Multipule Explorer.exe using a lot of memory.

Hello everyone,

I'm running into an issue with my system. I've attached an image of my System Processes. It's showing multipule explorer.exe processes running at over 100,000k and iexplore.exe at over 100,000k.

It's a gradual increase and does so even if I let my system just sit there after boot up. The memory increases until my system can't take it and crashed. (this happened once and I was awarded with a fantastic BSOD). I now find myself keeping the task manager open on a 2nd display and I keep ending the process when it gets fairly high.

Let me explain, my laptop worked 100% fine and never had an issue before Feb 6th in the evening. I updated my Macromedia flash and it was all down from there. A few hours later I noticed my laptop running extremely slow, checked task manager and saw the issue. I tried to do a system restore and I have no 'saved points'. I uninstalled flash and re-installed it, still have the issue.

I've checked for malware and ran Malwarebytes' Anti-Malware, Spybot - Search and Destroy, Ad-Aware from lavasoft - the problem still exists.

Can anyone please offer some advice? I'm stuck on this and greatly depend on my laptop for work.

Here are the my basic specs; (let me know if you need anything else)
https://www.asus.com/Notebooks_Ultrabooks/U56E/
Processor: Intel® Core™ i5 2520M/2450M/2430M/2410M
Operating System: Windows 7 Home Premium
Installed memory: 6gb

Thanks a lot in advance,

- Steve

Note; What is this being run? I attached another image All a sudden showed up on my task manager. I've asked my son if there was anything installed within the last week as he also uses the laptop but nothing out of the ordinary has been adjusted. Thanks again if anyone has advice.

Welcome to the Seven Forums.

I looks like you are using Internet Explorer 10 or 11 (iexplorer.exe). IE10 or IE11 will start a 64bit instance that does not create a window. That 64bit parent process (which uses very little RAM) then launches at least one 32bit child process. The child process creates the windows that you see. The children do the work of surfing. [Microsoft ignores child labor laws :-]

If you "exit" IE, the window can close, but IE can still hang on it way out of RAM. The 64bit parent and the 32bit child will not exit RAM on their own. If you start another instance of IE, you get a new parent/child pair. It looks like you have 3 parent/child pairs running. A hung IE session is the most common way to have multiple IE parent processes showing in Task Manager.

I bore you with all of the above ramblings so that I can suggest the first change to your system should be to turn on "64bit children" or "64bit tabs". See the two videos in this post and then scroll up to the tutorial: Internet Explorer 10 - Enable 32-bit or 64-bit IE10 in Windows 7

After you enable the option and after you restart your computer, IE10/11 might tell you that one or more add-on is not compatible with the Enhanced Protected Mode (EPM) - but this is a good thing - since a lot of malware is not compatible with EPM either.

You can turn off EPM later - after your computer is clean. But I would leave it turned on if possible.


Now on to Explorer [the Windows (file) Explorer]:
If are any of those instances are communicating with the internet, then you might have a rootkit.
Click on Start
type in Resource Monitor
Once that app starts, look at the Network tab.
Expand the area for TCP Connections and look for Explorer.exe
If you see explorer.exe making connections...
...then you should stop that traffic with a firewall rule.

Process Explorer might be of some help. See this post: Process Explorer 16

An offline scanner might be a place to start, but if it finds a rootkit, do not let it try to fix it.
What is Windows Defender Offline?

We will need to wait for a forum member that works with infected computers to help you clean yours.

Hello,
Thanks for the reply

I have enabled EPM which did push an alert to me when opening IE after a reboot. It did state that a javascript was not compatible. Unfortunatley I didn't grab the entire script name because IE had closed out. I have attached a screen shot of a new pop up which now appears asking me to install.

When looking at resource manager I do not fully understand how to tell if it's 'making a connection'. I do however see multipule explorer.exe and uhobco.exe listed along with wine225.exe.

What would be the best course of action to take right now?

Thanks
-Steve

I would go ahead and do the offline scan with WDO.

What antivirus app are you using? I see LiveUpdate as a process. That is usually a Symantec/Norton app.

Trying to get WDO to work. Having troubles booting via CD - will keep you posted.

Thank you so much for your advice and support.
-Steve.

If you need java, then keep it (and keep it updated).

If you don't need java, uninstall it. If you don't know if you need java, uninstall it and see if you miss having it.

Please post a screenshot of the Network tab of Resource Monitor.
(Expand the Network Activity area and/or the TCP Connections area.)


Questions:
1) What antivirus app are you using? I see LiveUpdate as a process. That is usually a Symantec/Norton app

2) Does IE still hang when you close all visible IE windows? (It can take a minute or two for IE to leave RAM after all IE windows are closed.)