recorded previously….usually it is 255.255.255.0
For the Default gateway, you again, input exactly what you recorded previously
192.168.4.1 [following my above example.]
Primary DNS server: input the SAME IP address as the Default gateway above. The Router will forward DNS requests to the same 2 server addresses inside it, and there is no need to repeat them.
Secondary DNS: leave blank, there again, is no need to repeat them here.

Another XP machine on the local net has the exact same problem.

Are those the only 2 PCs in your Network ?

Tallon41

WOW! Talk about great, detailed instructions! Thanks loads - easy to follow and the changes worked - for the network. The bad news is that explorer is still running away! As for my network, I have two XP PRO SP3 machines and a Vista one. You question prompted me to think about shutting down the Vista machine, rebooting the XPs and see where that puts me. I seem to remember something about networking interaction between Vista and XP. If there is a change, I'll be sure to post it. Thanks again for your time and help.

I seem to remember something about networking interaction between Vista and XP.

yeah, but nothing like this….

Bandwidth monitor type apps sometimes poll the registry like this.

firewalls might do similar.

If explorer.exe is responsible, autoruns which could be to blame (disabling the startup programs one at a time might help here.)

Could there be another network interface active but not in use ?

Tallon41

Right - the shutdown idea was no good - nothing changed. Disabling startup programs was how I came up with the Network Connection service as the cause. When it is down on reboot, the explorer.exe calms down just fine. Windows firewall is disabled, and I have seen the looping when McAfee is down (that took some effort), so not there. I think that those are the only two firewalls I have on this machine. Netmon doesn't show anything interesting, gaps in events as long as 40 milliseconds, many times longer than the loop period. Thanks again for all the help and ideas.

Right - the shutdown idea was no good - nothing changed.

so are there any other network connections….are you on wireless and theres a wired connection also in use…..

Another thing that can do the polling is if UPnP is turned-on in the Router. If you have a Vista box, it could be, but you'd have to call your ISP, (verizon doesn't provide cable modems, though if you have FIOS it can have a coaxil connection,) to have them correct that.

You could try Disabling, or setting to Manual, the Universal Plug-n-Play service.

Tallon41

Right - the shutdown idea was no good - nothing changed.

Disabling startup programs was how I came up with the Network Connection service as the cause. When it is down on reboot, the explorer.exe calms down just fine. Windows firewall is disabled, and I have seen the looping when McAfee is down (that took some effort), so not there. I think that those are the only two firewalls I have on this machine.

Netmon doesn't show anything interesting, gaps in events as long as 40 milliseconds, many times longer than the loop period.

Thanks again for all the help and ideas.

You're using a lot of monitoring programs. Have you looked in event viewer for anything to clue you in on what is really happening? Those tools you are using are very useful but the information they provide is useless if you don't know how to apply it. Event viewer may provide a "plain english" error or warning that you'll see to tell you why you are seeing what you are in those other programs. Click start -> run -> type 'eventvwr' and press ENTER. Look in the system log mainly, and possibly the application log.

I spotted the same problem some days ago. After a long inspection, I found what is the cause of this problem. Explorer.exe keeps reading the registry about network connections because of the system tray icon of network connection (the one at the bottom-right corner of your desktop). If you uncheck the checkboxs "Show icon in notification area when connected" and "Notify me when this connection has limited or no connectivity" in the Network Connection Properties page, the continuous reading of registry will stop. However (and of course), you are gaining this advantage by stop using the handy monitor of your network connection. In my opinions, the network connection system tray icon is necessary to keep reading the registry to maintain its information up-to-date. So, don't blame it. After all, we have an option to stop using it.