How to find what process(es) could spawn multiple explorer.exe processes on a Windows 7 Pro ...
Check if a string is entirely made of the same substring
Retract an already submitted recommendation letter (written for an undergrad student)
Why isn't everyone flabbergasted about Bran's "gift"?
The art of proof summarizing. Are there known rules, or is it a purely common sense matter?
What is the term for a person whose job is to place products on shelves in stores?
"My boss was furious with me and I have been fired" vs. "My boss was furious with me and I was fired"
"Whatever a Russian does, they end up making the Kalashnikov gun"? Are there any similar proverbs in English?
My bank got bought out, am I now going to have to start filing tax returns in a different state?
Is it acceptable to use working hours to read general interest books?
What is the ongoing value of the Kanban board to the developers as opposed to management
Is there any hidden 'W' sound after 'comment' in : Comment est-elle?
What is the least dense liquid under normal conditions?
Do I need to protect SFP ports and optics from dust/contaminants? If so, how?
Arriving in Atlanta after US Preclearance in Dublin. Will I go through TSA security in Atlanta to transfer to a connecting flight?
Is Electric Central Heating worth it if using Solar Panels?
Married in secret, can marital status in passport be changed at a later date?
Could moose/elk survive in the Amazon forest?
Multiple options vs single option UI
A strange hotel
I preordered a game on my Xbox while on the home screen of my friend's account. Which of us owns the game?
What’s with the clanks in Endgame?
A Paper Record is What I Hamper
A Dictionary or Encyclopedia of Fantasy or Fairy Tales from the 1960s
Contradiction proof for inequality of P and NP?
How to find what process(es) could spawn multiple explorer.exe processes on a Windows 7 Pro
Unicorn Meta Zoo #1: Why another podcast?
Announcing the arrival of Valued Associate #679: Cesar ManaraMultiple iexplore.exe processing running in Windows 7Find user running windows processCannot terminate process, “already terminated”How do I determine if a process on Windows “has no parent”?Process Manager/Hacker show already closed processes in Windows 8.1How can I see which user accounts are running which processes in Windows 8.1?How to show full command line of all processes in WindowsWhat is non-existent process in windows?why do i have more chrome processes in process-explorer than in chrome task manager?How to reset explorer.exe when I can't see it? Text not populating in Task Manager, Windows Explorer, and some other programs
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
Is it normal to have multiple explorer.exe processes running on a Windows 7 Pro (64-bit)?
(So just to clarify, this is not about the iexplore.exe which is the Windows Internet Explorer browser.)
I have currently 5 explorer.exe processes running on this machine according to Windows Task Manager. I do not have any Explorer (meaning: Windows file explorer) windows open, and I am the only user on this machine at the moment. In any case these multiple explorer processes show in Task Manager when I have not clicked on the "Show processes from all users" button.
I had configured Task Manager to display the "Command Line" column under the Processes tab, and based on that these started by following command lines:
- 1 (this is probably the "original") started with command line:
"C:WindowsExplorer.exe"
- 3 started with command line:
"C:Windowsexplorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding"
- 1 started with command line:
"C:Windowsexplorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding"
According to Process Hacker these have all been started by winit.exe > services.exe > svchost.exe which looks normal.
The svchost.exe is running (according to Process Hacker) these services: DcomLaunch, PlugPlay, and Power.
Could it be that the two bottom "explorer.exe" processes in above list (where the command line ends with "embedding") may have been started by some other process? If so, how could I find what process(es) might be spawning these?
process windows-explorer
asked Dec 18 '14 at 1:23
user100487user100487
3393618
migrated from stackoverflow.com Dec 21 '14 at 1:47
This question came from our site for professional and enthusiast programmers.
add a comment |
Is it normal to have multiple explorer.exe processes running on a Windows 7 Pro (64-bit)?
(So just to clarify, this is not about the iexplore.exe which is the Windows Internet Explorer browser.)
I have currently 5 explorer.exe processes running on this machine according to Windows Task Manager. I do not have any Explorer (meaning: Windows file explorer) windows open, and I am the only user on this machine at the moment. In any case these multiple explorer processes show in Task Manager when I have not clicked on the "Show processes from all users" button.
I had configured Task Manager to display the "Command Line" column under the Processes tab, and based on that these started by following command lines:
- 1 (this is probably the "original") started with command line:
"C:WindowsExplorer.exe"
- 3 started with command line:
"C:Windowsexplorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding"
- 1 started with command line:
"C:Windowsexplorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding"
According to Process Hacker these have all been started by winit.exe > services.exe > svchost.exe which looks normal.
The svchost.exe is running (according to Process Hacker) these services: DcomLaunch, PlugPlay, and Power.
Could it be that the two bottom "explorer.exe" processes in above list (where the command line ends with "embedding") may have been started by some other process? If so, how could I find what process(es) might be spawning these?
process windows-explorer
asked Dec 18 '14 at 1:23
user100487user100487
3393618
migrated from stackoverflow.com Dec 21 '14 at 1:47
This question came from our site for professional and enthusiast programmers.
Which services is that svchost running?
– SLaks
Dec 18 '14 at 1:26
@SLaks, the svchost.exe is running (according to Process Hacker) 3 services: DcomLaunch, PlugPlay, and Power.
– user100487
Dec 18 '14 at 1:30
Have you run malwarebytes yet?
– Tyson
Dec 21 '14 at 1:56
@Tyson, I have not run malwarebytes. I do have F-Secure Internet Security 2015 which I have run, however, and it has not found anything. I checked malwarebytes website and, looking at the description of their software, it seems to have the same features as what F-Secure advertizes. But I will check it out and let you know if it finds anything.
– user100487
Dec 21 '14 at 17:35
Only times I've run into multiple explorer.exe's it was the result of malware, after all who would kill explorer.exe and which one? While all malware scanners do most of the same things they all vary greatly due to the database behind them.
– Tyson
Dec 21 '14 at 17:51
add a comment |
Is it normal to have multiple explorer.exe processes running on a Windows 7 Pro (64-bit)?
(So just to clarify, this is not about the iexplore.exe which is the Windows Internet Explorer browser.)
I have currently 5 explorer.exe processes running on this machine according to Windows Task Manager. I do not have any Explorer (meaning: Windows file explorer) windows open, and I am the only user on this machine at the moment. In any case these multiple explorer processes show in Task Manager when I have not clicked on the "Show processes from all users" button.
I had configured Task Manager to display the "Command Line" column under the Processes tab, and based on that these started by following command lines:
- 1 (this is probably the "original") started with command line:
"C:WindowsExplorer.exe"
- 3 started with command line:
"C:Windowsexplorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding"
- 1 started with command line:
"C:Windowsexplorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding"
According to Process Hacker these have all been started by winit.exe > services.exe > svchost.exe which looks normal.
The svchost.exe is running (according to Process Hacker) these services: DcomLaunch, PlugPlay, and Power.
Could it be that the two bottom "explorer.exe" processes in above list (where the command line ends with "embedding") may have been started by some other process? If so, how could I find what process(es) might be spawning these?
process windows-explorer
asked Dec 18 '14 at 1:23
user100487user100487
3393618
Is it normal to have multiple explorer.exe processes running on a Windows 7 Pro (64-bit)?
(So just to clarify, this is not about the iexplore.exe which is the Windows Internet Explorer browser.)
I have currently 5 explorer.exe processes running on this machine according to Windows Task Manager. I do not have any Explorer (meaning: Windows file explorer) windows open, and I am the only user on this machine at the moment. In any case these multiple explorer processes show in Task Manager when I have not clicked on the "Show processes from all users" button.
I had configured Task Manager to display the "Command Line" column under the Processes tab, and based on that these started by following command lines:
- 1 (this is probably the "original") started with command line:
"C:WindowsExplorer.exe"
- 3 started with command line:
"C:Windowsexplorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding"
- 1 started with command line:
"C:Windowsexplorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding"
According to Process Hacker these have all been started by winit.exe > services.exe > svchost.exe which looks normal.
The svchost.exe is running (according to Process Hacker) these services: DcomLaunch, PlugPlay, and Power.
Could it be that the two bottom "explorer.exe" processes in above list (where the command line ends with "embedding") may have been started by some other process? If so, how could I find what process(es) might be spawning these?
process windows-explorer
process windows-explorer
asked Dec 18 '14 at 1:23
user100487user100487
3393618
asked Dec 18 '14 at 1:23
user100487user100487
3393618
asked Dec 18 '14 at 1:23
user100487user100487
3393618
asked Dec 18 '14 at 1:23
user100487user100487
3393618
asked Dec 18 '14 at 1:23
user100487user100487
3393618
3393618
migrated from stackoverflow.com Dec 21 '14 at 1:47
This question came from our site for professional and enthusiast programmers.
migrated from stackoverflow.com Dec 21 '14 at 1:47
This question came from our site for professional and enthusiast programmers.
Which services is that svchost running?
– SLaks
Dec 18 '14 at 1:26
@SLaks, the svchost.exe is running (according to Process Hacker) 3 services: DcomLaunch, PlugPlay, and Power.
– user100487
Dec 18 '14 at 1:30
Have you run malwarebytes yet?
– Tyson
Dec 21 '14 at 1:56
@Tyson, I have not run malwarebytes. I do have F-Secure Internet Security 2015 which I have run, however, and it has not found anything. I checked malwarebytes website and, looking at the description of their software, it seems to have the same features as what F-Secure advertizes. But I will check it out and let you know if it finds anything.
– user100487
Dec 21 '14 at 17:35
Only times I've run into multiple explorer.exe's it was the result of malware, after all who would kill explorer.exe and which one? While all malware scanners do most of the same things they all vary greatly due to the database behind them.
– Tyson
Dec 21 '14 at 17:51
add a comment |
Which services is that svchost running?
– SLaks
Dec 18 '14 at 1:26
@SLaks, the svchost.exe is running (according to Process Hacker) 3 services: DcomLaunch, PlugPlay, and Power.
– user100487
Dec 18 '14 at 1:30
Have you run malwarebytes yet?
– Tyson
Dec 21 '14 at 1:56
@Tyson, I have not run malwarebytes. I do have F-Secure Internet Security 2015 which I have run, however, and it has not found anything. I checked malwarebytes website and, looking at the description of their software, it seems to have the same features as what F-Secure advertizes. But I will check it out and let you know if it finds anything.
– user100487
Dec 21 '14 at 17:35
Only times I've run into multiple explorer.exe's it was the result of malware, after all who would kill explorer.exe and which one? While all malware scanners do most of the same things they all vary greatly due to the database behind them.
– Tyson
Dec 21 '14 at 17:51
Which services is that svchost running?
– SLaks
Dec 18 '14 at 1:26
Which services is that svchost running?
– SLaks
Dec 18 '14 at 1:26
@SLaks, the svchost.exe is running (according to Process Hacker) 3 services: DcomLaunch, PlugPlay, and Power.
– user100487
Dec 18 '14 at 1:30
@SLaks, the svchost.exe is running (according to Process Hacker) 3 services: DcomLaunch, PlugPlay, and Power.
– user100487
Dec 18 '14 at 1:30
Have you run malwarebytes yet?
– Tyson
Dec 21 '14 at 1:56
Have you run malwarebytes yet?
– Tyson
Dec 21 '14 at 1:56
@Tyson, I have not run malwarebytes. I do have F-Secure Internet Security 2015 which I have run, however, and it has not found anything. I checked malwarebytes website and, looking at the description of their software, it seems to have the same features as what F-Secure advertizes. But I will check it out and let you know if it finds anything.
– user100487
Dec 21 '14 at 17:35
@Tyson, I have not run malwarebytes. I do have F-Secure Internet Security 2015 which I have run, however, and it has not found anything. I checked malwarebytes website and, looking at the description of their software, it seems to have the same features as what F-Secure advertizes. But I will check it out and let you know if it finds anything.
– user100487
Dec 21 '14 at 17:35
Only times I've run into multiple explorer.exe's it was the result of malware, after all who would kill explorer.exe and which one? While all malware scanners do most of the same things they all vary greatly due to the database behind them.
– Tyson
Dec 21 '14 at 17:51
Only times I've run into multiple explorer.exe's it was the result of malware, after all who would kill explorer.exe and which one? While all malware scanners do most of the same things they all vary greatly due to the database behind them.
– Tyson
Dec 21 '14 at 17:51
add a comment |
2 Answers
2
active
oldest
votes
On my machine I get explorer processes like what you have, if I:
- open an explorer Window, click on Tools [menu] > Folder Options, and select the option "Launch folder windows in a separate process", and after this...
- open a folder from a shortcut, or from a web browsers (e.g. Firefox or Opera) downloads dialog by selecting "Open containing folder"
In above situation, the OS creates a new explorer process with setting similar to what you describe.
Note that these new explorer processes are typically not shut down automatically if you close the opened explorer windows. So you can well be left with multiple background processes having those command lines you are describing. If you want to avoid this, un-tick the "Launch folder windows in a separate process" option.
answered Dec 21 '14 at 22:33
coderworkscoderworks
309214
add a comment |
It is apparently an undocumented design decision. Prior to Win7, there was only one instance of explorer.exe, unless when you have "Launch folder windows in a separate process" enabled, or something went very wrong.
Since Win7, you may have multiple explorer.exe running even when "Launch folder windows in a separate process" is disabled. This is normal behavior that happens even on a clean installation of Windows. It can be triggered by running explorer.exe with one or more well-known command line parameters.
Example:explorer.exe C:explorer.exe /select,C:
While the change and the reasoning for the change is undocumented, it seems to be a deliberate design decision, or leftover from an ambitious design decision that was abandoned right before Win7 RTM. This premise is made based on a fact that if you find the CLSID after /factory, in Registry, you may find something interesting as below.
{ceff45ee-c862-41de-aee2-a022c81eda92} // CLSID_SeparateSingleProcessExplorerHost
When "Launch folder windows in a separate process" is enabled, it starts with command line /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding.
{75dff2b7-6936-4c06-a8bb-676a7b00b24b}` // CLSID_SeparateMultipleProcessExplorerHost
When explorer.exe is started with one or more command-line parameters (usually called by programs that implements "Open Containing Folder" by starting explorer.exe /select,<file path>), it starts with command line /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding. It deliberately starts a new instance for each invocation by specifying the SingleUse.
So, to answer your answer, to find what process spawned multiple explorer.exe of {75dff2b7-6936-4c06-a8bb-676a7b00b24b}, you need to identify which programs start explorer.exe with parameters like /select.
answered 17 hours ago
raymai97raymai97
1113
New contributor
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f855133%2fhow-to-find-what-processes-could-spawn-multiple-explorer-exe-processes-on-a-wi%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
On my machine I get explorer processes like what you have, if I:
- open an explorer Window, click on Tools [menu] > Folder Options, and select the option "Launch folder windows in a separate process", and after this...
- open a folder from a shortcut, or from a web browsers (e.g. Firefox or Opera) downloads dialog by selecting "Open containing folder"
In above situation, the OS creates a new explorer process with setting similar to what you describe.
Note that these new explorer processes are typically not shut down automatically if you close the opened explorer windows. So you can well be left with multiple background processes having those command lines you are describing. If you want to avoid this, un-tick the "Launch folder windows in a separate process" option.
answered Dec 21 '14 at 22:33
coderworkscoderworks
309214
add a comment |
On my machine I get explorer processes like what you have, if I:
- open an explorer Window, click on Tools [menu] > Folder Options, and select the option "Launch folder windows in a separate process", and after this...
- open a folder from a shortcut, or from a web browsers (e.g. Firefox or Opera) downloads dialog by selecting "Open containing folder"
In above situation, the OS creates a new explorer process with setting similar to what you describe.
Note that these new explorer processes are typically not shut down automatically if you close the opened explorer windows. So you can well be left with multiple background processes having those command lines you are describing. If you want to avoid this, un-tick the "Launch folder windows in a separate process" option.
answered Dec 21 '14 at 22:33
coderworkscoderworks
309214
add a comment |
On my machine I get explorer processes like what you have, if I:
- open an explorer Window, click on Tools [menu] > Folder Options, and select the option "Launch folder windows in a separate process", and after this...
- open a folder from a shortcut, or from a web browsers (e.g. Firefox or Opera) downloads dialog by selecting "Open containing folder"
In above situation, the OS creates a new explorer process with setting similar to what you describe.
Note that these new explorer processes are typically not shut down automatically if you close the opened explorer windows. So you can well be left with multiple background processes having those command lines you are describing. If you want to avoid this, un-tick the "Launch folder windows in a separate process" option.
answered Dec 21 '14 at 22:33
coderworkscoderworks
309214
On my machine I get explorer processes like what you have, if I:
- open an explorer Window, click on Tools [menu] > Folder Options, and select the option "Launch folder windows in a separate process", and after this...
- open a folder from a shortcut, or from a web browsers (e.g. Firefox or Opera) downloads dialog by selecting "Open containing folder"
In above situation, the OS creates a new explorer process with setting similar to what you describe.
Note that these new explorer processes are typically not shut down automatically if you close the opened explorer windows. So you can well be left with multiple background processes having those command lines you are describing. If you want to avoid this, un-tick the "Launch folder windows in a separate process" option.
answered Dec 21 '14 at 22:33
coderworkscoderworks
309214
answered Dec 21 '14 at 22:33
coderworkscoderworks
309214
answered Dec 21 '14 at 22:33
coderworkscoderworks
309214
answered Dec 21 '14 at 22:33
coderworkscoderworks
309214
309214
add a comment |
add a comment |
It is apparently an undocumented design decision. Prior to Win7, there was only one instance of explorer.exe, unless when you have "Launch folder windows in a separate process" enabled, or something went very wrong.
Since Win7, you may have multiple explorer.exe running even when "Launch folder windows in a separate process" is disabled. This is normal behavior that happens even on a clean installation of Windows. It can be triggered by running explorer.exe with one or more well-known command line parameters.
Example:explorer.exe C:explorer.exe /select,C:
While the change and the reasoning for the change is undocumented, it seems to be a deliberate design decision, or leftover from an ambitious design decision that was abandoned right before Win7 RTM. This premise is made based on a fact that if you find the CLSID after /factory, in Registry, you may find something interesting as below.
{ceff45ee-c862-41de-aee2-a022c81eda92} // CLSID_SeparateSingleProcessExplorerHost
When "Launch folder windows in a separate process" is enabled, it starts with command line /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding.
{75dff2b7-6936-4c06-a8bb-676a7b00b24b}` // CLSID_SeparateMultipleProcessExplorerHost
When explorer.exe is started with one or more command-line parameters (usually called by programs that implements "Open Containing Folder" by starting explorer.exe /select,<file path>), it starts with command line /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding. It deliberately starts a new instance for each invocation by specifying the SingleUse.
So, to answer your answer, to find what process spawned multiple explorer.exe of {75dff2b7-6936-4c06-a8bb-676a7b00b24b}, you need to identify which programs start explorer.exe with parameters like /select.
answered 17 hours ago
raymai97raymai97
1113
New contributor
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
It is apparently an undocumented design decision. Prior to Win7, there was only one instance of explorer.exe, unless when you have "Launch folder windows in a separate process" enabled, or something went very wrong.
Since Win7, you may have multiple explorer.exe running even when "Launch folder windows in a separate process" is disabled. This is normal behavior that happens even on a clean installation of Windows. It can be triggered by running explorer.exe with one or more well-known command line parameters.
Example:explorer.exe C:explorer.exe /select,C:
While the change and the reasoning for the change is undocumented, it seems to be a deliberate design decision, or leftover from an ambitious design decision that was abandoned right before Win7 RTM. This premise is made based on a fact that if you find the CLSID after /factory, in Registry, you may find something interesting as below.
{ceff45ee-c862-41de-aee2-a022c81eda92} // CLSID_SeparateSingleProcessExplorerHost
When "Launch folder windows in a separate process" is enabled, it starts with command line /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding.
{75dff2b7-6936-4c06-a8bb-676a7b00b24b}` // CLSID_SeparateMultipleProcessExplorerHost
When explorer.exe is started with one or more command-line parameters (usually called by programs that implements "Open Containing Folder" by starting explorer.exe /select,<file path>), it starts with command line /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding. It deliberately starts a new instance for each invocation by specifying the SingleUse.
So, to answer your answer, to find what process spawned multiple explorer.exe of {75dff2b7-6936-4c06-a8bb-676a7b00b24b}, you need to identify which programs start explorer.exe with parameters like /select.
answered 17 hours ago
raymai97raymai97
1113
New contributor
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
It is apparently an undocumented design decision. Prior to Win7, there was only one instance of explorer.exe, unless when you have "Launch folder windows in a separate process" enabled, or something went very wrong.
Since Win7, you may have multiple explorer.exe running even when "Launch folder windows in a separate process" is disabled. This is normal behavior that happens even on a clean installation of Windows. It can be triggered by running explorer.exe with one or more well-known command line parameters.
Example:explorer.exe C:explorer.exe /select,C:
While the change and the reasoning for the change is undocumented, it seems to be a deliberate design decision, or leftover from an ambitious design decision that was abandoned right before Win7 RTM. This premise is made based on a fact that if you find the CLSID after /factory, in Registry, you may find something interesting as below.
{ceff45ee-c862-41de-aee2-a022c81eda92} // CLSID_SeparateSingleProcessExplorerHost
When "Launch folder windows in a separate process" is enabled, it starts with command line /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding.
{75dff2b7-6936-4c06-a8bb-676a7b00b24b}` // CLSID_SeparateMultipleProcessExplorerHost
When explorer.exe is started with one or more command-line parameters (usually called by programs that implements "Open Containing Folder" by starting explorer.exe /select,<file path>), it starts with command line /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding. It deliberately starts a new instance for each invocation by specifying the SingleUse.
So, to answer your answer, to find what process spawned multiple explorer.exe of {75dff2b7-6936-4c06-a8bb-676a7b00b24b}, you need to identify which programs start explorer.exe with parameters like /select.
answered 17 hours ago
raymai97raymai97
1113
New contributor
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
It is apparently an undocumented design decision. Prior to Win7, there was only one instance of explorer.exe, unless when you have "Launch folder windows in a separate process" enabled, or something went very wrong.
Since Win7, you may have multiple explorer.exe running even when "Launch folder windows in a separate process" is disabled. This is normal behavior that happens even on a clean installation of Windows. It can be triggered by running explorer.exe with one or more well-known command line parameters.
Example:explorer.exe C:explorer.exe /select,C:
While the change and the reasoning for the change is undocumented, it seems to be a deliberate design decision, or leftover from an ambitious design decision that was abandoned right before Win7 RTM. This premise is made based on a fact that if you find the CLSID after /factory, in Registry, you may find something interesting as below.
{ceff45ee-c862-41de-aee2-a022c81eda92} // CLSID_SeparateSingleProcessExplorerHost
When "Launch folder windows in a separate process" is enabled, it starts with command line /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding.
{75dff2b7-6936-4c06-a8bb-676a7b00b24b}` // CLSID_SeparateMultipleProcessExplorerHost
When explorer.exe is started with one or more command-line parameters (usually called by programs that implements "Open Containing Folder" by starting explorer.exe /select,<file path>), it starts with command line /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding. It deliberately starts a new instance for each invocation by specifying the SingleUse.
So, to answer your answer, to find what process spawned multiple explorer.exe of {75dff2b7-6936-4c06-a8bb-676a7b00b24b}, you need to identify which programs start explorer.exe with parameters like /select.
answered 17 hours ago
raymai97raymai97
1113
New contributor
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 17 hours ago
raymai97raymai97
1113
New contributor
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 17 hours ago
raymai97raymai97
1113
answered 17 hours ago
raymai97raymai97
1113
1113
New contributor
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
raymai97 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f855133%2fhow-to-find-what-processes-could-spawn-multiple-explorer-exe-processes-on-a-wi%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Which services is that svchost running?
– SLaks
Dec 18 '14 at 1:26
@SLaks, the svchost.exe is running (according to Process Hacker) 3 services: DcomLaunch, PlugPlay, and Power.
– user100487
Dec 18 '14 at 1:30
Have you run malwarebytes yet?
– Tyson
Dec 21 '14 at 1:56
@Tyson, I have not run malwarebytes. I do have F-Secure Internet Security 2015 which I have run, however, and it has not found anything. I checked malwarebytes website and, looking at the description of their software, it seems to have the same features as what F-Secure advertizes. But I will check it out and let you know if it finds anything.
– user100487
Dec 21 '14 at 17:35
Only times I've run into multiple explorer.exe's it was the result of malware, after all who would kill explorer.exe and which one? While all malware scanners do most of the same things they all vary greatly due to the database behind them.
– Tyson
Dec 21 '14 at 17:51