Two explorer.exe, One taking all of my RAM's Memory

Ran into same issue - computer was crawling. Thanks so much for all your work and problem solving on this - I read through the 12 thread pages. The uvk script worked great as I noted the same hidden folder. My computer now screams along fine/as usual ... EXCEPT: I still see two windows explorer processes when I go on line. The good news is that it is no longer a RAM hog ( was using almost 4GB and now stays in the 30-40k range) but still there after reboot. Something to worry about? leave it alone? keep an eye on? The memory usage has stabilized (waited 24 hours to share this) - will let you know. Thanks for any thoughts.

Maybe thats there because you have the option for a new explorer,exe process to run when a new file is open?

Id like to thank you all , was having the same issue found this thread , found the same folder and cleaned it up

Saved me so much time after a few scans , only thing id done lately was windows updates and a flash player update so no idea where it came from but it was driving me nuts so thanks for the hard work

I'm having exactly the same problem with my laptop! So glad I found this thread, I've been trying to find a solution since October. I also have the folder with the same name in \ProgramData and have 2 Explorers, one of which uses all my memory. Can you please post the fix, I didn't quite understand how to delete this folder and get rid of the virus. Both Norton and Kasperski couldn't find it and I didn't quite get from this topic how to remove it. Thank you!

UPDATE: downloaded UVK and used it to delete the folder in \ProgramData. THe problem appears to be solved. Anything else I need to do? Thanks!

Callender said:

ITsupportneeded said:

UPDATE: downloaded UVK and used it to delete the folder in \ProgramData. THe problem appears to be solved. Anything else I need to do? Thanks!

Have a clean up maybe. Run Ccleaner or similar if you've got it installed. Delete all system restore points and create a new one. You could also check what's connecting using the method in Post #81 or use any similar utility that you've got installed.

Thank you! I used a Kasperski tool tdsskiller and Norton's clean up utilities to look for virus in the last few days and both came back clean. They only thing that helped was the deletion of that folder in \ProgramData. I might get the ccleaner and run it. The rest looks a bit too complicated for me :) Thank you so much for posting the solution, I've been googling the solution to this problem for 2 months and couldn't find the it anywhere! Why doesn't Norton address it? I have it running all the time!

A big thanks to all of you for doing the leg work.

I too had the same symptoms and GUID folder (Hidden under c:\ProgramData) with the recently modified login date.

For any others out there it seems to be getting in by old Java versions. AVG, MalwareBytes, and even combofix hadn't detected the issue.

I ended up using unlocker (downloaded from CNET Unlocker - Free download and software reviews - CNET Download.com) to forcefully delete the folder.

So far no 2nd explorer has come back taking up all the ram. Agreed that it's using signed DLLs to avoid detection . . . though I think mine was a different DLL name.

Thanks again for the help.