How to stop spawing IE windows after exiting Control Panel & Explo

[Guest]

This behavior appear recently without my having done anything intentionally
to change the behavior of Internet Explorer (IE). I have not be able to find
any information anywhere about this behavior.

This machine is a Compaq Presario 5310 desktop (1GB mem, 1.7 GHz Pentium 4)
running XP Pro SP2 with all updates, IE V7 (updated with the 10/04/2007
release), ZoneAlarm Pro, and Norton AV. Occasionally, I run BugDoctor,
RegCure, and RegistryFix to clean up the registry, etc. Regardless of the
order each finds something the previous ones miss.

Here's the scenario: I open the Control Panel or Explorer. When I exit
either one,
there is a not-so-short pause, then that window disappears, and immediately
a fresh full window (not a tab in an existing instance of IE) of IE appears
set to my homepage (about:blank). I exit that and get on with whatever else.

I'm guessing there is a switch (if TRUE on exit, spawn IE) somewhere. Where
is it? And what can I do to set it to stop the spurious spawning? Or do
whatever needs to be done to stop this time-wasting and annoying behavior?

Thanks in advance,

 

[Guest]

There is a way to set an accessibility 'style sheet' to execute a command
with the onUnLoad event. Some piece of Malware may well have done something
like that. (Trying to set themselves as a home page, and opening again on
close) At least it's worth a look at your options to find out. It's certainly
a 'malwarelike' type of behavior.

IE Tools menu, Options, General tab "Accessibility" button, uncheck 'format
documents using my style sheet'

If not there, I would run some app like Windows Defender.
Software Explorer in Windows Defender :
http://www.microsoft.com/athome/security/spyware/software/support/howto/softwareexplorer.mspx

 

[Guest]

Mark,

Thanks for the suggestions.

'Format documents using my style sheet' was already unchecked.

I downloaded and ran Windows Defender. It only found one program that was
unrelated to the problem at hand - a .msi used by various software companies
for license registration. I deleted it, but the behavior persists. WDef found
so little because I've got ZoneAlarm Pro running daily. Almost all the things
it catches are adware.

Presumably due to the layered firewalls (NetGear on router and ZoneAlarm Pro
on computer) and Norton AV scanning, I have not had a virus show up on this
system. (I'm not saying that there isn't anything there - just that nothing
has appeared as detected, quaranteened, or anything else).

On my other system that does not have ZoneAlarm Pro (but has Norton AV and
NetGear Router firewall), only one virus (Trojan Horse) has shown up, been
detected, quaranteened, and removed.

Another oddity, however, is that the ZoneAlarm firewall on my main system
has blocked tens of thousands of packets coming from various ports on my
other system. No other IP addresses show up in the firewall log. And every so
often, it blocks two packets from my system to the other system (a NetMagic
[see below] are-you-there ack pulse?).

Of course, I would like to have a functional local intranet, but have never
found the magic bullet for that - haven't figured out how to get network
printing or even file-sharing to work. I installed Network Magic in the vain
hope of trying to circumvent both of those problems, but haven't seen any
improvement in the situation except multiple print queue definitions. My
guess is that I don't know enough about how ZoneAlarm Pro is keeping me safe
from myself.

Oh, and while I'm listing the various weirdnesses that may or may not be
connected, my default USB-connected printer queue on the main system died a
few days ago - can't get it to respond when directly connected to the system
or "indirectly" connected through a USB hub and an USB A/B switch, regardless
of deleting and rebuilding from the installation CD provided by the mfg (HP).
Other print queues are fine, and the HP printer runs fine on the other system
regardless of the direct or "indirect" hub/A/B-switch connection. For what
it's worth, I'm shocked by the absence of print job debugging available from
the Windows Print Queue "Manager" - are those raucous guffaws I hear? "What a
rube!" in a Bugs Bunny voice? Sigh . . . .

I'd like to know more about locating and accessing the module(s) that
define(s) onUnload events. I'm guessing that that is a source code issue, and
therefore not available to folks like me, but I thought I'd ask anyway.

Maybe there's something that jumps out of the morass outlined above. Thanks
in advance for your patience.

 

[Guest]

Since you are behind the NetGear protection, it would definately be OK to
drop your software firewall long enough to see if it alters any of your
problems.
--
helpful? click "Yes" button. Voting helps the web interface.
http://www.microsoft.com/windowsxp/...g=microsoft.public.windowsxp.help_and_support
Mark L. Ferguson

Mark,

Thanks for the suggestions.

'Format documents using my style sheet' was already unchecked.

I downloaded and ran Windows Defender. It only found one program that was
unrelated to the problem at hand - a .msi used by various software companies
for license registration. I deleted it, but the behavior persists. WDef found
so little because I've got ZoneAlarm Pro running daily. Almost all the things
it catches are adware.

Presumably due to the layered firewalls (NetGear on router and ZoneAlarm Pro
on computer) and Norton AV scanning, I have not had a virus show up on this
system. (I'm not saying that there isn't anything there - just that nothing
has appeared as detected, quaranteened, or anything else).

On my other system that does not have ZoneAlarm Pro (but has Norton AV and
NetGear Router firewall), only one virus (Trojan Horse) has shown up, been
detected, quaranteened, and removed.

Another oddity, however, is that the ZoneAlarm firewall on my main system
has blocked tens of thousands of packets coming from various ports on my
other system. No other IP addresses show up in the firewall log. And every so
often, it blocks two packets from my system to the other system (a NetMagic
[see below] are-you-there ack pulse?).

Of course, I would like to have a functional local intranet, but have never
found the magic bullet for that - haven't figured out how to get network
printing or even file-sharing to work. I installed Network Magic in the vain
hope of trying to circumvent both of those problems, but haven't seen any
improvement in the situation except multiple print queue definitions. My
guess is that I don't know enough about how ZoneAlarm Pro is keeping me safe
from myself.

Oh, and while I'm listing the various weirdnesses that may or may not be
connected, my default USB-connected printer queue on the main system died a
few days ago - can't get it to respond when directly connected to the system
or "indirectly" connected through a USB hub and an USB A/B switch, regardless
of deleting and rebuilding from the installation CD provided by the mfg (HP).
Other print queues are fine, and the HP printer runs fine on the other system
regardless of the direct or "indirect" hub/A/B-switch connection. For what
it's worth, I'm shocked by the absence of print job debugging available from
the Windows Print Queue "Manager" - are those raucous guffaws I hear? "What a
rube!" in a Bugs Bunny voice? Sigh . . . .

I'd like to know more about locating and accessing the module(s) that
define(s) onUnload events. I'm guessing that that is a source code issue, and
therefore not available to folks like me, but I thought I'd ask anyway.

Maybe there's something that jumps out of the morass outlined above. Thanks
in advance for your patience.
--
W.

There is a way to set an accessibility 'style sheet' to execute a command
with the onUnLoad event. Some piece of Malware may well have done something
like that. (Trying to set themselves as a home page, and opening again on
close) At least it's worth a look at your options to find out. It's certainly
a 'malwarelike' type of behavior.

IE Tools menu, Options, General tab "Accessibility" button, uncheck 'format
documents using my style sheet'

If not there, I would run some app like Windows Defender.
Software Explorer in Windows Defender :
http://www.microsoft.com/athome/security/spyware/software/support/howto/softwareexplorer.mspx