Guest Terry R. Posted August 28, 2008 Posted August 28, 2008 I have one workstation on a network, that whenever I go to reboot it, it gives the error dialog that IEXPLORE.EXE needs to close. After clicking on End Now multiple times, if I cancel the reboot, I can see multiple IEXPLORE.EXE in Task Manager, often a dozen or more instances. What would be causing this behavior, and how can I correct it? I've never seen that on any other workstation before. I'm beginning to wonder whether I should just make Firefox the default browser. XP Pro sp2 w/IE 7 and all updates. Thanks, -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Guest Gary S. Terhune Posted August 28, 2008 Posted August 28, 2008 Re: multiple instances of IE on reboot I'm tired and I'm just going to steal this from PA Bear: -- Gary S. Terhune MS-MVP Shell/User http://grystmill.com Unexplained computer behavior may be caused by deceptive software http://support.microsoft.com/kb/827315 Run a /thorough/ check for hijackware, including posting your hijackthis log to an appropriate forum. Checking for/Help with Hijackware http://aumha.org/a/parasite.htm http://aumha.org/a/quickfix.htm http://aumha.net/viewtopic.php?t=5878 http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction http://mvps.org/winhelp2002/unwanted.htm http://inetexplorer.mvps.org/data/prevention.htm http://inetexplorer.mvps.org/tshoot.html http://www.mvps.org/sramesh2k/Malware_Defence.htm http://defendingyourmachine2.blogspot.com/ http://www.elephantboycomputers.com/page2.html#Removing_Malware When all else fails, HijackThis v2.0.2 (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in conjuction with some other utilities). HijackThis will NOT fix anything on its own, but it will help you to both identify and remove any hijackware/spyware with assistance from an expert. **Post your log to http://aumha.net/viewforum.php?f=30, http://forums.spybot.info/forumdisplay.php?f=22, http://castlecops.com/forum67.html, or other appropriate forums for review by an expert in such matters, not here.** If the procedures look too complex - and there is no shame in admitting this isn't your cup of tea - take the machine to a local, reputable and independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ "Terry R." <F1Com@NOSPAMpobox.com> wrote in message news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl... >I have one workstation on a network, that whenever I go to reboot it, it >gives the error dialog that IEXPLORE.EXE needs to close. After clicking on >End Now multiple times, if I cancel the reboot, I can see multiple >IEXPLORE.EXE in Task Manager, often a dozen or more instances. What would >be causing this behavior, and how can I correct it? I've never seen that >on any other workstation before. I'm beginning to wonder whether I should >just make Firefox the default browser. > > XP Pro sp2 w/IE 7 and all updates. > > Thanks, > -- > Terry R. > > ***Reply Note*** > Anti-spam measures are included in my email address. > Delete NOSPAM from the email address after clicking Reply.
Guest Mick Murphy Posted August 28, 2008 Posted August 28, 2008 Re: multiple instances of IE on reboot Hi Gary. I have seen it on mine; and it is not Spyware, or shy of updates; XP SP3. If you are at a site which is still downloading the page, and you cancel download, and attempt to close IE7, it freezes. You then bring up Task Manager, click the END NOW windows, and that is when you get multiples in the Task Bar. You can get out of it with Task Manger. It is a human error, lol. -- Mick Murphy - Qld - Australia "Gary S. Terhune" wrote: > I'm tired and I'm just going to steal this from PA Bear: > -- > Gary S. Terhune > MS-MVP Shell/User > http://grystmill.com > > Unexplained computer behavior may be caused by deceptive software > http://support.microsoft.com/kb/827315 > > Run a /thorough/ check for hijackware, including posting your hijackthis log > to an appropriate forum. > > Checking for/Help with Hijackware > http://aumha.org/a/parasite.htm > http://aumha.org/a/quickfix.htm > http://aumha.net/viewtopic.php?t=5878 > http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction > http://mvps.org/winhelp2002/unwanted.htm > http://inetexplorer.mvps.org/data/prevention.htm > http://inetexplorer.mvps.org/tshoot.html > http://www.mvps.org/sramesh2k/Malware_Defence.htm > http://defendingyourmachine2.blogspot.com/ > http://www.elephantboycomputers.com/page2.html#Removing_Malware > > When all else fails, HijackThis v2.0.2 > (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in > conjuction with some other utilities). HijackThis will NOT fix anything on > its own, but it will help you to both identify and remove any > hijackware/spyware with assistance from an expert. **Post your log to > http://aumha.net/viewforum.php?f=30, > http://forums.spybot.info/forumdisplay.php?f=22, > http://castlecops.com/forum67.html, or other appropriate forums for review > by an expert in such matters, not here.** > > If the procedures look too complex - and there is no shame in admitting this > isn't your cup of tea - take the machine to a local, reputable and > independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop. > > -- > ~Robear Dyer (PA Bear) > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 > AumHa VSOP & Admin http://aumha.net > DTS-L http://dts-l.net/ > > > "Terry R." <F1Com@NOSPAMpobox.com> wrote in message > news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl... > >I have one workstation on a network, that whenever I go to reboot it, it > >gives the error dialog that IEXPLORE.EXE needs to close. After clicking on > >End Now multiple times, if I cancel the reboot, I can see multiple > >IEXPLORE.EXE in Task Manager, often a dozen or more instances. What would > >be causing this behavior, and how can I correct it? I've never seen that > >on any other workstation before. I'm beginning to wonder whether I should > >just make Firefox the default browser. > > > > XP Pro sp2 w/IE 7 and all updates. > > > > Thanks, > > -- > > Terry R. > > > > ***Reply Note*** > > Anti-spam measures are included in my email address. > > Delete NOSPAM from the email address after clicking Reply. > > >
Guest PA Bear [MS MVP] Posted August 28, 2008 Posted August 28, 2008 Re: multiple instances of IE on reboot Thanks for watching my back! Gary S. Terhune wrote: > I'm tired and I'm just going to steal this from PA Bear: > -- > Gary S. Terhune > MS-MVP Shell/User > http://grystmill.com > > Unexplained computer behavior may be caused by deceptive software > http://support.microsoft.com/kb/827315 > > Run a /thorough/ check for hijackware, including posting your hijackthis > log > to an appropriate forum. > > Checking for/Help with Hijackware > http://aumha.org/a/parasite.htm > http://aumha.org/a/quickfix.htm > http://aumha.net/viewtopic.php?t=5878 > http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction > http://mvps.org/winhelp2002/unwanted.htm > http://inetexplorer.mvps.org/data/prevention.htm > http://inetexplorer.mvps.org/tshoot.html > http://www.mvps.org/sramesh2k/Malware_Defence.htm > http://defendingyourmachine2.blogspot.com/ > http://www.elephantboycomputers.com/page2.html#Removing_Malware > > When all else fails, HijackThis v2.0.2 > (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use > (in > conjuction with some other utilities). HijackThis will NOT fix anything > on > its own, but it will help you to both identify and remove any > hijackware/spyware with assistance from an expert. **Post your log to > http://aumha.net/viewforum.php?f=30, > http://forums.spybot.info/forumdisplay.php?f=22, > http://castlecops.com/forum67.html, or other appropriate forums for review > by an expert in such matters, not here.** > > If the procedures look too complex - and there is no shame in admitting > this > isn't your cup of tea - take the machine to a local, reputable and > independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop. > > > "Terry R." <F1Com@NOSPAMpobox.com> wrote in message > news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl... >> I have one workstation on a network, that whenever I go to reboot it, it >> gives the error dialog that IEXPLORE.EXE needs to close. After clicking >> on >> End Now multiple times, if I cancel the reboot, I can see multiple >> IEXPLORE.EXE in Task Manager, often a dozen or more instances. What >> would >> be causing this behavior, and how can I correct it? I've never seen that >> on any other workstation before. I'm beginning to wonder whether I >> should >> just make Firefox the default browser. >> >> XP Pro sp2 w/IE 7 and all updates. >> >> Thanks, >> -- >> Terry R. >> >> ***Reply Note*** >> Anti-spam measures are included in my email address. >> Delete NOSPAM from the email address after clicking Reply.
Guest Terry R. Posted August 28, 2008 Posted August 28, 2008 Re: multiple instances of IE on reboot The date and time was 8/28/2008 4:07 PM, and on a whim, PA Bear [MS MVP] pounded out on the keyboard: > Thanks for watching my back! > > Gary S. Terhune wrote: >> I'm tired and I'm just going to steal this from PA Bear: >> -- >> Gary S. Terhune >> MS-MVP Shell/User >> http://grystmill.com >> >> Unexplained computer behavior may be caused by deceptive software >> http://support.microsoft.com/kb/827315 >> Malware is not the issue here. Thanks, -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Guest PA Bear [MS MVP] Posted August 28, 2008 Posted August 28, 2008 Re: multiple instances of IE on reboot Terry R. wrote: > The date and time was 8/28/2008 4:07 PM, and on a whim, PA Bear [MS MVP] > pounded out on the keyboard: > >> Thanks for watching my back! >> >> Gary S. Terhune wrote: >>> I'm tired and I'm just going to steal this from PA Bear: >>> -- >>> Gary S. Terhune >>> MS-MVP Shell/User >>> http://grystmill.com >>> >>> Unexplained computer behavior may be caused by deceptive software >>> http://support.microsoft.com/kb/827315 >>> > > Malware is not the issue here. Post your HijackThis log in an appropriate forum and prove it, please.
Guest Gary S. Terhune Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot Haven't run into that one. I don't run IE7 on XP but I'll try to replicate the behavior when I'm next in Vistaland. So, it's either a problem with IE7 or one of its add-ons, or it's user error for not giving the app time to respond? I know I have to tell people regularly that "frozen" apps or Windows usually means it's so busy trying to do what it's been told to do that it doesn't have the time or resources to keep you informed. Eventually they recover. Lots of people are too quick on the draw with Task Manager. But that cascading stuff on the Task bar... Those represent real windows? Real instances of IE? While I'd like to give you the benefit of the doubt, I'd still recommend the scans, but my best guess is that it's caused by an add-on. -- Gary S. Terhune MS-MVP Shell/User http://grystmill.com "Mick Murphy" <MickMurphy@discussions.microsoft.com> wrote in message news:15555B87-0498-4C79-8F36-79970B2D7FF8@microsoft.com... > Hi Gary. > I have seen it on mine; and it is not Spyware, or shy of updates; XP SP3. > If you are at a site which is still downloading the page, and you cancel > download, and attempt to close IE7, it freezes. > You then bring up Task Manager, click the END NOW windows, and that is > when > you get multiples in the Task Bar. > You can get out of it with Task Manger. > It is a human error, lol. > -- > Mick Murphy - Qld - Australia > > > "Gary S. Terhune" wrote: > >> I'm tired and I'm just going to steal this from PA Bear: >> -- >> Gary S. Terhune >> MS-MVP Shell/User >> http://grystmill.com >> >> Unexplained computer behavior may be caused by deceptive software >> http://support.microsoft.com/kb/827315 >> >> Run a /thorough/ check for hijackware, including posting your hijackthis >> log >> to an appropriate forum. >> >> Checking for/Help with Hijackware >> http://aumha.org/a/parasite.htm >> http://aumha.org/a/quickfix.htm >> http://aumha.net/viewtopic.php?t=5878 >> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction >> http://mvps.org/winhelp2002/unwanted.htm >> http://inetexplorer.mvps.org/data/prevention.htm >> http://inetexplorer.mvps.org/tshoot.html >> http://www.mvps.org/sramesh2k/Malware_Defence.htm >> http://defendingyourmachine2.blogspot.com/ >> http://www.elephantboycomputers.com/page2.html#Removing_Malware >> >> When all else fails, HijackThis v2.0.2 >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use >> (in >> conjuction with some other utilities). HijackThis will NOT fix anything >> on >> its own, but it will help you to both identify and remove any >> hijackware/spyware with assistance from an expert. **Post your log to >> http://aumha.net/viewforum.php?f=30, >> http://forums.spybot.info/forumdisplay.php?f=22, >> http://castlecops.com/forum67.html, or other appropriate forums for >> review >> by an expert in such matters, not here.** >> >> If the procedures look too complex - and there is no shame in admitting >> this >> isn't your cup of tea - take the machine to a local, reputable and >> independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair >> shop. >> >> -- >> ~Robear Dyer (PA Bear) >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >> AumHa VSOP & Admin http://aumha.net >> DTS-L http://dts-l.net/ >> >> >> "Terry R." <F1Com@NOSPAMpobox.com> wrote in message >> news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl... >> >I have one workstation on a network, that whenever I go to reboot it, it >> >gives the error dialog that IEXPLORE.EXE needs to close. After clicking >> >on >> >End Now multiple times, if I cancel the reboot, I can see multiple >> >IEXPLORE.EXE in Task Manager, often a dozen or more instances. What >> >would >> >be causing this behavior, and how can I correct it? I've never seen >> >that >> >on any other workstation before. I'm beginning to wonder whether I >> >should >> >just make Firefox the default browser. >> > >> > XP Pro sp2 w/IE 7 and all updates. >> > >> > Thanks, >> > -- >> > Terry R. >> > >> > ***Reply Note*** >> > Anti-spam measures are included in my email address. >> > Delete NOSPAM from the email address after clicking Reply. >> >> >>
Guest Gary S. Terhune Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot Question: Is IE obviously open at the time you initiate a restart or shutdown, or is the fact that it's even still loaded a surprise to you? Because if it isn't obviously open but an instance exists in Task Manager, then you almost certainly do have a malware infection, or something almost the same, a bad add-on. -- Gary S. Terhune MS-MVP Shell/User http://grystmill.com "Terry R." <F1Com@NOSPAMpobox.com> wrote in message news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl... >I have one workstation on a network, that whenever I go to reboot it, it >gives the error dialog that IEXPLORE.EXE needs to close. After clicking on >End Now multiple times, if I cancel the reboot, I can see multiple >IEXPLORE.EXE in Task Manager, often a dozen or more instances. What would >be causing this behavior, and how can I correct it? I've never seen that >on any other workstation before. I'm beginning to wonder whether I should >just make Firefox the default browser. > > XP Pro sp2 w/IE 7 and all updates. > > Thanks, > -- > Terry R. > > ***Reply Note*** > Anti-spam measures are included in my email address. > Delete NOSPAM from the email address after clicking Reply.
Guest Terry R. Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot The date and time was 8/28/2008 6:51 PM, and on a whim, Gary S. Terhune pounded out on the keyboard: > Question: Is IE obviously open at the time you initiate a restart or > shutdown, or is the fact that it's even still loaded a surprise to you? > Because if it isn't obviously open but an instance exists in Task Manager, > then you almost certainly do have a malware infection, or something almost > the same, a bad add-on. > Everything appears to be closed, so I restart the workstation. I get the dialog that IEXPLORE.EXE needs to be closed, so I click on End Now. It comes up again and again, so I stop the shutdown and look in Task Manager and see there are many instances in memory. After I shut them all down, I can restart easily. I know there isn't any malware. I'm suspecting a bad add-on myself. Next week when I'm onsite, I'll talk with the user and see if IE can be run with no add-ons for a while for testing. Thanks, -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Guest Gary S. Terhune Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot So, why not disable all add-ons and test? (Internet Options, Programs tab, Manage Add-Ons button.Use IE, open a few instances, shut them all down then check Task Manager Processes tab for iexplore.exe. Another possibility that occurs to me is that some program (I'm thinking of Office, for example) may open a hidden instance of IE for it own inscrutable purposes and do to in such a way as to prevent IE from being killed by Shutdown in a normal manner (as it would kill most open apps.) -- Gary S. Terhune MS-MVP Shell/User http://grystmill.com "Terry R." <F1Com@NOSPAMpobox.com> wrote in message news:Oh95B4YCJHA.4368@TK2MSFTNGP06.phx.gbl... > The date and time was 8/28/2008 6:51 PM, and on a whim, Gary S. Terhune > pounded out on the keyboard: > >> Question: Is IE obviously open at the time you initiate a restart or >> shutdown, or is the fact that it's even still loaded a surprise to you? >> Because if it isn't obviously open but an instance exists in Task >> Manager, then you almost certainly do have a malware infection, or >> something almost the same, a bad add-on. >> > > Everything appears to be closed, so I restart the workstation. I get the > dialog that IEXPLORE.EXE needs to be closed, so I click on End Now. It > comes up again and again, so I stop the shutdown and look in Task Manager > and see there are many instances in memory. After I shut them all down, I > can restart easily. > > I know there isn't any malware. I'm suspecting a bad add-on myself. Next > week when I'm onsite, I'll talk with the user and see if IE can be run > with no add-ons for a while for testing. > > Thanks, > > -- > Terry R. > > ***Reply Note*** > Anti-spam measures are included in my email address. > Delete NOSPAM from the email address after clicking Reply.
Guest Terry R. Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune pounded out on the keyboard: > So, why not disable all add-ons and test? (Internet Options, Programs tab, > Manage Add-Ons button.Use IE, open a few instances, shut them all down then > check Task Manager Processes tab for iexplore.exe. Another possibility that > occurs to me is that some program (I'm thinking of Office, for example) may > open a hidden instance of IE for it own inscrutable purposes and do to in > such a way as to prevent IE from being killed by Shutdown in a normal manner > (as it would kill most open apps.) > I intend to next week. I looked at it once a couple months back, rebooted and opened, surfed and closed IE repeatedly and couldn't replicate it. So whatever the user is using or doing, it's causing the problem. He also doesn't shut down or restart very often and that may be complicating the issue. If it was just one process of IE, it wouldn't be as big a deal. But the times I've found it in this condition, there were 5 to 10 instances running. I'll post back next Wednesday, which is the next time I'm onsite. Thanks, -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Guest PA Bear [MS MVP] Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot > If it was just one process of IE, it wouldn't be as big a deal. But the > times I've found it in this condition, there were 5 to 10 instances > running. Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that you have hijackware problem, Terry. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ Terry R. wrote: > The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune > pounded out on the keyboard: > >> So, why not disable all add-ons and test? (Internet Options, Programs >> tab, >> Manage Add-Ons button.Use IE, open a few instances, shut them all down >> then >> check Task Manager Processes tab for iexplore.exe. Another possibility >> that >> occurs to me is that some program (I'm thinking of Office, for example) >> may >> open a hidden instance of IE for it own inscrutable purposes and do to in >> such a way as to prevent IE from being killed by Shutdown in a normal >> manner (as it would kill most open apps.) >> > > I intend to next week. I looked at it once a couple months back, > rebooted and opened, surfed and closed IE repeatedly and couldn't > replicate it. So whatever the user is using or doing, it's causing the > problem. He also doesn't shut down or restart very often and that may > be complicating the issue. > > If it was just one process of IE, it wouldn't be as big a deal. But the > times I've found it in this condition, there were 5 to 10 instances > running. > > I'll post back next Wednesday, which is the next time I'm onsite. > > Thanks,
Guest Gary S. Terhune Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot But are there not "legitimate" components that behave just like hijackware? -- Gary S. Terhune MS-MVP Shell/User http://grystmill.com "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl... >> If it was just one process of IE, it wouldn't be as big a deal. But the >> times I've found it in this condition, there were 5 to 10 instances >> running. > > Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that > you have hijackware problem, Terry. > -- > ~Robear Dyer (PA Bear) > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 > AumHa VSOP & Admin http://aumha.net > DTS-L http://dts-l.net/ > > Terry R. wrote: >> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune >> pounded out on the keyboard: >> >>> So, why not disable all add-ons and test? (Internet Options, Programs >>> tab, >>> Manage Add-Ons button.Use IE, open a few instances, shut them all down >>> then >>> check Task Manager Processes tab for iexplore.exe. Another possibility >>> that >>> occurs to me is that some program (I'm thinking of Office, for example) >>> may >>> open a hidden instance of IE for it own inscrutable purposes and do to >>> in >>> such a way as to prevent IE from being killed by Shutdown in a normal >>> manner (as it would kill most open apps.) >>> >> >> I intend to next week. I looked at it once a couple months back, >> rebooted and opened, surfed and closed IE repeatedly and couldn't >> replicate it. So whatever the user is using or doing, it's causing the >> problem. He also doesn't shut down or restart very often and that may >> be complicating the issue. >> >> If it was just one process of IE, it wouldn't be as big a deal. But the >> times I've found it in this condition, there were 5 to 10 instances >> running. >> >> I'll post back next Wednesday, which is the next time I'm onsite. >> >> Thanks, >
Guest PA Bear [MS MVP] Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot Big clue (assuming he didn't have "5 to 10 [separate] instances" open at the time): >> If it was just one process of IE, it wouldn't be as big a deal. But the >> times I've found it in this condition, there were 5 to 10 instances >> running. -- ~PAÞ Gary S. Terhune wrote: > But are there not "legitimate" components that behave just like > hijackware? > > > "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message > news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl... >>> If it was just one process of IE, it wouldn't be as big a deal. But the >>> times I've found it in this condition, there were 5 to 10 instances >>> running. >> >> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that >> you have hijackware problem, Terry. >> -- >> ~Robear Dyer (PA Bear) >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >> AumHa VSOP & Admin http://aumha.net >> DTS-L http://dts-l.net/ >> >> Terry R. wrote: >>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune >>> pounded out on the keyboard: >>> >>>> So, why not disable all add-ons and test? (Internet Options, Programs >>>> tab, >>>> Manage Add-Ons button.Use IE, open a few instances, shut them all down >>>> then >>>> check Task Manager Processes tab for iexplore.exe. Another possibility >>>> that >>>> occurs to me is that some program (I'm thinking of Office, for example) >>>> may >>>> open a hidden instance of IE for it own inscrutable purposes and do to >>>> in >>>> such a way as to prevent IE from being killed by Shutdown in a normal >>>> manner (as it would kill most open apps.) >>>> >>> >>> I intend to next week. I looked at it once a couple months back, >>> rebooted and opened, surfed and closed IE repeatedly and couldn't >>> replicate it. So whatever the user is using or doing, it's causing the >>> problem. He also doesn't shut down or restart very often and that may >>> be complicating the issue. >>> >>> If it was just one process of IE, it wouldn't be as big a deal. But the >>> times I've found it in this condition, there were 5 to 10 instances >>> running. >>> >>> I'll post back next Wednesday, which is the next time I'm onsite. >>> >>> Thanks,
Guest Terry R. Posted August 29, 2008 Posted August 29, 2008 Re: multiple instances of IE on reboot The date and time was 8/29/2008 1:17 PM, and on a whim, PA Bear [MS MVP] pounded out on the keyboard: >> If it was just one process of IE, it wouldn't be as big a deal. But the >> times I've found it in this condition, there were 5 to 10 instances >> running. > > Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that > you have hijackware problem, Terry. I check the workstations regularly. I know there's not an issue. As I stated, I can reboot, go in and out of IE repeatedly and can't replicate it. It's only after the user has had it on for a couple weeks. I'll report more next Wednesday. -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Guest Gary S. Terhune Posted August 30, 2008 Posted August 30, 2008 Re: multiple instances of IE on reboot Well, let's see what results, if any, Terry comes up with over the weekend, or over several months, considering the symptoms present so slowly, and maybe he'll eventually talk himself into doing some malware scanning just to be thorough, ;-) -- Gary S. Terhune MS-MVP Shell/User http://grystmill.com "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message news:%23GenPRiCJHA.4576@TK2MSFTNGP05.phx.gbl... > Big clue (assuming he didn't have "5 to 10 [separate] instances" open at > the time): >>> If it was just one process of IE, it wouldn't be as big a deal. But the >>> times I've found it in this condition, there were 5 to 10 instances >>> running. > -- > ~PAÞ > > Gary S. Terhune wrote: >> But are there not "legitimate" components that behave just like >> hijackware? >> >> >> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message >> news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl... >>>> If it was just one process of IE, it wouldn't be as big a deal. But >>>> the >>>> times I've found it in this condition, there were 5 to 10 instances >>>> running. >>> >>> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you >>> that >>> you have hijackware problem, Terry. >>> -- >>> ~Robear Dyer (PA Bear) >>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >>> AumHa VSOP & Admin http://aumha.net >>> DTS-L http://dts-l.net/ >>> >>> Terry R. wrote: >>>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. >>>> Terhune >>>> pounded out on the keyboard: >>>> >>>>> So, why not disable all add-ons and test? (Internet Options, Programs >>>>> tab, >>>>> Manage Add-Ons button.Use IE, open a few instances, shut them all down >>>>> then >>>>> check Task Manager Processes tab for iexplore.exe. Another possibility >>>>> that >>>>> occurs to me is that some program (I'm thinking of Office, for >>>>> example) >>>>> may >>>>> open a hidden instance of IE for it own inscrutable purposes and do to >>>>> in >>>>> such a way as to prevent IE from being killed by Shutdown in a normal >>>>> manner (as it would kill most open apps.) >>>>> >>>> >>>> I intend to next week. I looked at it once a couple months back, >>>> rebooted and opened, surfed and closed IE repeatedly and couldn't >>>> replicate it. So whatever the user is using or doing, it's causing the >>>> problem. He also doesn't shut down or restart very often and that may >>>> be complicating the issue. >>>> >>>> If it was just one process of IE, it wouldn't be as big a deal. But >>>> the >>>> times I've found it in this condition, there were 5 to 10 instances >>>> running. >>>> >>>> I'll post back next Wednesday, which is the next time I'm onsite. >>>> >>>> Thanks, >
Guest PA Bear [MS MVP] Posted August 30, 2008 Posted August 30, 2008 Re: multiple instances of IE on reboot And/or log the user's online activities. ("The dog ate my homework!") Gary S. Terhune wrote: > Well, let's see what results, if any, Terry comes up with over the > weekend, > or over several months, considering the symptoms present so slowly, and > maybe he'll eventually talk himself into doing some malware scanning just > to > be thorough, ;-) > > > "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message > news:%23GenPRiCJHA.4576@TK2MSFTNGP05.phx.gbl... >> Big clue (assuming he didn't have "5 to 10 [separate] instances" open at >> the time): >>>> If it was just one process of IE, it wouldn't be as big a deal. But >>>> the >>>> times I've found it in this condition, there were 5 to 10 instances >>>> running. >> -- >> ~PAÞ >> >> Gary S. Terhune wrote: >>> But are there not "legitimate" components that behave just like >>> hijackware? >>> >>> >>> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message >>> news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl... >>>>> If it was just one process of IE, it wouldn't be as big a deal. But >>>>> the >>>>> times I've found it in this condition, there were 5 to 10 instances >>>>> running. >>>> >>>> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you >>>> that >>>> you have hijackware problem, Terry. >>>> -- >>>> ~Robear Dyer (PA Bear) >>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >>>> AumHa VSOP & Admin http://aumha.net >>>> DTS-L http://dts-l.net/ >>>> >>>> Terry R. wrote: >>>>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. >>>>> Terhune >>>>> pounded out on the keyboard: >>>>> >>>>>> So, why not disable all add-ons and test? (Internet Options, Programs >>>>>> tab, >>>>>> Manage Add-Ons button.Use IE, open a few instances, shut them all >>>>>> down >>>>>> then >>>>>> check Task Manager Processes tab for iexplore.exe. Another >>>>>> possibility >>>>>> that >>>>>> occurs to me is that some program (I'm thinking of Office, for >>>>>> example) >>>>>> may >>>>>> open a hidden instance of IE for it own inscrutable purposes and do >>>>>> to >>>>>> in >>>>>> such a way as to prevent IE from being killed by Shutdown in a normal >>>>>> manner (as it would kill most open apps.) >>>>>> >>>>> >>>>> I intend to next week. I looked at it once a couple months back, >>>>> rebooted and opened, surfed and closed IE repeatedly and couldn't >>>>> replicate it. So whatever the user is using or doing, it's causing >>>>> the >>>>> problem. He also doesn't shut down or restart very often and that may >>>>> be complicating the issue. >>>>> >>>>> If it was just one process of IE, it wouldn't be as big a deal. But >>>>> the >>>>> times I've found it in this condition, there were 5 to 10 instances >>>>> running. >>>>> >>>>> I'll post back next Wednesday, which is the next time I'm onsite. >>>>> >>>>> Thanks,
Guest Gary S. Terhune Posted August 30, 2008 Posted August 30, 2008 Re: multiple instances of IE on reboot Yeah, that idea was lurking at the back of my mind, too, but refusing to coalesce. I so detest any type of spyware, but then again, I'm not an admin-type like Terry. -- Gary S. Terhune MS-MVP Shell/User http://grystmill.com "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message news:OiFcW9kCJHA.3668@TK2MSFTNGP05.phx.gbl... > And/or log the user's online activities. ("The dog ate my homework!") > > Gary S. Terhune wrote: >> Well, let's see what results, if any, Terry comes up with over the >> weekend, >> or over several months, considering the symptoms present so slowly, and >> maybe he'll eventually talk himself into doing some malware scanning just >> to >> be thorough, ;-) >> >> >> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message >> news:%23GenPRiCJHA.4576@TK2MSFTNGP05.phx.gbl... >>> Big clue (assuming he didn't have "5 to 10 [separate] instances" open at >>> the time): >>>>> If it was just one process of IE, it wouldn't be as big a deal. But >>>>> the >>>>> times I've found it in this condition, there were 5 to 10 instances >>>>> running. >>> -- >>> ~PAÞ >>> >>> Gary S. Terhune wrote: >>>> But are there not "legitimate" components that behave just like >>>> hijackware? >>>> >>>> >>>> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message >>>> news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl... >>>>>> If it was just one process of IE, it wouldn't be as big a deal. But >>>>>> the >>>>>> times I've found it in this condition, there were 5 to 10 instances >>>>>> running. >>>>> >>>>> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you >>>>> that >>>>> you have hijackware problem, Terry. >>>>> -- >>>>> ~Robear Dyer (PA Bear) >>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >>>>> AumHa VSOP & Admin http://aumha.net >>>>> DTS-L http://dts-l.net/ >>>>> >>>>> Terry R. wrote: >>>>>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. >>>>>> Terhune >>>>>> pounded out on the keyboard: >>>>>> >>>>>>> So, why not disable all add-ons and test? (Internet Options, >>>>>>> Programs >>>>>>> tab, >>>>>>> Manage Add-Ons button.Use IE, open a few instances, shut them all >>>>>>> down >>>>>>> then >>>>>>> check Task Manager Processes tab for iexplore.exe. Another >>>>>>> possibility >>>>>>> that >>>>>>> occurs to me is that some program (I'm thinking of Office, for >>>>>>> example) >>>>>>> may >>>>>>> open a hidden instance of IE for it own inscrutable purposes and do >>>>>>> to >>>>>>> in >>>>>>> such a way as to prevent IE from being killed by Shutdown in a >>>>>>> normal >>>>>>> manner (as it would kill most open apps.) >>>>>>> >>>>>> >>>>>> I intend to next week. I looked at it once a couple months back, >>>>>> rebooted and opened, surfed and closed IE repeatedly and couldn't >>>>>> replicate it. So whatever the user is using or doing, it's causing >>>>>> the >>>>>> problem. He also doesn't shut down or restart very often and that >>>>>> may >>>>>> be complicating the issue. >>>>>> >>>>>> If it was just one process of IE, it wouldn't be as big a deal. But >>>>>> the >>>>>> times I've found it in this condition, there were 5 to 10 instances >>>>>> running. >>>>>> >>>>>> I'll post back next Wednesday, which is the next time I'm onsite. >>>>>> >>>>>> Thanks, >
Guest Terry R. Posted August 30, 2008 Posted August 30, 2008 Re: multiple instances of IE on reboot The date and time was 8/29/2008 7:57 PM, and on a whim, Gary S. Terhune pounded out on the keyboard: > Well, let's see what results, if any, Terry comes up with over the weekend, > or over several months, considering the symptoms present so slowly, and > maybe he'll eventually talk himself into doing some malware scanning just to > be thorough, ;-) > I've run scans, using four or five methods. Nothing has come up, and other than the IE processes, the workstation runs fine. Let you know more Wednesday, -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Guest Terry R. Posted August 30, 2008 Posted August 30, 2008 Re: multiple instances of IE on reboot The date and time was 8/29/2008 8:16 PM, and on a whim, PA Bear [MS MVP] pounded out on the keyboard: > And/or log the user's online activities. ("The dog ate my homework!") > At this point, the user hasn't warranted any reason. But you never know. He is Hispanic, and some of the sites he visits are all in Spanish, so there could possibly be some bad scripting he's running into. -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Guest Gary S. Terhune Posted August 30, 2008 Posted August 30, 2008 Re: multiple instances of IE on reboot Enjoy your weekend! -- Gary S. Terhune MS-MVP Shell/User http://grystmill.com "Terry R." <F1Com@NOSPAMpobox.com> wrote in message news:uDjPzDmCJHA.1224@TK2MSFTNGP02.phx.gbl... > The date and time was 8/29/2008 7:57 PM, and on a whim, Gary S. Terhune > pounded out on the keyboard: > >> Well, let's see what results, if any, Terry comes up with over the >> weekend, or over several months, considering the symptoms present so >> slowly, and maybe he'll eventually talk himself into doing some malware >> scanning just to be thorough, ;-) >> > > I've run scans, using four or five methods. Nothing has come up, and other > than the IE processes, the workstation runs fine. > > Let you know more Wednesday, > > -- > Terry R. > > ***Reply Note*** > Anti-spam measures are included in my email address. > Delete NOSPAM from the email address after clicking Reply.
Guest PA Bear [MS MVP] Posted August 30, 2008 Posted August 30, 2008 Re: multiple instances of IE on reboot No scanning or utilities can detect all hijackware, Terry. Get over it. Terry R. wrote: > The date and time was 8/29/2008 7:57 PM, and on a whim, Gary S. Terhune > pounded out on the keyboard: > >> Well, let's see what results, if any, Terry comes up with over the >> weekend, >> or over several months, considering the symptoms present so slowly, and >> maybe he'll eventually talk himself into doing some malware scanning just >> to be thorough, ;-) >> > > I've run scans, using four or five methods. Nothing has come up, and > other than the IE processes, the workstation runs fine. > > Let you know more Wednesday,
Guest PA Bear [MS MVP] Posted August 30, 2008 Posted August 30, 2008 Re: multiple instances of IE on reboot Spoken like a true xenophobe. Terry R. wrote: > The date and time was 8/29/2008 8:16 PM, and on a whim, PA Bear [MS MVP] > pounded out on the keyboard: > >> And/or log the user's online activities. ("The dog ate my homework!") >> > > At this point, the user hasn't warranted any reason. But you never > know. He is Hispanic, and some of the sites he visits are all in > Spanish, so there could possibly be some bad scripting he's running into.
Guest Terry R. Posted September 4, 2008 Posted September 4, 2008 Re: multiple instances of IE on reboot The date and time was 8/29/2008 11:07 PM, and on a whim, Gary S. Terhune pounded out on the keyboard: > Enjoy your weekend! > Hi Gary, I worked on the workstation today. After it has been running a week, I checked running processes and there were no IE processes running. So I launched IE, nothing, dbl-clicked again, nothing. Checked TM and two processes were running. So IE was "broke" somehow. Rather than run SFC, I installed SP3 (since it took as long) and everything works fine now. IE opens and exits properly. Thanks for taking an interest, -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Guest Terry R. Posted September 4, 2008 Posted September 4, 2008 Re: multiple instances of IE on reboot The date and time was 8/30/2008 2:33 PM, and on a whim, PA Bear [MS MVP] pounded out on the keyboard: > No scanning or utilities can detect all hijackware, Terry. Get over it. > > Terry R. wrote: >> The date and time was 8/29/2008 7:57 PM, and on a whim, Gary S. Terhune >> pounded out on the keyboard: >> >>> Well, let's see what results, if any, Terry comes up with over the >>> weekend, >>> or over several months, considering the symptoms present so slowly, and >>> maybe he'll eventually talk himself into doing some malware scanning just >>> to be thorough, ;-) >>> >> I've run scans, using four or five methods. Nothing has come up, and >> other than the IE processes, the workstation runs fine. >> >> Let you know more Wednesday, > Usually I see you helpful. I don't know where I've ruffled your feathers, but you're the one that needs to get over it. I resolved the issue and malware had nothing to do with it, as I told you in the first place. -- Terry R. ***Reply Note*** Anti-spam measures are included in my email address. Delete NOSPAM from the email address after clicking Reply.
Recommended Posts