The Case of the Randomly Launching Internet Explorer Processes

re: The Case of the Randomly Launching Internet Explorer Processes

Madhurjya — Tue, 09 Nov 2010 09:49:12 GMT

Great logical and structured troubleshooting !!

re: The Case of the Randomly Launching Internet Explorer Processes

Raju Singh — Mon, 27 Sep 2010 15:57:27 GMT

This Article is really worth reading. It explains the OS internal process and very much useful to the guys who are into system performance tuning. for 0x10000000, logically, the memroy utilization for user mode process should not exceed the 2 GB limitation of virtual memory addressing space. As this may lead other process running sort of memory hance causing system unstability.

Regards

re: The Case of the Randomly Launching Internet Explorer Processes

Anshuman Ghosh — Mon, 02 Aug 2010 20:41:17 GMT

Thanks Ramon for the correction 0x10000000 = 256MB , bad Math on my part

re: The Case of the Randomly Launching Internet Explorer Processes

Ramón Sola — Sat, 31 Jul 2010 03:58:08 GMT

I really love these articles that show detailed troubleshooting processes to solve real problems. They are enlightening, good job. However, please allow me clear up something.

Actually, address 0x10000000 falls much below the 2 GB boundary, as it equals to 256 MB. This is the default preferred base address which the Microsoft linker and probably other linkers assign to DLL files, unless the /BASE switch is passed with a different address. The executable headers may have confirmed that this wouldn't be a coincidence and that the DLL wasn't relocated. The interesting part is how the rogue module wasn't noticed until the trace from Process Monitor was carefully analyzed. In a Windows XP-based system, the version number of the file might have fooled many people. Moreover, 32-bit processes which don't have set the LargeProcessAware flag always receive a space address of 2 GB, even if the system is running with the /3GB switch or it is a 64-bit system.

Regards.

re: The Case of the Randomly Launching Internet Explorer Processes

Carlo — Fri, 30 Jul 2010 12:35:32 GMT

Very good analysis of the problem, and it's nice to see the way you use process monitor and cross compare Windows OS startup switches.

What I cannot understand is that you say that you have no Internet connection ("getting internet access on the server would be difficult") and then you ran an online Onecare scan...

Good job anyway.

Carlo

re: The Case of the Randomly Launching Internet Explorer Processes

nc — Fri, 30 Jul 2010 11:17:02 GMT

=====

First off 0x10000000 converts to 268435456. This is essentially greater than the 2 GB user mode, virtual address space limit. The box was running with the /3GB switch, so this is a valid user mode address; however Explorer.exe and Iexplore.exe are not /LargeAddressAware, which definitely looks suspicious.

=====

You may wish to review/remove the above paragraph - converting the default load address (in hex) set by a VS native DLL project (0x10000000) to base 10 and comparing that to the 2 GB user-mode virtual address limit seems not quite right.