1 Chrome window (1 tab), but 12 "chrome.exe *32" in Task Manager!

Itundic · 24 Apr 2015

When I launch Chrome, I find 10 to 12 "chrome.exe *32" processes running in the background and the laptop can get pretty slow.

Chrome regularly displays "Not responding", as the laptop struggles to process what should be a simple opening or closing of a tab.

This is what I have at the moment, with just one Chrome window and one tab:

1 Chrome window (1 tab), but 12 "chrome.exe *32" in Task Manager!-2015-04-24_175116.jpg

I have 64-bit Win 7.

Also, I no longer get the Google page, when I open the Browser for the first time, only "about:blank". It appears from the second tab onwards and for every other Chrome window and tab I open and shows the frequently visited sites, as normal.

What can I do?

ThrashZone · 24 Apr 2015

Hi,
Obviously you have some corruption most likely a virus or malware,
What type of extensions do you have installed in Chrome,
Review Jacee’s instructions to run Adwcleaner here post #7,
Ignore the title of the thread,
https://www.sevenforums.com/system-security/316404-instant-savings-app.html
This is what the download button looks like on the BleepingComputer site,

You can use these free tools to see if they find anything,
Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
See this tutorial on how to download and run Malwarebytes,
https://www.sevenforums.com/tutorials/338716-malwarebytes-anti-malware-free.html
Also use the Custom scan option not the Threat scan,

Please Do Not clean/ Delete or Remove Any detections before posting the scan results first before review especially Malwarebytes,
http://www.malwarebytes.org/products/malwarebytes_free
SAS is safe to remove anything it finds

http://www.superantispyware.com/?tag=SUPERANTISPYWARE
This one is the longest up to 4 hours, the others are only about 45 minutes,
http://www.microsoft.com/security/scanner/en-us/default.aspx

Alejandro85 · 24 Apr 2015

This is quite normal for Chrome, it's a documented design flaw. Have a look at the details here:
Chromium Blog: Multi-process Architecture

In short, it opens a main process, a process for each tab, a process for each plugin and a process for each extension, or at least that's what they say. It doesn't surprises me to see such usage, even with an empty browser, it's the way it's meant to be (for good or bad).
I find very little reason to worry about that really.

ThrashZone said:

Obviously you have some corruption most likely a virus or malware,
What type of extensions do you have installed in Chrome

Very unlikely to be virus related, considering that Chrome published this behavior years ago and is widely known and even copied by other programs. Lots of extensions inside Chrome would easily explain the tons of processes.
Some routine virus scan for the sake of extra-safety would suffice, just in case, I think.

Unless there is a virus trying to disguise as Chrome

ThrashZone · 24 Apr 2015

Hi,
Well plug-ins/ extensions get installed sometimes without notice in Chrome too,
These extensions often effect other installed browsers
Either way using that much juice might be normal but I'd say not a good thing
Cheers.

Just a note a lot of people were freaked out because ie10-11 had one process and another for every open tab,
Chrome does it for each extension

Itundic · 25 Apr 2015

Sorry for the delay - I've been running complete scans for as many of the progs as possible.

I've had these Chrome extensions for 1,2 or 3 years without any problems:

Avast Online Security 10.2.0.190
Evernote Web Clipper 6.3
EagleGet
Flubit extension 1.1.3.1 - owned by Amazon, usd to get personal lower prices.
Full Page Screen Capture 0.0.15
History Trends Unlimited 1.1.2 - Analyse search and browsing history
Print Friendly & PDF 2.3 - strips extraneous graphics, etc, from webpages leaving only the article to print/turn into PDF
Search the Current Site 6.3 - search all pages of a website

# AdwCleaner v4.202 - Logfile created 25/04/2015 at 00:16:10
# Updated 23/04/2015 by Xplode
# Database : 2015-04-23.2 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Dad - DAD-PC
# Running from : C:\PROGRAMS\AdwCleaner 4.202\adwcleaner_4.202.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifohbjbgfchkkfhphahclmkpgejiplfo_0.localstorage
File Found : C:\Users\Public\Desktop\eBay.lnk
Folder Found : C:\Program Files (x86)\Coupon Printer
Folder Found : C:\Program Files (x86)\FLV Player
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupon Printer
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLV Player
Folder Found : C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\jliolpcnkmolaaecncdfeofombdekjcp
Folder Found : C:\Windows\FLV Player

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Data Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
Key Found : HKCU\Software\Ask&Record
Key Found : HKCU\Software\Local AppWizard-Generated Applications
Key Found : [x64] HKCU\Software\Ask&Record
Key Found : [x64] HKCU\Software\Local AppWizard-Generated Applications
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5555CC4C-FA2B-4D69-8296-B6AE5E95C0B7}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{63BEF061-5EFC-4753-9806-ED0573BC7C4B}
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0E44BB13-2523-468B-BF51-58D5F52A84F6}
Key Found : HKLM\SOFTWARE\SimplyGen
Key Found : HKU\.DEFAULT\Software\Local AppWizard-Generated Applications

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17728

-\\ Mozilla Firefox v37.0.2 (x86 en-GB)

-\\ Google Chrome v42.0.2311.90

[C:\Users\CCleaner-Test\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://uk.ask.com/web?q={searchTerms}
[C:\Users\CCleaner-Test\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Found [Extension] : eofcbnmajmjmplflapaojjnihcjkigck
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://uk.ask.com/web?q={searchTerms}
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3315513&octid=EB_ORIGINAL_CTID&ISID=M08AB69D0-373D-4C18-956B-1138BD153C79&SearchSource=58&CUI=&UM=5&UP=SPF72EF9AF-729C-4225-8D57-299642F05D15&q={searchTerms}&SSPV=
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Found [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Found [Extension] : eofcbnmajmjmplflapaojjnihcjkigck
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Found [Extension] : flpcjncodpafbgdpnkljologafpionhb
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Found [Extension] : jliolpcnkmolaaecncdfeofombdekjcp

-\\ Chromium v

*************************

AdwCleaner[R0].txt - [3502 bytes] - [25/04/2015 00:16:10]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3561 bytes] ##########

The only suspicious item here, that I think is fine, is the FLV Player.

MBAM

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 25/04/2015
Scan Time: 00:31:49
Logfile: MBAM 2015-04-25 Results.txt
Administrator: Yes

Version: 2.01.4.1018
Malware Database: v2015.04.24.08
Rootkit Database: v2015.04.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Dad

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 661839
Time Elapsed: 2 hr, 39 min, 21 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.InstallIQ.A, C:\PROGRAMS\Applian FLV Player 2.0.25\applianflv.exe, , [94d41c547e0cd66058771730ba47ce32],

Physical Sectors: 0
(No malicious items detected)

(end)

SuperAntispyware

It found 161 tracking cookies, which I deleted.

Microsoft Security Scanner

After 3 hours, it began scanning my external drive, so I cancelled the scan. It hadn't found anything. I couldn't find any way of limiting the scan to the "C:\" drive.

Although multiple processes is a feature of Chrome - which I wasn't aware of, unfortunately - there has to be a reason for why Chrome often grinds to a halt (taking the laptop with it), while Firefox is usually lightning fast in comparison.

ThrashZone · 25 Apr 2015

Thanks for the additional info,
yep well you might be seeing the effects of 3 gb of ram,
What antivirus program or any other security related suites do you use before the scanners I recommended using
It might be throwing a fit over all of the processes ?
Cheers.
According to this JRT is recommended to run,
Also HitmanPro
Remove Win32/InstallIQ.A virus (Easy Removal Guide)

If you ever save directly to the external it should also be scanned my friend :)

Itundic · 26 Apr 2015

I have Avast Free Antivirus 2015 and the bog-standard Windows 7 firewall, I'm afraid. Plus Malwarebytes Anti-exploit free and Zemana AntiLogger.

# AdwCleaner v4.202 - Logfile created 26/04/2015 at 20:47:22
# Updated 23/04/2015 by Xplode
# Database : 2015-04-23.2 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Dad - DAD-PC
# Running from : C:\PROGRAMS\AdwCleaner 4.202\adwcleaner_4.202.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

[x] Not Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLV Player
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupon Printer
[x] Not Deleted : C:\Program Files (x86)\FLV Player
Folder Deleted : C:\Program Files (x86)\Coupon Printer
[x] Not Deleted : C:\Windows\FLV Player
Folder Deleted : C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\jliolpcnkmolaaecncdfeofombdekjcp
File Deleted : C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifohbjbgfchkkfhphahclmkpgejiplfo_0.localstorage
File Deleted : C:\Users\Public\Desktop\eBay.lnk

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5555CC4C-FA2B-4D69-8296-B6AE5E95C0B7}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{63BEF061-5EFC-4753-9806-ED0573BC7C4B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0E44BB13-2523-468B-BF51-58D5F52A84F6}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Ask&Record
Key Deleted : HKCU\Software\Local AppWizard-Generated Applications
Key Deleted : HKLM\SOFTWARE\SimplyGen
Key Deleted : HKU\.DEFAULT\Software\Local AppWizard-Generated Applications
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17728

-\\ Mozilla Firefox v37.0.2 (x86 en-GB)

-\\ Google Chrome v42.0.2311.90

[C:\Users\CCleaner-Test\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://uk.ask.com/web?q={searchTerms}
[C:\Users\CCleaner-Test\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : eofcbnmajmjmplflapaojjnihcjkigck
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://uk.ask.com/web?q={searchTerms}
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3315513&octid=EB_ORIGINAL_CTID&ISID=M08AB69D0-373D-4C18-956B-1138BD153C79&SearchSource=58&CUI=&UM=5&UP=SPF72EF9AF-729C-4225-8D57-299642F05D15&q={searchTerms}&SSPV=
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : eofcbnmajmjmplflapaojjnihcjkigck
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : flpcjncodpafbgdpnkljologafpionhb
[C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : jliolpcnkmolaaecncdfeofombdekjcp

-\\ Chromium v

*************************

AdwCleaner[R0].txt - [3652 bytes] - [25/04/2015 00:16:10]
AdwCleaner[R1].txt - [3711 bytes] - [26/04/2015 20:40:59]
AdwCleaner[S0].txt - [3571 bytes] - [26/04/2015 20:47:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3630 bytes] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.6.4 (04.26.2015:1)
OS: Windows 7 Home Premium x64
Ran by Dad on 26/04/2015 at 21:40:38.44
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1392B8D2-5C05-419F-A8F6-B9F15A596612}

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] C:\Windows\syswow64\ai_recyclebin

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26/04/2015 at 21:47:26.29
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 26/04/2015
Scan Time: 22:01:43
Logfile: MBAM 2015-04-26.txt
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.04.26.05
Rootkit Database: v2015.04.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Dad

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 438882
Time Elapsed: 27 min, 15 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

Code:

HitmanPro 3.7.9.240
www.hitmanpro.com

   Computer name . . . . : DAD-PC
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Dad-PC\Dad
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2015-04-26 22:46:15
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 5m 40s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 2

   Objects scanned . . . : 1,927,805
   Files scanned . . . . : 25,661
   Remnants scanned  . . : 308,451 files / 1,593,693 keys

Potential Unwanted Programs _________________________________________________

   HKU\S-1-5-21-1050699504-4118538850-2090742069-1001\Software\AppDataLow\Software\Smartbar\ (Conduit)

Cookies _____________________________________________________________________

   C:\Users\CCleaner-Test\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net

I couldn't delete these as I couldn't activate the free licence.

1 Chrome window (1 tab), but 12 "chrome.exe *32" in Task Manager!-2015-04-26_232754.jpg

I can't find a way to add HitmanPro35.exe to the list of allowed processes in the Windows firewall. I've added HitmanPro.exe, but it didn't make any difference.

Is the slowness of Chrome really down to too little RAM? I know 3Gb isn't much at all and Firefox only has one "firefox.exe *32" process running, making it quicker than Chrome, but there is still a huge difference. The laptop often grinds to a halt when I use Chrome.

ThrashZone · 26 Apr 2015

I believe it is just Chrome bogging you down and Avast trying to keep up with all of those processes
The scans as long as you cleaned should be good,
Reset Chrome and firefox for a clean start,

You showed 8 extensions in Chrome but there was 4 additional Chrome processes running I'll assume four tabs were open and not one or two as you stated ?

You might want to test and uninstall one at a time your extensions and see if you can find the problematic add-on soaking up 66.668 kb seems quite a bit to me via your screen shot
Cheers.

datapod · 27 Apr 2015

Looks quite the same on my machine.

I had questioned it initially too. My research indicated it was normal for Chrome and does not seem to cause me any problems.

There is an option in Chromes advanced settings to prevent background processes from running after Chrome is closed you might want to experiment with.

I find I get much faster load times with the background processes running and as a have a silly abundance of RAM I just leave it. HTH

D

Callender · 27 Apr 2015

@ datapod

Do you get a huge Chrome cache after a browsing session that takes ages to cleanup using Ccleaner? Itundic has reported this issue in another thread. So - is it normal and what's your typical cache size after a browsing session?

Thanks.