Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My system ( Dell Inspiron 1520, Core 2 Duo T5250 @ 1.5GHz, 2 GB RAM, 160GB HDD, 8600m GT) was acting a bit sluggish, so I launched Process Explorer, and when I saw the process tree I was astounded:

alt text

Why are so many processes running ? I don't use Internet Explorer. I use Steam so I suppose that's 1 app which uses the IE rendering engine. This is not the first time that its happened, I had to get a screenshot this time. I've run HijackThis, and had the logs scanned, but it doesn't show any malicious processes running.

share|improve this question
Theoretically, each IE tab could be using its own process. Maybe there's a bug in the Steam client. – alex Jan 7 '10 at 9:32
up vote 5 down vote accepted

I've seen this behavior on others machines before. I know you've run HijackThis already, but give MBAM (Malwarebytes' Anti-Malware) a try, it may have missed something. A lot of malware will try and "phone home" to give the coder information as to what the software is doing, or just as a notification that it's up and running on a remote machine. They may also be using your machine to visit other sites for various reasons (gaining ad revenue, DoS, etc). A lot of coders don't properly terminate these forked processes and this is what you get as a result.

I'd also download Sysinternals TCPView and see what these IE processes are connecting to.

share|improve this answer
TCPView shows that they're connected to my system, on random ports ( 61xxx series), but no remote connections. Will try MBAM. The connections make me fear if my system has been converted into an on-demand DDoS provider :-s – Sathya Jan 7 '10 at 10:01
Yep, you could indeed be a member of a botnet ( ) – John T Jan 7 '10 at 10:17
MBAM found Trojan.Vundo & Trojan.BHO, and few malicious registry keys deep in HKR\CLSID and HKR\Typelib hives. Thanks! – Sathya Jan 7 '10 at 10:37
You're most welcome :) – John T Jan 7 '10 at 10:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.