Explorer.exe causes Iexplore to open multiple instances and high mem

TBH, I'm surprised it took them so long to pull them in the first place - I'm thinking that someone's going to lose their bonus this year - if nothing else!

gregrocker said:

mohavepc;2858079

I checked and low and behold C:Acer was not active which is indeed where the OS is installed. We have rebooted once and are at the [B said:

"Expanding Windows files 18%"[/B] Stage 3 so far so good. we will see if this fixes the issue or not here in a few. Will let you know.

**update**
We are now at the "Transfering files" stage 5 so the "Active" setting was the key in repair installation error.

The picture you posted shows System Reserved is booting C as signified by the System label and therefore it must be marked Active and should not be expected to boot Win7 if it's not. To move it to C it would normally require running 3 Startup Repairs or transferring the System flag there by some other method as the Active flag alone cannot boot Win7 but only points to the intended boot partition, where the boot files must still be installed and bcd edited to change boot partition.

However doing a Repair Install it should reconfigure the boot so it may itself transfer the System flag to C based on where you planted the Active flag and abandon the System Reserved partition. You'll know this because it will boot. If it won't then I'd move the Active flag back to SysReserved to boot it.

The linked post refers to this possibly working for your purposes because SysReserved doesn't have enough free space to stage the Repair Install, something we've seen before with Win7 imaging failing to run due to not enough space for the the SysVol file to expand. So its plausible and would be easier to know if we could see the used space of SysReserved partition since those readings are masked in your screenshot. No more than half should be used.

The new screenshot shows 60 percent free on that partition. I did not intentionally mask the original screenshot. (you should have corrected me and made me take another )

I found that NONE of the partitions were marked active. Is this possible? don't think so as windows needs to know where to look. When I marked c: active it threw me a warning that only the partition with windows installed should be marked active. It rebooted without issue so I believe it Was active but not reading so from within windows hence the corruption and inability to do an in place upgrade.

It should have never booted if I had actually moved the flag. I believe all I did was correct an error. seatools shows the drive as healthy and it is running like a champ. It is now activated and has 144 updates done. will be ready to give back to the customer tomorrow.

gregrocker said:

It's booting because a Repair Install like any install refreshes the boot config so it moved System to C following the Active flag - unless you're saying it booted before the Repair Install yet after the Active flag moved Yes that is what I am saying

The fact that System Active was flagged in picture on SysReserved is always determinative so I doubt Disk Mgmt had it wrong at that point, although its possible. Otherwise For C to be bootable it had to have the boot files written and be bootsected previously. Which I believe it did

Now you have an orphan Sys Reserved which can be deleted. That it interfered with Repair Install is hard to say as I've never seen it before and we get the toughest cases here. It is an interesting case to remember. Bookmarked

I as well. I have only seen something similar Once Before but it was with a Linux install that had issues with a system flag outside and inside the os. I had set up a Ext4 partition using g parted but the os when loaded reported it as ntsf and would not allow me access to the data.

I know it sounds impossible and stupid but it happened. I figure that windows had it wrong and when it saw it correctly it was able to repair install. I don't know for sure what happened, I just know it worked without too much issue and it is running great.

Got another with the same symptoms the 64bit version of IE is running up memory. This time I was trying out a new scanner software from Sophos and it came up with a Trojan cidoxVBR-a that it said could not be healed. Kaspersky rescue and AVG rescue find nothing. I am currently running a scan with Bit defender Rescue that has found nothing with the exception of a couple of disk errors even though sea tools found no issues. Malware bytes trial shows constant attempts of IE trying to reach out to several questionable sites but unable to find what is triggering it. A repair install fails with the unable to prepare system to restart. The active flag is on the system reserved partition and if moved it fails to boot as expected.

This is a gaming rig and there are at least 45 different steam games and several more other games that the customer adamantly does not want to reinstall(can't exactly blame him there). I realize I may have no other choice but with this not being a one off issue I was hoping someone might have an idea what the cause is or how to go about finding the little bugger causing it.
Thank you

Again - check the Scheduled Tasks and see if there's anything odd in there - a lot of recent nasties have put stuff in there, and very few cleaners seem to look there.

gregrocker said:

I'd research everything you can find on the infection, post it up in Security section. Try cleaning it up.

I'd also check closely all Browser Add-On's and Search services to see if it's lodged in there since IE is irregular. Often times even when uninstalled these spywares often stay running via the registry but are found by SuperAntiSpyware scan.

Ran SAS but all it found was a few tracking cookies. I will try resetting IE again and perhaps removing and reinstalling in features. All I can find on the infection of the CidoxVBR-a is a couple pages on Sophos website whick essentially says to run their scanner which coincidentally fails to remove the infection then fails a second run saying it must be activated (of course it does). The other relevant page says to run the bitdefender rescue to remove the rootkit. will let you know and if Repairing IE doesn't fix it I will post in Security. Thanks Greg.

NoelDP said:

Again - check the Scheduled Tasks and see if there's anything odd in there - a lot of recent nasties have put stuff in there, and very few cleaners seem to look there.

nothing abnormal in tasks (checked there first :) ) but disabled everything as well as a clean boot. Clean boot still has IE pop up regularly and run ram up.