Why can't I close a handle that's locking a file?

Some handles are protected or the process may not tolerate having them forcibly closed; if it fails, close the owning application instead.

What does high CPU in a svchost.exe process mean?

svchost hosts multiple Windows services; check its Services tab in Process Explorer to identify which specific service is responsible.

Is a DLL loaded from a Temp folder always malicious?

Not always, but it's unusual for legitimate system DLLs and worth verifying the signature and company name before trusting it.

Troubleshooting with Process Explorer

Download now

Process Explorer's search, tree, and threading views make it well suited to four common troubleshooting jobs: file locks, runaway CPU usage, DLL loading issues, and quick reputation checks.

Updated August 9, 2026 · PC Utility Hub Editorial Team

Find which process is locking a file

The classic 'file is in use' or 'cannot delete because it's open in another program' problem is what Process Explorer's handle search was built for.

1Press Ctrl+F to open Find Handle or DLL.
2Type part of the file or folder path (e.g., report.docx or the folder name) and click Search.
3Double-click a result to jump to the owning process in the main tree.
4Right-click the handle in the lower pane and choose Close Handle, or close the owning application normally if closing the handle isn't safe.

If Explorer.exe itself holds the lock (common with an open folder window), just close that Explorer window instead of touching the handle.

Diagnose high CPU usage

Sort the process list by CPU% to see the top consumer. If it's a generic host like svchost.exe or a browser, drill into threads to see what's actually running.

1Double-click the process and open the Threads tab.
2Sort by CPU to find the hot thread, then click Stack to see the call stack — this often reveals the module or driver responsible.
3For svchost.exe, check the Services tab in its properties to see which services are hosted in that instance.
4Use View > System Information for a longer CPU history graph to see if the spike is periodic.

Inspect DLL loading and search order

Switch the lower pane to DLL view (Ctrl+D) to see every module a process has loaded, along with its path, version, and company name.

Unsigned DLLs loaded from unusual locations (Temp, AppData root, Downloads) are worth investigating for DLL-hijacking issues.
Duplicate DLL names loaded from different paths can indicate a search-order hijack, where a malicious DLL in the app's folder shadows the legitimate system one.
Compare the loaded path against the expected System32/SysWOW64 location for known system DLLs.

Check process reputation with VirusTotal

Enable Options > VirusTotal.com > Check VirusTotal.com, accept the terms, and a Virus Total column appears showing detection counts for each running executable's hash.

This only submits and checks hashes by default, not full files, but it does require sending that data to a third-party service — skip it on networks where that's a policy concern.

When Process Explorer isn't enough

For deeper timelines — every file, registry, and network operation a process performs — pair Process Explorer with Process Monitor. For a full system health picture, cross-check with Windows' built-in diagnostics.

Frequently asked questions

Why can't I close a handle that's locking a file?: Some handles are protected or the process may not tolerate having them forcibly closed; if it fails, close the owning application instead.
What does high CPU in a svchost.exe process mean?: svchost hosts multiple Windows services; check its Services tab in Process Explorer to identify which specific service is responsible.
Is a DLL loaded from a Temp folder always malicious?: Not always, but it's unusual for legitimate system DLLs and worth verifying the signature and company name before trusting it.