If you do a Google search for multiple instances of iexplore.exe running in Task Manager
, you will find thousands of complaints with various causes (malware and non-malware related).
There are some worms (i.e. W32/Lovgate-AD
) which can launch iexplorer.exe but it usually drops the malicious file in the Windows directory or C:\Windows\system32 folder. One of the ways that malware tries to hide is to give itself the same name as a legitimate or critical system file like iexplore.exe. However, it then places itself in a different location (folder) than where the legitimate file resides and runs from there. The legitimate iexplore.exe is located in the C:\Program Files\Internet Explorer folder. Be sure to confirm the spelling
of the file. If it is iexplor.exe
, then it's malware.
While there are some malware infections which can launch iexplorer.exe, be aware that if Internet Explorer is open, the browser itself may be creating multiple instances in Task Manager. If you're not finding any malware after performing various security scans look more closely at your browser.
If using Internet Explorer 8 or Windows 7, the browser will run an extra instance
of iexplorer.exe for each opened tab as part of the Loosely-Coupled IE
and Automatic Crash Recovery
features by design. ACR stores information about a browsing session on the hard disk so that in the event of a browser crash, hang, or other unexpected shutdown, it will allow you to resume the last browsing session. If using multiple tabs, ARC allows recovery of all opened tabs in case of a browser failure. Essentially that allows Internet Explorer to prevent itself from closing when a web site in one tab crashes. In order to this, Internet Explorer 8 will open a new process for the main window and another process with any opened tab
. As such, it is not unusual to find multiple instances of iexplore.exe running in Task Manager
. More information about ACR and LCIE can be found on the IEBlog: IE8 and Reliability
and an explanation of multiple instances of iexplorer.exe is provided by Don Varnau (MS MVP-IE) here
. One drawback of this new feature is that ACR has been reported to utilize high memory resources.