Two explorer.exe, One taking all of my RAM's Memory

In the lower pane window, right-click on a column header for example "Name". A small window will show up. Click "Select columns". Then select: Path, Company Name, Verified Signer, Virus Total

I don't know. Looking at imgur: the simple image sharer several Microsoft processes are not signed in column "Verified Signer", including the 2 explorer.exe while for example Snipping Tool.exe is. But they are "clean" according to VirusTotal.

Don't know what that means but on my PC all processes by MS are signed by MS. I mainly use the Verified Signer info to check signatures only for 3rd party products, because all MS processes should be signed AFAIK.

Hope someone else can jump in here and help out. Until then you could try to scan your machine with other and IMO better products than Microsofts, for example Free Virus Scan | Online Virus Scanner from ESET

Well I had the same problem once but it can be tricky to pin down the cause. On my machine the problem has historically been caused by buggy shell extensions and also by security software.

Suggest:

Download and run UVK: UVK - Ultra Virus Killer

   Note

Don't try running any UVK fixes as they are only needed for specific problems and only if and when needed.

From the GUI select "Scan and create log" with the following options selected.



The resulting log should contain anything that creates a right click context menu in Explorer when you right click on a file or folder. If there's anything that you don't use - disable the entry. Whatever is left - check for updates for those products. You could upload the log and attach it to your next post if you like.

You can usually disable context menu entires from within the offending program's settings.

Also when running UVK take a look at "Memory Modules Manager" and use it to see what dll's the offending explorer.exe (from the PID) has loaded. You can get the PID from Process Explorer or change Task Manager view settings to show process PID.

Here's an example and you can see that the highlighted entries are shell extensions that integrate with explorer.



We would be most interested in the results shown for the problem explorer process.

Okay so I've only had a quick look so far. I've spotted a few things.

7-zip hasn't been updated in a long time and did cause problems on my machine at one point with two explorer.exe processes being created. A quick test would be to uninstall 7-zip as it's free - it can be reinstalled any time. Don't remove it just yet though. What method do you use to uninstall software?

You've also got WinRar alongside 7-zip. Do you need them both?

You've got an Avast file context menu entry:

<FileContextMenu> | 00avast | | No description | Hash error: Directory | Unsigned : No publisher

However it looks like your on board security is currently Kaspersky (KIS). Do you see any Avast entry in your right click context menu when right clicking on a file? Try a few file types including executables.

If you previously used Avast but have removed it -how did you do it?

There are other entries that I need to ask about. Power ISO - do you really need a folder right click context menu entry? Same goes for VLC. Media files play fine for me in VLC without enabling the context menu.

Then you're using Google Drive and Dropbox. I heard about a problem with the Dropbox shell extension some time ago. I don't use either but check for Dropbox version updates.

I'm going to take a look at the file you uploaded to Dropbox but I'll need to disable my hosts file and post again after looking at your file.

For the time being just try answering the above questions if you can. Thanks!

A note: both the specs and this screenshot https://i.imgur.com/wYbXUnI.png indicates that also Microsoft Security Essentials is running. So it seems to me that more than one anti-virus product is running which is not recommended. It can cause conflicts and strange problems.

And from the latest screenshot I noticed an old and vulnerable version of Adobes Flash Player for Internet Explorer. Outdated over a year ago.