1

Is it normal to have multiple explorer.exe processes running on a Windows 7 Pro (64-bit)?

(So just to clarify, this is not about the iexplore.exe which is the Windows Internet Explorer browser.)

I have currently 5 explorer.exe processes running on this machine according to Windows Task Manager. I do not have any Explorer (meaning: Windows file explorer) windows open, and I am the only user on this machine at the moment. In any case these multiple explorer processes show in Task Manager when I have not clicked on the "Show processes from all users" button.

I had configured Task Manager to display the "Command Line" column under the Processes tab, and based on that these started by following command lines:

  • 1 (this is probably the "original") started with command line:

"C:\Windows\Explorer.exe"

  • 3 started with command line:

"C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding"

  • 1 started with command line:

"C:\Windows\explorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding"

According to Process Hacker these have all been started by winit.exe > services.exe > svchost.exe which looks normal.

The svchost.exe is running (according to Process Hacker) these services: DcomLaunch, PlugPlay, and Power.

Could it be that the two bottom "explorer.exe" processes in above list (where the command line ends with "embedding") may have been started by some other process? If so, how could I find what process(es) might be spawning these?

Improve this question
5
  • Which services is that svchost running?
    – SLaks
    Dec 18, 2014 at 1:26
  • @SLaks, the svchost.exe is running (according to Process Hacker) 3 services: DcomLaunch, PlugPlay, and Power.
    – user100487
    Dec 18, 2014 at 1:30
  • Have you run malwarebytes yet?
    – Tyson
    Dec 21, 2014 at 1:56
  • @Tyson, I have not run malwarebytes. I do have F-Secure Internet Security 2015 which I have run, however, and it has not found anything. I checked malwarebytes website and, looking at the description of their software, it seems to have the same features as what F-Secure advertizes. But I will check it out and let you know if it finds anything.
    – user100487
    Dec 21, 2014 at 17:35
  • Only times I've run into multiple explorer.exe's it was the result of malware, after all who would kill explorer.exe and which one? While all malware scanners do most of the same things they all vary greatly due to the database behind them.
    – Tyson
    Dec 21, 2014 at 17:51

2 Answers 2

Reset to default
2

It is apparently an undocumented design decision. Prior to Win7, there was only one instance of explorer.exe, unless when you have "Launch folder windows in a separate process" enabled, or something went very wrong.

Since Win7, you may have multiple explorer.exe running even when "Launch folder windows in a separate process" is disabled. This is normal behavior that happens even on a clean installation of Windows. It can be triggered by running explorer.exe with one or more well-known command line parameters.

Example:
explorer.exe C:\
explorer.exe /select,C:

While the change and the reasoning for the change is undocumented, it seems to be a deliberate design decision, or leftover from an ambitious design decision that was abandoned right before Win7 RTM. This premise is made based on a fact that if you find the CLSID after /factory, in Registry, you may find something interesting as below.

{ceff45ee-c862-41de-aee2-a022c81eda92} // CLSID_SeparateSingleProcessExplorerHost

When "Launch folder windows in a separate process" is enabled, it starts with command line /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding.

CLSID_SeparateSingleProcessExplorerHost

{75dff2b7-6936-4c06-a8bb-676a7b00b24b}` // CLSID_SeparateMultipleProcessExplorerHost

When explorer.exe is started with one or more command-line parameters (usually called by programs that implements "Open Containing Folder" by starting explorer.exe /select,<file path>), it starts with command line /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding. It deliberately starts a new instance for each invocation by specifying the SingleUse.

enter image description here

So, to answer your answer, to find what process spawned multiple explorer.exe of {75dff2b7-6936-4c06-a8bb-676a7b00b24b}, you need to identify which programs start explorer.exe with parameters like /select.

Improve this answer
3

On my machine I get explorer processes like what you have, if I:

  1. open an explorer Window, click on Tools [menu] > Folder Options, and select the option "Launch folder windows in a separate process", and after this...
  2. open a folder from a shortcut, or from a web browsers (e.g. Firefox or Opera) downloads dialog by selecting "Open containing folder"

In above situation, the OS creates a new explorer process with setting similar to what you describe.

Note that these new explorer processes are typically not shut down automatically if you close the opened explorer windows. So you can well be left with multiple background processes having those command lines you are describing. If you want to avoid this, un-tick the "Launch folder windows in a separate process" option.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .