Helping people with computers... one answer at a time.

With the release of IE8 many people are noticing that there is more than one iexplore.exe process when they run IE. I'll look at why.

When I open up Internet Explorer, just one instance, I get two of them in my process list. No extra tabs or windows open, just the one iexplore. When I close that iexplore, they both go away in the process list. When I open it up again, poof two in processes. One usually runs parallel to whatever website I am on, ie higher memory usage for bigger sites, and the other runs about 16M all the time. I run Spy-bot and Ad Aware regularly. Don't know what is causing this, wasn't there before.

This has actually spooked a few people since IE8 came out.

I can't tell you why it's done, because quite honestly I don't know.

But I can tell you this: it's not a problem, and not a sign of anything like malware.

Let's look at what people are seeing.

If you fire up a single instance of Internet Explorer version 8, and then open up the task manager, you may see something like this in the process tab:

IE8 showing up twice in the process list

If, instead, we look at the process list using Process Explorer we'll see something like this:

IE8 Twice in Process Explorer

What I immediately notice is that one instance is indented underneath the other. That means that the top one explicitly started the one underneath it - it's that process's "parent".

If I start another instance of IE (via the quick launch bar):

IE8's second instance

You'll see that the instance of IE8 that I started is not a new top-level process, but was rather added as a child of that same parent IE8 process. (Creating tabs will also create more processes, though not necessarily one-for-one.)

My theory is simply this: with the release of IE8, Microsoft added features to make IE more resilient to crashes. One instance of IE crashing will not affect another, for example. Moreover, if one of those child processes crashes, then I believe it's that parent process's job to recover from the crash. It probably notices and automatically restarts a new child process so that you can continue browsing.

I could be wrong about the specifics, but I'm fairly certain that this "extra" IE8 instance is all about making your browser experience more robust and stable. (Much of this is confirmed by the IE8 team blog.)

More importantly, whatever the reasons, it's nothing to be concerned about. It's not a sign of malware or something bad happening behind the scenes.

Article C4312 - May 12, 2010 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

5 Comments
Gabe
May 18, 2010 9:04 AM

...and THIS is why I continue to stay on your email list, Leo. I've seen those double entries and I've just not investigated them as I've just assumed that IE8 was the reason. Now I know and the answer came to me rather than me hunting it down. I guess I owe you another beer soon.

TheManRetired
May 18, 2010 9:33 AM

You will see two or more open as like you stated the first one is the parent and responsable for everything, the others are for tabs to different sites if you have more than one tab open, if not the one tab is the child of the parent and has the site open. The more tabs the more child process' and that is suppose to be so that you don't lose all iexplorer if one site stops and locks up you do not loose everything that was open and have to go back and redo everything. I have seen it help like it is suppose to but then sometimes I have seen it lock everything so it is like anything else on the computer tempermental.

Richard Blake
May 18, 2010 10:32 AM

After opening several tabs or starting separate IE windows, close a few. I found that the extra processes do not go away. Defect? Perhaps. I'll take care to quit and restart IE occasionally to relieve memory/cpu bloat and the potential for a lockup.

Richard
May 19, 2010 3:23 PM

when the process is running inside of itself like that,
it could be a side effect of the newer IE internal sand-boxing methods

I haven't played with or used it
because if I install anything higher than IE6 on my systems it breaks a lot of my production software

Marty Stewart
May 29, 2010 10:33 PM

My second iexplore.exe is generated by the google toolbar. I have tried uninstalling and removing it using hijack this and it keep coming back. It does seem to randomly open up other websites especially when I am looking for something on a google search. Maybe randomly is the wrong word, it might be very selective. While it doesn't suck up a ton of resources I still consider this type of item Malware as it is directing my internet path. Two other web pages opened while I was typing this.
Thanks

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.