When I open up Internet Explorer, just one instance, I get two of them in my
process list. No extra tabs or windows open, just the one iexplore. When I
close that iexplore, they both go away in the process list. When I open it up
again, poof two in processes. One usually runs parallel to whatever website I
am on, ie higher memory usage for bigger sites, and the other runs about 16M
all the time. I run Spy-bot and Ad Aware regularly. Don’t know what is causing
this, wasn’t there before.
This has actually spooked a few people since IE8 came out.
I can’t tell you why it’s done, because quite honestly I don’t know.
But I can tell you this: it’s not a problem, and not a sign of anything like
malware.
Let’s look at what people are seeing.
]]>
If you fire up a single instance of Internet Explorer version 8, and then open up the task manager, you may see something like this in the process tab:
If, instead, we look at the process list using Process Explorer we’ll see something like this:
What I immediately notice is that one instance is indented underneath the other. That means that the top one explicitly started the one underneath it – it’s that process’s “parent”.
If I start another instance of IE (via the quick launch bar):
You’ll see that the instance of IE8 that I started is not a new top-level process, but was rather added as a child of that same parent IE8 process. (Creating tabs will also create more processes, though not necessarily one-for-one.)
My theory is simply this: with the release of IE8, Microsoft added features to make IE more resilient to crashes. One instance of IE crashing will not affect another, for example. Moreover, if one of those child processes crashes, then I believe it’s that parent process’s job to recover from the crash. It probably notices and automatically restarts a new child process so that you can continue browsing.
I could be wrong about the specifics, but I’m fairly certain that this “extra” IE8 instance is all about making your browser experience more robust and stable. (Much of this is confirmed by the IE8 team blog.)
More importantly, whatever the reasons, it’s nothing to be concerned about. It’s not a sign of malware or something bad happening behind the scenes.
…and THIS is why I continue to stay on your email list, Leo. I’ve seen those double entries and I’ve just not investigated them as I’ve just assumed that IE8 was the reason. Now I know and the answer came to me rather than me hunting it down. I guess I owe you another beer soon.
You will see two or more open as like you stated the first one is the parent and responsable for everything, the others are for tabs to different sites if you have more than one tab open, if not the one tab is the child of the parent and has the site open. The more tabs the more child process’ and that is suppose to be so that you don’t lose all iexplorer if one site stops and locks up you do not loose everything that was open and have to go back and redo everything. I have seen it help like it is suppose to but then sometimes I have seen it lock everything so it is like anything else on the computer tempermental.
After opening several tabs or starting separate IE windows, close a few. I found that the extra processes do not go away. Defect? Perhaps. I’ll take care to quit and restart IE occasionally to relieve memory/cpu bloat and the potential for a lockup.
when the process is running inside of itself like that,
it could be a side effect of the newer IE internal sand-boxing methods
I haven’t played with or used it
because if I install anything higher than IE6 on my systems it breaks a lot of my production software
My second iexplore.exe is generated by the google toolbar. I have tried uninstalling and removing it using hijack this and it keep coming back. It does seem to randomly open up other websites especially when I am looking for something on a google search. Maybe randomly is the wrong word, it might be very selective. While it doesn’t suck up a ton of resources I still consider this type of item Malware as it is directing my internet path. Two other web pages opened while I was typing this.
Thanks