FoMoCo466 C.I.D. join:2001-01-10 Grand Rapids, MI |
FoMoCo
Member
2012-Sep-25 10:01 pm
Normal ?New to win7 and set it up to use a limited user account. Looking at the task manager while on the LU and find 2 iexplorers runing with none open. When I open 1 then I have 3 running. This is a single pc behind uverse router. Is this normal? |
|
|
StuartMW
Premium Member
2012-Sep-25 10:03 pm
No iexplore.exe processes running on my Win7 x64 box. |
|
JuggernautIrreverent or irrelevant? Premium Member join:2006-09-05 Kelowna, BC |
to FoMoCo
Maybe look at one of those 'other' processes that are running. |
|
|
StuartMW
Premium Member
2012-Sep-25 10:09 pm
The Windows Sidebar (sidebar.exe) may use IE. The first thing I did on this Win7 x64 box was to disable all that junk, |
|
|
Dustyn Premium Member join:2003-02-26 Ontario, CAN |
to FoMoCo
Kill one process. Does the other one remain? If not, kill that one too. Now launch IE and then close it. Are there now any "iexplore.exe" processes in task manager? |
|
JuggernautIrreverent or irrelevant? Premium Member join:2006-09-05 Kelowna, BC |
to StuartMW
I was thinking 'SnippingTool.exe', and the Flash. |
|
Mele20 Premium Member join:2001-06-05 Hilo, HI |
to FoMoCo
Why is ActiveX version of Flash running if IE is not and you are not on a site using Flash? |
|
JuggernautIrreverent or irrelevant? Premium Member join:2006-09-05 Kelowna, BC |
There must be an echo in here tonight. |
|
|
to Mele20
Clearly IE is running. I suspect there's two sidebar gadgets connected to the internet (e.g. news headlines) and that one/both is using flash. |
|
Mele20 Premium Member join:2001-06-05 Hilo, HI |
Mele20
Premium Member
2012-Sep-25 10:36 pm
Yeah, I noticed he had Sidebar gadgets running but since I don't have Windows 7 yet, I wasn't sure that was the source of the Flash Player running but it makes sense as IE would be called for that even though IE is not running as a browser. It is very entwined with the OS. @Juggernaut sorry about the "echo". I just now saw your post. We must have posted at about the same time. |
|
|
StuartMW
Premium Member
2012-Sep-25 10:39 pm
said by Mele20:Yeah, I noticed he had Sidebar gadgets running but since I don't have Windows 7 yet... Vista, which I believe you do have, has Sidebar gadgets too |
|
Dustyn Premium Member join:2003-02-26 Ontario, CAN ·Carry Telecom ·TekSavvy Cable Asus GT-AX11000 Technicolor TC4400
|
Dustyn
Premium Member
2012-Sep-25 10:48 pm
Not sure if it is related to the sidebar. However, this could be dependent on WHAT gadgets are installed and if they call reference to IE (Flash as you mentioned). I use the sidebar everyday and have "4" gadgets constantly at work in the background. The only process that is actively chewing memory then releasing a bunch of it back is "sidebar.exe". The process iexplore.exe does not come into play at any point in time with the gadgets I use. I only observe iexplore.exe during a browsing session... then it disappears. |
|
FoMoCo466 C.I.D. join:2001-01-10 Grand Rapids, MI |
FoMoCo
Member
2012-Sep-25 10:54 pm
Logged on to admin account and the flash is not running nor the 2 ie's. Open / close ie on that account ( 1 gadget running - clock ) and ie closes as it should. Log back on the LU and the 2 ie's not running. Open/close ie on that account and flash as well as the 2 ie's running again. These are not showing up on the applications running tab. Also no connections open per TCPView. The flash was set to update which made no difference when I set it to not update. Maybe I should just delete and remake the LU account (?) |
|
1 edit |
to FoMoCo
FoMoCo, which version of IE are you running? we could assume that you are using IE 8, but you could be running IE 9 or IE 10..
i don't use IE 8 but i have heard some people say that they had problems with IE 8's "web slices".. besides, "sidebar", IE 8's "web slices" also might have something to do with the IE processes running..
p.s. before you delete your newly created limited-user account, and starting over with a new one, i would try tweaking some settings in it.. |
|
FoMoCo466 C.I.D. join:2001-01-10 Grand Rapids, MI |
FoMoCo
Member
2012-Sep-25 11:12 pm
IE9 - looking at it more the flash is staring when I open a real ie window but does not close by itself when ie closes. The 2 unknown ie's are stuburn to end process on and when I do get them to close they restart in about 30 seconds. Scanned with MSE and malwarebytes and it's showing clean. I really don't think this has anything to do wih the clock gadget as I have turned that off. I have not been keeping up on security or pc's in general so I have forgot alot of things. If there is something on this lu account any chance it will infect the admin account ? Will check back tomorrow - thanks |
|
Mele20 Premium Member join:2001-06-05 Hilo, HI |
to StuartMW
said by StuartMW:said by Mele20:Yeah, I noticed he had Sidebar gadgets running but since I don't have Windows 7 yet... Vista, which I believe you do have, has Sidebar gadgets too Wow! You have a good memory. I do have a virtual machine that I have Vista Ultimate on but I haven't used that machine in ages (I use my XP Pro virtual machine mostly). But, yes, I do recall immediately disabling all that sidebar stuff right after installing Vista. I disabled that immediately so I really wasn't sure that it, or Win 7 sidebar, uses Flash. I never gave the Vista machine a chance to try and use Flash or anything else. |
|
1 edit |
to FoMoCo
Starting with IE8, IE runs separate processes for browser and tabs. IE with three tabs open.. |
|
Mele20 Premium Member join:2001-06-05 Hilo, HI |
Mele20
Premium Member
2012-Sep-26 4:17 am
On my IE8 on XP Pro, IE starts up with two iexplore.exe instances in Task Manager. That is with only the home page tab in use. If I add two more tabs that does NOT add two more instances of IE. Thank goodness. I hate a browser that sandboxes each tab. That wrecks utter havoc on Task Manager for finding anything and eats RAM like it is candy....FAR FAR WORSE than Fx eating RAM. |
|
FoMoCo466 C.I.D. join:2001-01-10 Grand Rapids, MI |
to chachazz
When I open ie I get the additional 2 in TM but they close as they should with the 2 ghost ones still running. The fact that these 2 restart on their own after I shut them off makes me believe its some sort of nasty that shouldn't be there. |
|
THZNDUPDeorum Offensa Diis Curae Premium Member join:2003-09-18 Lard |
to FoMoCo
The 'Flash' seen in your screenshot is the Flash Installer/Uninstaller. If you wanted, it could be renamed to prevent it being loaded. The file should be in C:\Windows\SysWOW64\Macromed\Flash\ Just add a letter (I use XXX) to the beginning of the name just in case I need it back......... |
|
FoMoCo466 C.I.D. join:2001-01-10 Grand Rapids, MI |
FoMoCo
Member
2012-Sep-26 8:09 pm
Thanks THZNDUP - not sure why its running on LU but not admin. I am messing around with this tonight and found a link. When I end the rundll32 process then end the 2 ghost ie's they do not restart. Ending them with rundll running causes them to restart with in 30 seconds. This racore file seems to be tide to real player which I have never installed. Thoughts? |
|
THZNDUPDeorum Offensa Diis Curae Premium Member join:2003-09-18 Lard |
THZNDUP
Premium Member
2012-Sep-27 12:58 am
It's kinda odd that the file isn't in it's own directory of some sort and is just dumped into the 'Roaming' root. That's pretty rude nowadays but still happens. It could also have been used by something other than RA(bloatware, free trial, etc). You could try 'renaming' it (racore.dll) to see what breaks until a reason is figured out why it's there and running. You will have to find out where/what is calling that rundll with racore.dll being passed to it. Notice a pattern? |
|
|
to FoMoCo
FoMoCo, for what it is worth, i did a google-search for "racore.dll" and the only program that i saw that had a "racore.dll" file associated with it was a program called "RetroActive": » www.acquasys.com/retroac ··· ult.aspxit is possible that you could use some of the "sysinternals" programs to see what is causing "racore.dll" to be run: » technet.microsoft.com/en ··· bb896645» technet.microsoft.com/en ··· bb896653 |
|
FoMoCo466 C.I.D. join:2001-01-10 Grand Rapids, MI |
FoMoCo
Member
2012-Sep-27 9:58 am
Process explorer shows it leading to WinDJViewer which I did not install. I will rename it and see what happens. If I figure it out I will follow up. Thanks all. |
|