Multiple Explorers in Process Explorer ? ? ?

Discussion in 'Windows 7' started by RASelkirk, Sep 30, 2011.

  1. RASelkirk

    RASelkirk MDL Member

    Feb 4, 2010
    185
    8
    10
    Hi All,

    Win7 Home Premium. On several (actually many) occasions, I can open Sysinternals "Process Explorer" only to find multiple instances of Windows Explorer running. These "rogues" are all children of svchost.exe. They are all legitimate versions of Windows explorer. I have no idea why they are there or what programs are opening them, as there are no visible windows. I kill the process and they go away but later on they are back, sometimes one but never more that three. I have no viruses and nothing abnormal is running. All I can figure is a previous program had called on explorer but failed to properly close it... Any ideas?

    TIA!

    Russ
     

    Attached Files:

  2. IronMaiden

    IronMaiden MDL Member

    Oct 27, 2009
    104
    9
    10
    Hmm, weird...but since these rogue explorers run under svchost, why don't you run services.msc (or go to Administrative Tools -> Services) and see if you find anything out of the ordinary there...
     
  3. RASelkirk

    RASelkirk MDL Member

    Feb 4, 2010
    185
    8
    10
    Thanks, but I look at my services a couple times a day and don't see anything out of place. Just seems like whenever "Explorer" gets called through another program, it doesn't get closed out properly. Not sure if it's a Windows system problem or just poor memory release of these auxiliary programs...

    Russ
     
  4. 100

    100 MDL Expert

    May 17, 2011
    1,346
    1,544
    60
    That doesn't sound quite right. Explorer is a GUI program, and a service should have no business opening Explorer, since it runs in a non-interactive session and can't display any UI. The regular Windows services certainly wouldn't do that.
    Check which services are run by the svchost.exe that started the Explorer processes (Process Explorer will show that in the process properties) to find the service that's probably doing that.
     
  5. Stannieman

    Stannieman MDL Guru

    Sep 4, 2009
    2,232
    1,803
    90
    If a program has an open file/save file dialog, doesn't that call explorer.exe? But I think windows should handle that and say "hey, explorer is already running, so I let you use the running copy".
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. RASelkirk

    RASelkirk MDL Member

    Feb 4, 2010
    185
    8
    10
    I've found out that some of these "Explorer" windows are opened under svhost whenever I open MS programs such as device manager, networking center, etc. Also, if I use the "file browse" function from non-MS programs, they are called "explorer.exe" and are showing under svhost after the program closes. I guess the memory is not being released properly. I just use process explorer to kill the process(es) and it works OK.

    Russ
     
  7. Blizzarddemon

    Blizzarddemon MDL Novice

    May 9, 2011
    5
    0
    0
    I have the same problem on my Windows 7 Enterprise edition. I always thought it was cause of LiteStep but maybe it isn't since you're having this problem too
     
  8. Rainey

    Rainey MDL Novice

    Apr 27, 2011
    23
    3
    0
    Open a command prompt and do a
    Netstat -abo
    or
    Get-Process

    that should list the process names and PID for each open process. This might help ID what is attached to the svchost processes