dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1005
share rss forum feed


FoMoCo
466 C.I.D.

join:2001-01-10
Grand Rapids, MI

Normal ?

Click for full size
New to win7 and set it up to use a limited user account. Looking at the task manager while on the LU and find 2 iexplorers runing with none open. When I open 1 then I have 3 running. This is a single pc behind uverse router. Is this normal?


StuartMW
Who Is John Galt?
Premium
join:2000-08-06
Galt's Gulch
kudos:2
No iexplore.exe processes running on my Win7 x64 box.
--
Don't feed trolls--it only makes them grow!


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2
reply to FoMoCo
Maybe look at one of those 'other' processes that are running.


StuartMW
Who Is John Galt?
Premium
join:2000-08-06
Galt's Gulch
kudos:2
The Windows Sidebar (sidebar.exe) may use IE. The first thing I did on this Win7 x64 box was to disable all that junk,
--
Don't feed trolls--it only makes them grow!


Dustyn
Premium
join:2003-02-26
Ontario, CAN
kudos:11
reply to FoMoCo
Kill one process.
Does the other one remain?
If not, kill that one too.
Now launch IE and then close it.
Are there now any "iexplore.exe" processes in task manager?


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2
reply to StuartMW
I was thinking 'SnippingTool.exe', and the Flash.

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
reply to FoMoCo
Why is ActiveX version of Flash running if IE is not and you are not on a site using Flash?


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2
There must be an echo in here tonight.


StuartMW
Who Is John Galt?
Premium
join:2000-08-06
Galt's Gulch
kudos:2
reply to Mele20
Clearly IE is running. I suspect there's two sidebar gadgets connected to the internet (e.g. news headlines) and that one/both is using flash.
--
Don't feed trolls--it only makes them grow!

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
Yeah, I noticed he had Sidebar gadgets running but since I don't have Windows 7 yet, I wasn't sure that was the source of the Flash Player running but it makes sense as IE would be called for that even though IE is not running as a browser. It is very entwined with the OS.

@ Juggernaut See Profile sorry about the "echo". I just now saw your post. We must have posted at about the same time.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson


StuartMW
Who Is John Galt?
Premium
join:2000-08-06
Galt's Gulch
kudos:2
said by Mele20:

Yeah, I noticed he had Sidebar gadgets running but since I don't have Windows 7 yet...

Vista, which I believe you do have, has Sidebar gadgets too
--
Don't feed trolls--it only makes them grow!


Dustyn
Premium
join:2003-02-26
Ontario, CAN
kudos:11
Not sure if it is related to the sidebar.
However, this could be dependent on WHAT gadgets are installed and if they call reference to IE (Flash as you mentioned). I use the sidebar everyday and have "4" gadgets constantly at work in the background. The only process that is actively chewing memory then releasing a bunch of it back is "sidebar.exe". The process iexplore.exe does not come into play at any point in time with the gadgets I use. I only observe iexplore.exe during a browsing session... then it disappears.
--
Remember that cool hidden "Graffiti Wall" here on BBR? After the name change I became the "owner", so to speak as it became: Dustyn's Wall »[Serious] RIP


FoMoCo
466 C.I.D.

join:2001-01-10
Grand Rapids, MI
reply to FoMoCo
Logged on to admin account and the flash is not running nor the 2 ie's. Open / close ie on that account ( 1 gadget running - clock ) and ie closes as it should. Log back on the LU and the 2 ie's not running. Open/close ie on that account and flash as well as the 2 ie's running again. These are not showing up on the applications running tab. Also no connections open per TCPView. The flash was set to update which made no difference when I set it to not update. Maybe I should just delete and remake the LU account (?)
--


redwolfe_98
Premium
join:2001-06-11
kudos:1
Reviews:
·Time Warner Cable

1 edit
reply to FoMoCo
FoMoCo, which version of IE are you running? we could assume that you are using IE 8, but you could be running IE 9 or IE 10..

i don't use IE 8 but i have heard some people say that they had problems with IE 8's "web slices".. besides, "sidebar", IE 8's "web slices" also might have something to do with the IE processes running..

p.s. before you delete your newly created limited-user account, and starting over with a new one, i would try tweaking some settings in it..


FoMoCo
466 C.I.D.

join:2001-01-10
Grand Rapids, MI
IE9 - looking at it more the flash is staring when I open a real ie window but does not close by itself when ie closes. The 2 unknown ie's are stuburn to end process on and when I do get them to close they restart in about 30 seconds. Scanned with MSE and malwarebytes and it's showing clean. I really don't think this has anything to do wih the clock gadget as I have turned that off. I have not been keeping up on security or pc's in general so I have forgot alot of things. If there is something on this lu account any chance it will infect the admin account ? Will check back tomorrow - thanks
--


Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
reply to StuartMW
said by StuartMW:

said by Mele20:

Yeah, I noticed he had Sidebar gadgets running but since I don't have Windows 7 yet...

Vista, which I believe you do have, has Sidebar gadgets too

Wow! You have a good memory. I do have a virtual machine that I have Vista Ultimate on but I haven't used that machine in ages (I use my XP Pro virtual machine mostly). But, yes, I do recall immediately disabling all that sidebar stuff right after installing Vista. I disabled that immediately so I really wasn't sure that it, or Win 7 sidebar, uses Flash. I never gave the Vista machine a chance to try and use Flash or anything else.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson


chachazz
Premium
join:2003-12-14
kudos:9
Reviews:
·TELUS

1 edit
reply to FoMoCo
Starting with IE8, IE runs separate processes for browser and tabs.

IE with three tabs open..


Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
On my IE8 on XP Pro, IE starts up with two iexplore.exe instances in Task Manager. That is with only the home page tab in use. If I add two more tabs that does NOT add two more instances of IE. Thank goodness. I hate a browser that sandboxes each tab. That wrecks utter havoc on Task Manager for finding anything and eats RAM like it is candy....FAR FAR WORSE than Fx eating RAM.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson


FoMoCo
466 C.I.D.

join:2001-01-10
Grand Rapids, MI
reply to chachazz
When I open ie I get the additional 2 in TM but they close as they should with the 2 ghost ones still running. The fact that these 2 restart on their own after I shut them off makes me believe its some sort of nasty that shouldn't be there.


THZNDUP
Deorum Offensa Diis Curae
Premium
join:2003-09-18
Lard
kudos:2
reply to FoMoCo
The 'Flash' seen in your screenshot is the Flash Installer/Uninstaller.

If you wanted, it could be renamed to prevent it being loaded.

The file should be in C:\Windows\SysWOW64\Macromed\Flash\

Just add a letter (I use XXX) to the beginning of the name just in case I need it back.........
--
one should not increase, beyond what is necessary, the number of entities required to explain anything


FoMoCo
466 C.I.D.

join:2001-01-10
Grand Rapids, MI
Click for full size
Thanks THZNDUP - not sure why its running on LU but not admin. I am messing around with this tonight and found a link. When I end the rundll32 process then end the 2 ghost ie's they do not restart. Ending them with rundll running causes them to restart with in 30 seconds. This racore file seems to be tide to real player which I have never installed. Thoughts?


THZNDUP
Deorum Offensa Diis Curae
Premium
join:2003-09-18
Lard
kudos:2
It's kinda odd that the file isn't in it's own directory of some sort and is just dumped into the 'Roaming' root. That's pretty rude nowadays but still happens. It could also have been used by something other than RA(bloatware, free trial, etc).

You could try 'renaming' it (racore.dll) to see what breaks until a reason is figured out why it's there and running. You will have to find out where/what is calling that rundll with racore.dll being passed to it.

Notice a pattern?
--
one should not increase, beyond what is necessary, the number of entities required to explain anything

redwolfe_98
Premium
join:2001-06-11
kudos:1
Reviews:
·Time Warner Cable
reply to FoMoCo
FoMoCo, for what it is worth, i did a google-search for "racore.dll" and the only program that i saw that had a "racore.dll" file associated with it was a program called "RetroActive":

»www.acquasys.com/retroactive/Default.aspx

it is possible that you could use some of the "sysinternals" programs to see what is causing "racore.dll" to be run:

»technet.microsoft.com/en-us/sysi···bb896645

»technet.microsoft.com/en-us/sysi···bb896653


FoMoCo
466 C.I.D.

join:2001-01-10
Grand Rapids, MI
Process explorer shows it leading to WinDJViewer which I did not install. I will rename it and see what happens. If I figure it out I will follow up. Thanks all.