> Oh and yes, it does vary with extension.
>
> Plus I've also seen the shell stick around for longer before
> disappearing. Although not having any CPU usage so could be Windows
> getting around to zapping it after it's done.
>
> Here's a delay example (consecutive lines in ProcMon):
>
> "18:24:47.6325859","ZSHELL64.EXE","12892","RegCloseKey","HKCR\WOW6432Node\CLSID\{3C5E2B20-B911-44E2-A2DD-9F05E7B5E775}","SUCCESS",""
>
> "18:25:17.1963760","ZSHELL64.EXE","12892","Thread
> Exit","","SUCCESS","Thread ID: 39868, User Time: 0.0000000, Kernel
> Time: 0.0156250"
So from your first reply, the delay is between ZSHELL64.EXE starting and the menu being displayed.
As Matthias said and as I suspected, the delay is in ZSHELL64.EXE when it has to caculate what to display.
Note: Windows Explorer has an advantage, because it stays loaded, whereas ZSHELL64.EXE only runs until the selection has been made.
The easy part is
HKCR\.ext => HKCR\progid\shell\*
The slower part will be loading DLL's, for example
HKCR\*\shellex\ContextMenuHandlers
One odd thing from the ProcMon trace is the a 64bit process ZSHELL64.EXE is reading the 32bit view of the registry HKCR\WOW6432Node\..., which could mean it's trying and failing with a timeout to load a 32bit DLL into a 64bit process.
i.e. the cause is somehing that has done an incorrect registration.
That is assuming that it's not a ZSHELL64.EXE bug.
Another posibily is some interaction with Antivirus.
You stated how much memory the machine has, but not how much of it is free.
i.e. could the issue by pageing memory back from the pagefile to memory.
Ben