Mem usage for explorer.exe and iexplore.exe

Discussion in 'Software' started by pegg, May 19, 2004.

  1. pegg

    pegg MajorGeek

    I first posted this attached to an old thread and no one answered this :confused: so I'm starting it with a new title.

    I've been doing a search on MG and I may have missed this type of info...can someone tell me what "normal" mem usage is for explorer.exe and iexplore.exe?

    I've seen posts about TeaTimer being a mem hog, and other programs taking up a lot of resources...but what exactly is "hogging memory?"

    I have Windows XP, with only 256 MB of RAM which is why I'm asking I guess. I saw in one of the searched posts about disabling services, etc. (and I've been to those sites months ago re: disabling several services to speed things up on your computer [Black Viper's infinite wisdom]). It's really not that I have a problem or that anything is slow.

    I checked Task Manager and over and over again explorer.exe uses 20,000 k or more and iexplore is up to 40,000 - 46,000k or more.

    I just want to know if this is "NORMAL" memory usage when the programs are running??
     
  2. jujet84

    jujet84 Master Sergeant

    Pegg why don't you add one more stick of memory bringing you to 512-- where XP is the most happy.If you can afford more do so. :) :cool:
     
  3. jujet84

    jujet84 Master Sergeant

    I didn't see any referal to having any memory leakage. ;) :cool:
     
  4. pegg

    pegg MajorGeek

    hijack this log

    OK -- here's my log I just ran:

    I've done this before but never deleted anything:
    Obviously I have Avast, Zone Alarm, SpyBot, AdAware, SpyWareBlaster, AllVantage is my ISP, callwave is an Internet Answering machine I use while online.....


    Logfile of HijackThis v1.97.7
    Scan saved at 10:15:36 AM, on 5/19/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\TFNF5.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\CallWave\IAM.exe
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\hijackthis\HijackThis.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.allvantage.com/myvantage/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.waterjetconnection.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allvantage.com/myvantage/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.allvantage.com/myvantage/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = -
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = "C:\Program Files\Outlook Express\msimn.exe"
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Forget Me Not.lnk.disabled
    O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
    O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.gfi.com/trojanscan/TDECntrl.CAB
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
    O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://webchat.dell.com/Media/VisitorChat/TLIEFlash.CAB
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1B548B16-ACC2-4216-AD4C-C18EA99EEF75}: NameServer = 198.6.1.125 198.6.100.125
    O17 - HKLM\System\CS3\Services\Tcpip\..\{1B548B16-ACC2-4216-AD4C-C18EA99EEF75}: NameServer = 198.6.1.125 198.6.100.125


    Let me know what to "tweak". I did run RegSeeker and it gave me about 1,000!! items. Is that crazy or normal??? I didn't select them all to delete yet but I got rid of obvious ones like McAfee which I had "deleted" the program a couple weeks ago and some other "programs" which I had deleted.

    Right now I checked Task Manager and Explorer.exe was only 7,000 and iexplore.exe was down to 22,400 (it really fluctuates)
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hey Xflat & Robo, I think ya missed one.

    O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"

    I believe this has been known to cause slow performance with IE.
    See: http://www.pestpatrol.com/PestInfo/p/peopleonpage.asp
    What do you guys think? Should we add it to the list of items to get rid of?
     
  6. Vonnie

    Vonnie Sergeant

    What does this one do?
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You guys are doing just fine in this area. ;) Many hands (many eyes in this case) make heavy work light. You know it is not easy keeping up with the constant crap that keeps popping up. So with all of us pitching in, it makes it easier. Especially since we always can count on someone picking up whatever we may miss with our tired eyes. Some of these logs are getting huge. And they just keep coming! :eek:
     
  8. pegg

    pegg MajorGeek

    1,000 items in RegSeeker - crazy?

    Wow -- thanks for all your help. Now to me that stuff looks important. Especially if it says ".exe" because, hey, that's how a program runs, right? Oh well...


    Is that an outrageous amount?
     
  9. pegg

    pegg MajorGeek

    Crash

    I never deleted anything from this hijack scan except HKLM\..\Run...AutoUpdate...exe

    I went on a site I've been on a lot and it said I didn't have JAVA -- which came with my system. I've been trying to figure out why. I had deleted a few items from RegSeeker that I knew I didn't have (mcafee, etc.) Maybe I have deleted something I thought I recognized that was Java.

    Anyway, I went to Control Panel, didn't uninstall Java but went into "Change/repair". Then I doodled around and checked e-mail and a few other things and all of a sudden BLUE SCREEN.

    It said it was caused by the following file win32k.sys and basically was a CPU problem & HARDWARE. I've had several crashes early on with this dumbbell DELL but never related to CPU and HARDWARE. I didn't do anything to hardware. I'm not even sure what is hardware (duh). AND YES, I know I'm posting this in "software".


    This is what it said:
    These first 3 happened seconds apart:


    <SPAN style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">
     
  10. pegg

    pegg MajorGeek

    Re: Crash

    UGH -- I don't know how to copy and paste obviously -- here's an attachment of the error log I got info from when it crashed.
     
  11. pegg

    pegg MajorGeek

    read-only memory

    oh yeah, when it crashed the blue screen said "An attempt was made to write to read-only memory"
     
  12. jujet84

    jujet84 Master Sergeant

  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: Crash

    The TrueVector problems seem to be related to ZoneAlarm. See this link about half way down. http://www.computergripes.com/ZoneAlarm.html They seem to imply it is not a ZoneAlarm bug though. They go on to say when your computer crashes, the database that ZoneAlarm currently has open is corrupted because it is unable to close it properly. The next time your computer boots up, ZoneAlarm restores the previous database.

    Also read through this set of messages on ZoneLabs website
    http://forums.zonelabs.com/zonelabs/board/message?board.id=gen&message.id=11200

    Not sure if that was of any help. I am not familiar with these error code messages but a search on Error code 100000be, parameter 1 gets lots of hits.
     
  14. pegg

    pegg MajorGeek

    I DO copy & paste butit "disappears" when I submit post

    Thanks -- I DO know how to copy & paste actually, and I can see the whole thing here when I'm writing my reply. However, when I hit "submit reply" and it actually posts then what appears to on the board is:

    <SPAN style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">

    This has happened to me 90% of the time I go back to a .doc I have stored info. from to post here instead of typing again. I see it - then I don't. I've even highlighted it in my post and changed the font and size here, then hit submit and it's still gone.

    I know that's not what this post is about but since it keeps happening to me (and I've seen it happen to a few other posts and I haven't read how to fix that) any advice would be appreciated.
     
  15. pegg

    pegg MajorGeek

    CPU and Hardware problem?

    Thanks for the ideas...yours too, robo. This stuff isn't HARDWARE though which is what my BLUE SCREEN told me it was unhappy with...or doesn't that matter?
     
  16. craigb187

    craigb187 Private E-2

    Hi, I thought my Explorer and IE mem count is too high, but after reading what you guys get I not sure anymore. My question also is, Does your Hardware (RAM) make a difference on your mem usage?

    Here's what I'm sitting on:

    Machine Spec:
    Dual PIII 550mhz
    512 RAM
    4x10GB HDD (2 on IDE and 2 on SCSI)

    Explorer (Peak): +- 27.000 k
    Explorer (Normal): +-25.000k
    IE (Peak): +-31.000k
    IE (Normal): +-22.000k
    Logfile of HijackThis v1.97.7
    Scan saved at 05:30:26 PM, on 2004/06/17
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\ePOAgent\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\Mcshield.exe
    C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    C:\WINDOWS\System32\vmnat.exe
    C:\WINDOWS\System32\vmnetdhcp.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\ctfmon.exe
    C:\ePOAgent\UpdaterUI.exe
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\WINDOWS\StartupMonitor.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\taskmgr.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    c:\hijackthis\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = iexplore
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\ePOAgent\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Download by NetAnts - C:\PROGRA~1\NetAnts\NAGet.htm
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Download &All by NetAnts - C:\PROGRA~1\NetAnts\NAGetAll.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: NetAnts (HKLM)
    O9 - Extra 'Tools' menuitem: &NetAnts (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38150.0606365741
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BE8658F6-4997-442C-9667-7BD100BCF075}: NameServer = 196.7.0.138,196.7.0.139
     
  17. pegg

    pegg MajorGeek

    I have a software answer

    I think you have McAfee right? Man, that was giving me no end of trouble. I haven't seen my explorer.exe go up at all like the numbers you show (and that I HAD) since I got rid of it and downloaded AVAST instead. Just an idea.

    Don't know the answer about Hardware though, sorry.
     
  18. Pruins

    Pruins Private E-2

    On my computer explorer.exe and IEXPLORE.exe also tend to use a lot of memory. The longer Internet Explorer is active the more memory is used. This sometimes leads to crashing of explorer.exe and the desktop disappears (which can be restarted manually by task manager).
    These problems originate from the introduction of Windows 95. They are accompannied by a lot of sudden (and excessive) harddisk activity. It is a problem which is part of windows. It is independant on the amount of physical memory you have in your system. (The only way to ged rid of the problem is installing Windows 3.1)
     
  19. Adrynalyne

    Adrynalyne Guest

    Err, what?
     
  20. Maxwell

    Maxwell Folgers

    Yes, I thought that too Adrynalyne but I think perhaps what the poster is saying that memory leaks are apparent in applications going way back to Windows 95 as well as now. Not even sure that going back to Wndows 3.1 is going to help here.
     
  21. Pruins

    Pruins Private E-2

    That's what I meant. And indeed going back to Windows 3.1 doesn't solve things, but it didn't have these and some other problems.
     
  22. Adrynalyne

    Adrynalyne Guest

    Going back to win 3.1 is not an option though :p
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds