explorer thread using unusual amount of processor power, detect root/source of "issue"?

Question

I was profiling an application I am developing, and I saw unusual explorer.exe processor usage, almost 15%!

This is very high for explorer, I launched process explorer and then I saw this:

I click "kill" and explorer works fine..

this happens every time explorer restarts / startsup.. How can I detect which application or what is causing that thread to launch and how do I prevent it from launching? My explorer works fine without it.

I suspect this is a virus but none of my AV software detects it..

Can anyone help me out?

Answer 1

You have a 3rd party components which creates dynamically code (green) and this code creates snapshots of programs (red) with this function: kernel32.dll!CreateToolhelp32Snapshot

Use AutoRuns and ShellExView to disable all 3rd party tools until you find the code which causes your CPU usage.