multiple explorer.exe processes, cannot disable

[hinarei]

Hi all,

I have a machine that seems to run two instances of explorer.exe. Using
Process Explorer, it seems to launch explorer off of a <non-existent
process>:<number>.

Opening a folder/My Computer/My Docs/network resource launches a second
explorer.exe instance as follows: "explorer.exe
/IDLIST,:<number>:<number>,/S" (with random numbers)

Unchecking “Launch folder windows in separate process†or editing/deleting
what I assume is the correct reg key doesn’t work, it always resets itself.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SeparateProcess"=dword:00000001

Right clicking leads to long pauses and crashes.

Booting in to Safe Mode launches the same two processes of explorer.exe, but
when I killed those and re-ran explorer after disabling 'Launch in separate
processes", only one process stayed open and launched folders as I would
normally expect.

This wouldn't normally be an issue, but the machine seems to be acting up
and not running as quickly as it could, added to the fact I don't seem able
to change the setting back.

Any ideas, please?

 

[Alister]

Hi all,

I have a machine that seems to run two instances of explorer.exe. Using
Process Explorer, it seems to launch explorer off of a <non-existent
process>:<number>.

Opening a folder/My Computer/My Docs/network resource launches a second
explorer.exe instance as follows: "explorer.exe
/IDLIST,:<number>:<number>,/S" (with random numbers)

Unchecking “Launch folder windows in separate process†or editing/deleting
what I assume is the correct reg key doesn’t work, it always resets itself.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SeparateProcess"=dword:00000001

Right clicking leads to long pauses and crashes.

Booting in to Safe Mode launches the same two processes of explorer.exe, but
when I killed those and re-ran explorer after disabling 'Launch in separate
processes", only one process stayed open and launched folders as I would
normally expect.

This wouldn't normally be an issue, but the machine seems to be acting up
and not running as quickly as it could, added to the fact I don't seem able
to change the setting back.

Any ideas, please?

Don't forget that explorer.exe is the process responsible for providing
you with a desktop, start menu and taskbar, so if you open a My Computer
or any other browsing window you *will* see two processes, this is
normal behaviour.

It sounds like in your efforts to stop this you may have broken something!

Try doing a system restore back to before you started changing things -
and also check for malware infestation.

Alister

 

[hinarei]

Don't forget that explorer.exe is the process responsible for providing
you with a desktop, start menu and taskbar, so if you open a My Computer
or any other browsing window you *will* see two processes, this is
normal behaviour.

It sounds like in your efforts to stop this you may have broken something!

Try doing a system restore back to before you started changing things -
and also check for malware infestation.

Alister

Thanks for that. I don't recall changing anything, necessarily. All I've
mentioned is that I've tried booting to safe mode and killing processes,
deleting reg keys that set themselves back up again... if anything, the
setup's the same as when I started looking at it.

Unfortunately the machine hasn't had System Restore enabled, so that isn't
an option. I have also run through scans from Windows Defender, MalwareBytes
AntiMalware and Adaware, as well as Kaspersky Anti-Virus, none of which seems
to have picked any problems out other than tracking cookies.

Also, to my recollection, regarding the multiple processes: I've always
noticed a single process for explorer.exe on every other XP install I've
used. Perhaps this isn't a great way of working, but if the one process is
capable of firing multiple folders, why do you need two processes to do the
job?

Surely I'd be able to tick a folder view option without it setting itself
back again without my knowledge?

 

[Pegasus [MVP]]

Thanks for that. I don't recall changing anything, necessarily. All I've
mentioned is that I've tried booting to safe mode and killing processes,
deleting reg keys that set themselves back up again... if anything, the
setup's the same as when I started looking at it.

Unfortunately the machine hasn't had System Restore enabled, so that isn't
an option. I have also run through scans from Windows Defender,
MalwareBytes
AntiMalware and Adaware, as well as Kaspersky Anti-Virus, none of which
seems
to have picked any problems out other than tracking cookies.

Also, to my recollection, regarding the multiple processes: I've always
noticed a single process for explorer.exe on every other XP install I've
used. Perhaps this isn't a great way of working, but if the one process
is
capable of firing multiple folders, why do you need two processes to do
the
job?

Surely I'd be able to tick a folder view option without it setting itself
back again without my knowledge?

I agree with your observation: I too have just a single instance of
explorer.exe, regardless of the number of active Explorer processes. Perhaps
you have a rogue process that calls itself "explorer" but is really
something else. If you launch siw.exe
(http://www.gtopala.com/siw-download.html) then you can find out the path to
both instances like so:
- Click "Running Processes".
- Click "Explorer.exe".
- Check the Path, Version and Description in the lower pane.

By the way - do you have a particular reason for disabling System Restore? I
find this an extremely useful feature with no known problems or drawbacks.
Turning it off appears to be counter-productive.

 

[Alister]

Thanks for that. I don't recall changing anything, necessarily. All I've
mentioned is that I've tried booting to safe mode and killing processes,
deleting reg keys that set themselves back up again... if anything, the
setup's the same as when I started looking at it.

Unfortunately the machine hasn't had System Restore enabled, so that isn't
an option. I have also run through scans from Windows Defender, MalwareBytes
AntiMalware and Adaware, as well as Kaspersky Anti-Virus, none of which seems
to have picked any problems out other than tracking cookies.

Also, to my recollection, regarding the multiple processes: I've always
noticed a single process for explorer.exe on every other XP install I've
used. Perhaps this isn't a great way of working, but if the one process is
capable of firing multiple folders, why do you need two processes to do the
job?

Surely I'd be able to tick a folder view option without it setting itself
back again without my knowledge?

OK, you got me - I realise that I do have the option "Launch folder
windows in a separate process" ticked - and therefore I get multiple
instances in Task manager.

This is something set on all the machines I work with as we do a lot of
work on remote network shares which can be a bit flaky - this way if an
instance is open and locks up, we can kill the process without killing
the desktop / taskbar.

I apologise for the misleading information.

As Pegasus suggests you may have a rogue process pretending to be
explorer. The fact that you cannot get your settings change to stick
also suggests something is running which shouldn't be. As well as the
program he has suggested, you could try Process Explorer from sysinternals:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Which will let you investigate each process in detail.

Alister

 

[nass]

Thanks for that. I don't recall changing anything, necessarily. All I've
mentioned is that I've tried booting to safe mode and killing processes,
deleting reg keys that set themselves back up again... if anything, the
setup's the same as when I started looking at it.

Unfortunately the machine hasn't had System Restore enabled, so that isn't
an option. I have also run through scans from Windows Defender, MalwareBytes
AntiMalware and Adaware, as well as Kaspersky Anti-Virus, none of which seems
to have picked any problems out other than tracking cookies.

Also, to my recollection, regarding the multiple processes: I've always
noticed a single process for explorer.exe on every other XP install I've
used. Perhaps this isn't a great way of working, but if the one process is
capable of firing multiple folders, why do you need two processes to do the
job?

Surely I'd be able to tick a folder view option without it setting itself
back again without my knowledge?

Try to search for the two explorer.exe and see what will comes up and
compare the properties!

I wonder if it is a bat file or VBS running this second process
Process Monitor v2.04
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

PsList v1.28
http://technet.microsoft.com/en-us/sysinternals/bb896682.aspx

X-RayPc
http://www.xblock.com/download/xraypc.zip

Easy Clean:
http://www.f-secure.com/en_EMEA/security/security-center/easy-clean/
BlackLight
http://www.f-secure.com/en_UK/security/security-lab/tools-and-services/blacklight/index.html

HTH,
nass