none
Multiple instances of explorer.exe running in task manager

    Question

  • I'm running Windows 7 Ultimate 64-bit and have noticed several times that multiple instances of explorer.exe are running. Today, to my amazement, there were 49 instances running. I'm sure this has accumilated over time because I have not rebooted this machine for several weeks.

    Why would I have so many instances running when I don't have any explorer windows open?

    Shouldn't the OS close an instance when it is no longer needed?

    I checked and verified that HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced>SeparateProcess is set to 0.

    Any other suggestions?

     

    Thursday, March 25, 2010 5:05 PM

Answers

All replies

  • Use Process Explorer to check the start time of each ins tance, as well as the parent process.  Does that give any clue as to what is going on?

    Consider using Process Monitor to check the creating process - configure symbols in Process Monitor, and see if you are able to gather any information from the stack of the Process Create event.

    Scan for malware, as well.

    Do you have multiple users logging into the system?

    Friday, March 26, 2010 11:34 PM
  • Hi,

     

    Sometimes, explorer.exe will be crashed or created by third party software conflicts.

     

    Based on the current situation, you may also test the issue in Clean Boot.

     

    Regards,


    Arthur Li - MSFT
    Monday, March 29, 2010 2:29 AM
  • I'm not familiar with Process Monitor. Searched my Win7 system, tried Help, but couldn't find anything. Could you please elaborate?

    I've scanned for malware, and have AVG Anti-Virus running at all times and haven't run into anything peculiar. A few days ago AVG did report a trojan horse (avg.exe was found in my 'C:\Program Files (x86)\Common Files' folder). This came in long after noticing this problem with multimple explorer.exe.

    Multiple users are not logged into the system. I am the only person that has a login to this system.

     

    BTW, after searching the internet for "multiple instances of explorer.exe" it seems this is not an unusual problem. Many people are reporting this. Is this the first time anyone has mentioned this on Technet forums?

     

    If I end each 'explorer.exe' process with task manager, then I simply can run 'explorer.exe' to get it back to a single instance. However, over time, multiple instances will appear. I usually keep my computer running without re-booting for several weeks at a time. It will go into sleep mode sometimes and restoring/recovering from this is not always what I expect.

    Monday, April 05, 2010 9:33 PM
  • Try Process Explorer before getting into Process Monitor.  What's the parent of the Explorer.exe processes?  What about the command-line of the instances - any clue there?  Compare start times to coordinate them with what you were doing on the system at that time.
    Monday, April 05, 2010 10:00 PM
  • All except one instance of explorer.exe was nested under an instance of svchost.exe. Their siblings were WUDFHost.exe and dwm.exe.

     

    I deleted these instances and they haven't returned in the last 21 hours.

     

    Next time, how do you see what the start times are? I don't see anyway to do this with Process Explorer.

     

    Thanks for your help,

    Gregg

    Tuesday, April 06, 2010 8:18 PM
  • The process start time is listed in the "Started" section of the properties of the process, on the Image tab.  You can also add the "Start Time" column - View->Select Columns, Process Performance tab, "Start Time".

    What were the services running in the svchost.exe instance that was the parent of the explorer.exe instances?  (You can use Process Explorer to tell this, too, but selecting the svchost.exe of interest, and looking at its Properties, on the Services tab.)

    Tuesday, April 06, 2010 8:33 PM
  • The process start time is listed in the "Started" section of the properties of the process, on the Image tab.  You can also add the "Start Time" column - View->Select Columns, Process Performance tab, "Start Time".

    What were the services running in the svchost.exe instance that was the parent of the explorer.exe instances?  (You can use Process Explorer to tell this, too, but selecting the svchost.exe of interest, and looking at its Properties, on the Services tab.)

    AudioEndpointBuilder
    CscService
    hidserv
    IPBusEnum
    Netman
    PCASVC
    SysMain
    TrkWks
    UxSms
    WPDBusEnum
    wudfsvc

    Thanks again for you help.

    Wednesday, April 07, 2010 8:17 PM
  • Interesting...

    Any additional insights into the exploration with Process Explorer?

    Thursday, April 08, 2010 1:21 AM
  • Hi there, Do you happen to use Utorrent?

     

    If so, it's a bug when you run Utorrent & use the option to  "open containing folder" of a torrent file..

    • Proposed as answer by Adnan_EliXR Monday, May 03, 2010 4:45 AM
    Friday, April 09, 2010 11:14 AM
  • I agree with floyd11, Bittorent shows the same bug. If you chose "open containing folder" it will open an windows explorer (explorer.exe), with 6,460 Kb  memory process (aprox. it varies a bit depending of window content) while the windows explorer is open. Once closed the "explorer.exe" process wont close, but it will change memory consumption down aprox. 1 mb.

    Also I suspected it to be a virus or malware, but computer has been scanned using Microsoft Security Essentials and it showed perfectly clean.

    Running Windows 7 Ultimate x32.

    The same behavior is not seen when windows explorer is opened manually. No aditional explorer.exe processer are shown in taskmanager.

    Seems its a bug with certain softwares and the way they interact with WPF, or something.

    Let me know what can I do to help debug the problem, I have moderate tech skills.

    Saturday, April 24, 2010 6:54 AM
  • Are you able to attach a debugger to one of these "extra" explorer.exe processes to see what it is doing?  Or use Process Explorer to check the stacks of its threads to see what they may be doing? Or, use Resource Monitor's "Analyze Wait Chain" feature to see if any details turn up.
    Saturday, April 24, 2010 1:54 PM
  • I checked and verified that HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced>SeparateProcess is set to 0.

    This registry key should map to the "Launch folder windows in a separate process" setting, what that does is create a explorer.exe process to segregate shell elements (taskbar, desktop) from folder windows. This should result in no more than two explorer.exe processes.

    Some people change Windows Explorer's default folder by appending a folder path to a taskbar button's "Target" property. While this does exactly what it's supposed to do it creates this new windows in their own process. I'm not entirely convinced this is your problem because these processes tend to close shortly after the window is but if that's something you've done it could be contributing.

    Sunday, April 25, 2010 2:35 PM
  • THank you @ floyd11

     

    I too have many explorer exes, after reading your question, I went to utorrent 1.8.5 and used that option " Open Containing Folder" while my taskmanager was ON, on the top of all. And the more I open different files from that option, the more I saw explorer exes, and when I closed them all they were all gone in maybe 10+ seconds.

     

    While at this time, i have 3 explorer exes, which I don't know from where they are coming, 

    And process explorer shows, two are the sub categories of winnt.exe --> services.exe---> svchost.exe----> 2 explorer.exes there!

     

    While other explorer.exe is ( as I know the original one) it self a main category... and in it are utorrent and other programs are running....!

     

     

    Well, at least I am OK with multiple exes because I know I don't have any malware or virus lurking around or hidden in my computer...!

     

    THank you FLOYD11,

    AND thank you all who tried to help others, and thanks GREG for bringing this question up!

     

    Monday, May 03, 2010 4:52 AM
  • Hi

    I posted a query about this several months ago: http://social.answers.microsoft.com/Forums/en/w7performance/thread/d4f28787-6208-4756-aa9d-96f7a6d34b7e - I did not receive any useful information. I have two machines, one of which has uTorrent. Both are Home Premium 64-bit.  After running either machine for more than a day, there are always at least three or four explorer processes running, and if I forgot to check for a few days there can be up to 16 or so.

    By taking some small action in the actual shell I can identify the shell copy of Explorer.exe, and can end all the other processes with no apparent consequences.  I have of course checked the registry key mentioned above and it is set to 0.

    Surely M$ are investigating this bug by now.  It is not related to uTorrent, as it is happening on the machine without uT installled.  The only other background processes are NIS 2010, Diskeeper 2010 and Acronis True Image Home 2010.  I use Firefox 3.6.3 at the moment, but had this problem with previous releases.  The only other processes that are constantly running are Alps Pointing Device and ATI Catalyst Control Centre, neither of which seems a likely culprit.

    I have looked in process explorer and can't find any relationship between my actions on the machine and these instances of explorer. Can anyone offer some more concrete information or troubleshooting?  ... Unlike Adnan_EliXR I'm not content to have to go killing off half a dozen processes every day or two. Each process is typically using 20-30MB of memory.

    I don't see any point in setting my machine to a clean boot - I'm not wiping out months of software and config just to save M$ the bother of tracking down this bug.  I can't see any point in trying Safe Mode because half the programs won't run.

    TIA for any information or suggestions on where to go from here.

    Wednesday, May 19, 2010 2:31 AM
  • I am having the same problems. It doesn't happened on utorrent, flashget and FDM also have the same problems if I use the open containing file directory features. Is this the software bugs(flashget, FDM) need to fix or Windows problems?
    Monday, September 20, 2010 5:49 AM
  • Some people change Windows Explorer's default folder by appending a folder path to a taskbar button's "Target" property. While this does exactly what it's supposed to do it creates this new windows in their own process. I'm not entirely convinced this is your problem because these processes tend to close shortly after the window is but if that's something you've done it could be contributing.
    I know this is an old thread, but I stumbled across it while searching because I had the same issue.  I have uTorrent installed, and I also changed the default folder Windows Explorer opens into.  uTorrent was creating separate explorer.exe processes, but they were closing down properly.  Turns out, it was because I changed the default folder Windows Explorer opened into; every time I clicked my Windows Explorer shortcut, a new explorer.exe process was created.  I removed the default path and all is well!
    Wednesday, March 30, 2011 3:00 AM
  • I know I'm a few years late on this reply, but the issue you described can be caused by Mozilla Firefox when using the "Open Containing Folder" selection in the context menu of the Download Bar, or any other application that launches an explorer window. Depends on the method they are using to spawn that window. It appears that the method Mozilla is using worked fine in XP, but does not work for Windows 7. I noticed a post about UTorrent as well. This application also has a menu option to Open a Containing Folder. which also worked fine on XP. This leads me to believe, that something has changed in the way Windows spawns an explorer window, and that the methods the 3rd party apps use, while they may work on XP, do not work in Win7...Good point about the changing of the default folders. Still means the method the 3rd party app uses is not the same one MS uses in Win7, which makes 3rd party developers have to do some logic for determining which OS version is running and handle each differently, which sucks!!!


    In any case, after I pinned it down to Firefox as being the culprit in MY case, I reported the bug. The link is posted below. The guys are working hard on it over there.

    https://bugzilla.mozilla.org/show_bug.cgi?id=670068
    Tuesday, August 02, 2011 7:58 PM
  • I've been having the same problem. In my case, I get an extra instance of explorer that prevents my flash drive from being "safely removed". Based on the hints in this thread, I tried starting explorer from the command line. The command "start explorer /e,c:\" results in an extra explorer instance while "start c:\" does not!

    In my experiment, the extra instance quit when the explorer window was closed. I run scripts that open explorer using the first command. I suspect that sometimes the extra instance does not shut down when the window is closed.

    Thanks for the hints, now I just have to change my scripts.

    • Proposed as answer by Steve_Cdj Wednesday, November 09, 2011 5:57 AM
    • Unproposed as answer by Steve_Cdj Wednesday, November 09, 2011 5:57 AM
    Wednesday, August 17, 2011 7:41 PM
  • Dunno if this helps anyone...a few days ago i had a similar problem whereby 4 to 6 instances of explorer.exe would load every boot. I noticed HKCU and HKLM entries in startup from msconfig which i know is not right so i did some sleuthing. Ended up finding a directory "c:\windows\explorer" which contained 1 file "svchost.exe". Zone Alarm recognized it as virus but wouldnt remove it. Just kept respawning instantly. Had to boot into safe mode, remove entries from registry, then delete said folder. Entries found in "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" and also HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run". Also removed all prefetch entries.

    Hope this might help someone :)

    Wednesday, November 09, 2011 6:09 AM
  • Open file location, in any non explorer.exe software causes this glitch each time!!! (I am aware of the other problem with this regarding the taskbar buttons and what not but i believe the solution would be basicly the same and im not elaborating on that problem because I dont know much about that one as its not the problem that affected me) So I google search, i came across the first few results, mostly forum and it was this page that mentioned the using utorrent and "open file location" command as each time it is an additional explorer.exe in the task manager suddenly using about 10,000kb of memory in each of the additionals as a result. I put 2 and 2 together realizing just a few minutes previously upon downloading a file in firefox browser i used the "open file location" option that is so popular of a command nowadays. why i had in fact done it twice and with 3 explorer.exe running in my windows 7 I killed the processes of low memory which would obviously merit low importance in comparison to the main 26,000kb process. I had a hunch. the largest would be the main so dont kill that one. it is quite simple I tested my theory that using the command opens an additional explorer.exe and this holds true in windows 7 each time you do it when you use the "open file location" command in any 3rd party software such as utorrent or firefox.exe, atleast as i have tested this in task manager itself using the "open file location" command and it appears windows recognizes itself and prevents the extrenuous process from running at all. Basicly if you use the command "open file location" with any 3rd party program or perhaps even any program other than explorer.exe itself it will cause the additional processes to appear and even "hang" around in the background so to speak after closing the explorer window in question. With 5 minutes of research and 30 seconds of thinking from a somewhat computer literate average individual like myself I have found the solution and the most likely cause of the problem that everyone is missing, I have one upped the tech support engineers all of them that Ive ever seen online or met. none had an explanation, yet the answer being quite simple indeed.I hope this helps everyone across all forums those I have seen. (Dont worry if you kill the main explorer.exe that runs normally windows automatically reboots the main explorer.exe process upon termination. you will barely notice it actually.)
    Thursday, November 10, 2011 6:12 AM
  • Open file location, in any non explorer.exe software causes this glitch each time!!!

     (I am aware of the other problem with this regarding the taskbar buttons and what not but i believe the solution would be basicly the same and im not elaborating on that problem because I dont know much about that one as its not the problem that affected me)

    So I google search, i came across the first few results, mostly forum and it was this page that mentioned the using utorrent and "open file location" command as each time it is an additional explorer.exe in the task manager suddenly using about 10,000kb of memory in each of the additionals as a result. I put 2 and 2 together realizing just a few minutes previously upon downloading a file in firefox browser i used the "open file location" option that is so popular of a command nowadays. why i had in fact done it twice and with 3 explorer.exe running in my windows 7 I killed the processes of low memory which would obviously merit low importance in comparison to the main 26,000kb process. I had a hunch. the largest would be the main so dont kill that one. it is quite simple I tested my theory that using the command opens an additional explorer.exe and this holds true in windows 7 each time you do it when you use the "open file location" command in any 3rd party software such as utorrent or firefox.exe, atleast as i have tested this in task manager itself using the "open file location" command and it appears windows recognizes itself and prevents the extrenuous process from running at all. Basicly if you use the command "open file location" with any 3rd party program or perhaps even any program other than explorer.exe itself it will cause the additional processes to appear and even "hang" around in the background so to speak after closing the explorer window in question. 

    With 5 minutes of research and 30 seconds of thinking from a somewhat computer literate average individual like myself I have found the solution and the most likely cause of the problem that everyone is missing, I have one upped the tech support engineers all of them that Ive ever seen online or met. none had an explanation, yet the answer being quite simple indeed.I hope this helps everyone across all forums those I have seen.  (Dont worry if you kill the main explorer.exe that runs normally windows automatically  reboots the main explorer.exe process upon termination. you will barely notice it actually.)
    Thursday, November 10, 2011 6:13 AM
  • Open file location, in any non explorer.exe software causes this glitch each time!!!

     (I am aware of the other problem with this regarding the taskbar buttons and what not but i believe the solution would be basicly the same and im not elaborating on that problem because I dont know much about that one as its not the problem that affected me)

    So I google search, i came across the first few results, mostly forum and it was this page that mentioned the using utorrent and "open file location" command as each time it is an additional explorer.exe in the task manager suddenly using about 10,000kb of memory in each of the additionals as a result. I put 2 and 2 together realizing just a few minutes previously upon downloading a file in firefox browser i used the "open file location" option that is so popular of a command nowadays. why i had in fact done it twice and with 3 explorer.exe running in my windows 7 I killed the processes of low memory which would obviously merit low importance in comparison to the main 26,000kb process. I had a hunch. the largest would be the main so dont kill that one. it is quite simple I tested my theory that using the command opens an additional explorer.exe and this holds true in windows 7 each time you do it when you use the "open file location" command in any 3rd party software such as utorrent or firefox.exe, atleast as i have tested this in task manager itself using the "open file location" command and it appears windows recognizes itself and prevents the extrenuous process from running at all. Basicly if you use the command "open file location" with any 3rd party program or perhaps even any program other than explorer.exe itself it will cause the additional processes to appear and even "hang" around in the background so to speak after closing the explorer window in question. 

    With 5 minutes of research and 30 seconds of thinking from a somewhat computer literate average individual like myself I have found the solution and the most likely cause of the problem that everyone is missing, I have one upped the tech support engineers all of them that Ive ever seen online or met. none had an explanation, yet the answer being quite simple indeed.I hope this helps everyone across all forums those I have seen.  (Dont worry if you kill the main explorer.exe that runs normally windows automatically  reboots the main explorer.exe process upon termination. you will barely notice it actually.)
    • Proposed as answer by Lilamezz Wednesday, November 16, 2011 5:08 PM
    • Unproposed as answer by Lilamezz Wednesday, November 16, 2011 5:08 PM
    Thursday, November 10, 2011 6:18 AM
  • A simple solution to the multi instance of explorer.exe. The cause is really when you open Windows Explorer with an option (ex "%windir%\explorer.exe D:\" to open automatically Explorer showing disk D:).

    If you open without any kind of option ("%windir%\explorer.exe"), this problem doesn't appear, but you do not solve the problem, because you WANT to open Explorer on a specific directory (or disk).

    I found the solution on another forum : in this case, simply put the aim (disk or directory) in the shortcut. For example, instead of "%windir%\explorer.exe D:\tmp", only put "D:\tmp". It works very well and doesn't leave any Explorer process pending in memory.

    Tested on Windows 7 32 and 64 bits, works like a charm.

    Alain
    • Proposed as answer by trumpy81 Tuesday, January 31, 2012 9:25 PM
    Wednesday, November 16, 2011 5:08 PM
  • I'm not sure if it's related or not I couldn't find out, but I have also used utorrent before.  Tried the above fix and no improvement

    When ever I load a MP3 from from Windows Explorer when I look in Task Manager I will get many explore.exe's launching, dozens of them, all mostly under 10 megs.

    Mbam/Kaspersky won't detect anything but explorer's keep opening usually until the system is completely bogged down.

    Only thing I can do is reboot and not launch mp3 files from Explorer, which sux becuase it's too easy to forget that common task...

    any clues???


    • Edited by mike_01 Thursday, April 05, 2012 5:37 AM
    Thursday, April 05, 2012 5:35 AM
  • Any "trick" that adds an argument to an explorer.exe shortcut causes a new instance of explorer.exe to hang around indefinitely. All of these solutions result in an extra instance of the explorer.exe process each time the modified shortcut is used, and they accumulate until you logoff.

    A simpler and better solution is simply to replace all of the "Windows Explorer.lnk" shortcuts throughout the system with an ordinary folder shortcut named "Windows Explorer.lnk" that points to whatever folder you've chosen.

    Here's a little procedure that does this for Windows 7 and 8, where the replacement shortcut points to the %USERPROFILE% folder. The standard admonition should you try this is to first make a restore point as a precaution.

    http://reliancepc.com/menu/tips/Downloads/ReplaceDefaultExplorerShortcuts.zip

    Once unzipped, you can use 7zip to look inside the resulting ReplaceDefaultExplorerShortcuts.exe (which is a 7z SFX) and see what it does and that nothing nefarious is inside. BTW, you'll have to run ReplaceDefaultExplorerShortcuts.exe from an Administrative account, and it will ask for elevated privilege.
    Thursday, December 27, 2012 6:39 PM
  • You might think the Parent Explorer Process would use the most memory, but that's not always the case. You can't just blindly kill all of the explorer tasks from the manager and hope you hit the right one. That's a good way to let adware/malware/viruses take control and hitch a ride, and stuff like AVG-virus certainly is not going to help you much either in that case.  You might as well reboot and do it safely the first time.

    However, through experimentation I've found a safe way to do it without rebooting...

    In Windows 7 if you try to kill the Parent Explorer Process from an administrative command-line using...

     "TaskKill /IM explorer.exe"

    then you will get a "Shut Down Windows" prompt for the Parent Process and all other instances will be soft-killed. Just click "cancel" to keep the Parent. Then go back to the Task Manager and note the PID number of the single instance of explorer.exe. As long as you DON"T reboot, the PID will always remain the same. It changes if you have to reboot.

    Here's the basic criteria you must consider...

    • From boot to boot the PID changes. It's also dependent on how quick explorer.exe loads during a boot. It would be nice to see the PID being the least amount, but that's not always the case, although it is most of the time.
    • Memory usage is dependent of the active task running in the process. If a scan is running under a different process, then it's memory usage can be higher than the Parent process.
    • The USER name the process is running under is dependent of how many users are signed into windows. However, the active Parent you want to keep will be using the account you have signed into, obviously. Killing the others is the equivalent to booting them out!
    • Just like memory usage, the operating/running time is dependent of the active task running in the process. The Parent process can sit idle for days and only show a few minutes of activity, but a long search in a separate instance can show hours of activity.
    • An option not available in the Task Manager that really NEEDS to be there is the Window Title. However, you can still extract this information using the TaskList Verbose switch from an administrative command-line. Syntax is - TaskList /V /FI "IMAGENAME eq explorer.exe" - I would recommend redirecting the output to a report.txt file so you can read it easily. The Parent Explorer Process will ALWAYS show a Title of "N/A". If you ever discover you have more than one process with a Not Applicable Title, then it could mean you're running shoddy software that fails to Title the window, or another hidden process is masking itself deliberately so you can't see it (like a remote hacker does), or a legitimate installation is running an update and needed to query your system briefly (which is why I HATE 3rd party apps with live auto-update features, I turn those suckers OFF, I'll do it MYSELF).

    Now you should see how tricky it is to determine the Parent Explorer process. The ONLY ways to be sure you find the correct one is to either use the TaskKill trick and hit cancel on the prompt - OR - use Process Explorer and find the Unexpanded System Explorer process, Window Title may report as "program manager". Native tools only show the Title as "N/A" (batch script note: there are 69 spaces following the title, 72 characters total).

    Thursday, September 19, 2013 5:10 PM
  • I have a machine running Win7 Ultimate x64 with the same problem.

    After a lot of playing around I found a solution.  The virus appears to be related to the MBR or the boot sector

    Boot from the Windows 7 installation CD and enter the repair menu.  Select command prompt there.

    At the command prompt run BootRec.exe twice:

      BootRec /FixMbr

      BootRec /FixBoot

    This will reinitialize the MBR and the boot sector.  At the same time, it dumps the virus.

    I still don't know what the virus is but who cares?  It's gone.

    Friday, April 18, 2014 5:58 PM