multiple instances of IE on reboot

[Terry R.]

I have one workstation on a network, that whenever I go to reboot it, it
gives the error dialog that IEXPLORE.EXE needs to close. After clicking
on End Now multiple times, if I cancel the reboot, I can see multiple
IEXPLORE.EXE in Task Manager, often a dozen or more instances. What
would be causing this behavior, and how can I correct it? I've never
seen that on any other workstation before. I'm beginning to wonder
whether I should just make Firefox the default browser.

XP Pro sp2 w/IE 7 and all updates.

Thanks,
--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.

 

[Gary S. Terhune]

I'm tired and I'm just going to steal this from PA Bear:
--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

 

[Mick Murphy]

Hi Gary.
I have seen it on mine; and it is not Spyware, or shy of updates; XP SP3.
If you are at a site which is still downloading the page, and you cancel
download, and attempt to close IE7, it freezes.
You then bring up Task Manager, click the END NOW windows, and that is when
you get multiples in the Task Bar.
You can get out of it with Task Manger.
It is a human error, lol.

 

[PA Bear [MS MVP]]

Thanks for watching my back!

I'm tired and I'm just going to steal this from PA Bear:
--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis
log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
(in
conjuction with some other utilities). HijackThis will NOT fix anything
on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting
this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

 

[Terry R.]

The date and time was 8/28/2008 4:07 PM, and on a whim, PA Bear [MS MVP]
pounded out on the keyboard:

Thanks for watching my back!

Malware is not the issue here.

Thanks,

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.

 

[PA Bear [MS MVP]]

The date and time was 8/28/2008 4:07 PM, and on a whim, PA Bear [MS MVP]
pounded out on the keyboard:

Thanks for watching my back!

Malware is not the issue here.

Post your HijackThis log in an appropriate forum and prove it, please.

 

[Gary S. Terhune]

Haven't run into that one. I don't run IE7 on XP but I'll try to replicate
the behavior when I'm next in Vistaland.

So, it's either a problem with IE7 or one of its add-ons, or it's user error
for not giving the app time to respond? I know I have to tell people
regularly that "frozen" apps or Windows usually means it's so busy trying to
do what it's been told to do that it doesn't have the time or resources to
keep you informed. Eventually they recover. Lots of people are too quick on
the draw with Task Manager.

But that cascading stuff on the Task bar... Those represent real windows?
Real instances of IE? While I'd like to give you the benefit of the doubt,
I'd still recommend the scans, but my best guess is that it's caused by an
add-on.

 

[Gary S. Terhune]

Question: Is IE obviously open at the time you initiate a restart or
shutdown, or is the fact that it's even still loaded a surprise to you?
Because if it isn't obviously open but an instance exists in Task Manager,
then you almost certainly do have a malware infection, or something almost
the same, a bad add-on.

 

[Terry R.]

The date and time was 8/28/2008 6:51 PM, and on a whim, Gary S. Terhune
pounded out on the keyboard:

Question: Is IE obviously open at the time you initiate a restart or
shutdown, or is the fact that it's even still loaded a surprise to you?
Because if it isn't obviously open but an instance exists in Task Manager,
then you almost certainly do have a malware infection, or something almost
the same, a bad add-on.

Everything appears to be closed, so I restart the workstation. I get the
dialog that IEXPLORE.EXE needs to be closed, so I click on End Now. It
comes up again and again, so I stop the shutdown and look in Task
Manager and see there are many instances in memory. After I shut them
all down, I can restart easily.

I know there isn't any malware. I'm suspecting a bad add-on myself.
Next week when I'm onsite, I'll talk with the user and see if IE can be
run with no add-ons for a while for testing.

Thanks,

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.

 

[Gary S. Terhune]

So, why not disable all add-ons and test? (Internet Options, Programs tab,
Manage Add-Ons button.Use IE, open a few instances, shut them all down then
check Task Manager Processes tab for iexplore.exe. Another possibility that
occurs to me is that some program (I'm thinking of Office, for example) may
open a hidden instance of IE for it own inscrutable purposes and do to in
such a way as to prevent IE from being killed by Shutdown in a normal manner
(as it would kill most open apps.)

 

[Terry R.]

The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune
pounded out on the keyboard:

So, why not disable all add-ons and test? (Internet Options, Programs tab,
Manage Add-Ons button.Use IE, open a few instances, shut them all down then
check Task Manager Processes tab for iexplore.exe. Another possibility that
occurs to me is that some program (I'm thinking of Office, for example) may
open a hidden instance of IE for it own inscrutable purposes and do to in
such a way as to prevent IE from being killed by Shutdown in a normal manner
(as it would kill most open apps.)

I intend to next week. I looked at it once a couple months back,
rebooted and opened, surfed and closed IE repeatedly and couldn't
replicate it. So whatever the user is using or doing, it's causing the
problem. He also doesn't shut down or restart very often and that may
be complicating the issue.

If it was just one process of IE, it wouldn't be as big a deal. But the
times I've found it in this condition, there were 5 to 10 instances running.

I'll post back next Wednesday, which is the next time I'm onsite.

Thanks,

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.

 

[PA Bear [MS MVP]]

If it was just one process of IE, it wouldn't be as big a deal. But the

times I've found it in this condition, there were 5 to 10 instances
running.

Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that
you have hijackware problem, Terry.

 

[Gary S. Terhune]

But are there not "legitimate" components that behave just like hijackware?

 

[PA Bear [MS MVP]]

Big clue (assuming he didn't have "5 to 10 [separate] instances" open at the
time):--
~PAÞ

 

[Terry R.]

The date and time was 8/29/2008 1:17 PM, and on a whim, PA Bear [MS MVP]
pounded out on the keyboard:

Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that
you have hijackware problem, Terry.

I check the workstations regularly. I know there's not an issue. As I
stated, I can reboot, go in and out of IE repeatedly and can't replicate
it. It's only after the user has had it on for a couple weeks.

I'll report more next Wednesday.

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.

 

[Gary S. Terhune]

Well, let's see what results, if any, Terry comes up with over the weekend,
or over several months, considering the symptoms present so slowly, and
maybe he'll eventually talk himself into doing some malware scanning just to
be thorough, ;-)

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

Big clue (assuming he didn't have "5 to 10 [separate] instances" open at
the time):--
~PAÞ

But are there not "legitimate" components that behave just like
hijackware?

 

[PA Bear [MS MVP]]

And/or log the user's online activities. ("The dog ate my homework!")

Well, let's see what results, if any, Terry comes up with over the
weekend,
or over several months, considering the symptoms present so slowly, and
maybe he'll eventually talk himself into doing some malware scanning just
to
be thorough, ;-)

Big clue (assuming he didn't have "5 to 10 [separate] instances" open at
the time):

If it was just one process of IE, it wouldn't be as big a deal. But
the
times I've found it in this condition, there were 5 to 10 instances
running.

--
~PAÞ

But are there not "legitimate" components that behave just like
hijackware?


If it was just one process of IE, it wouldn't be as big a deal. But
the
times I've found it in this condition, there were 5 to 10 instances
running.

Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you
that
you have hijackware problem, Terry.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Terry R. wrote:
The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S.
Terhune
pounded out on the keyboard:

So, why not disable all add-ons and test? (Internet Options, Programs
tab,
Manage Add-Ons button.Use IE, open a few instances, shut them all
down
then
check Task Manager Processes tab for iexplore.exe. Another
possibility
that
occurs to me is that some program (I'm thinking of Office, for
example)
may
open a hidden instance of IE for it own inscrutable purposes and do
to
in
such a way as to prevent IE from being killed by Shutdown in a normal
manner (as it would kill most open apps.)


I intend to next week. I looked at it once a couple months back,
rebooted and opened, surfed and closed IE repeatedly and couldn't
replicate it. So whatever the user is using or doing, it's causing
the
problem. He also doesn't shut down or restart very often and that may
be complicating the issue.

If it was just one process of IE, it wouldn't be as big a deal. But
the
times I've found it in this condition, there were 5 to 10 instances
running.

I'll post back next Wednesday, which is the next time I'm onsite.

Thanks,

 

[Gary S. Terhune]

Yeah, that idea was lurking at the back of my mind, too, but refusing to
coalesce. I so detest any type of spyware, but then again, I'm not an
admin-type like Terry.

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

And/or log the user's online activities. ("The dog ate my homework!")

Well, let's see what results, if any, Terry comes up with over the
weekend,
or over several months, considering the symptoms present so slowly, and
maybe he'll eventually talk himself into doing some malware scanning just
to
be thorough, ;-)

Big clue (assuming he didn't have "5 to 10 [separate] instances" open at
the time):
If it was just one process of IE, it wouldn't be as big a deal. But
the
times I've found it in this condition, there were 5 to 10 instances
running.
--
~PAÞ

Gary S. Terhune wrote:
But are there not "legitimate" components that behave just like
hijackware?


If it was just one process of IE, it wouldn't be as big a deal. But
the
times I've found it in this condition, there were 5 to 10 instances
running.

Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you
that
you have hijackware problem, Terry.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Terry R. wrote:
The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S.
Terhune
pounded out on the keyboard:

So, why not disable all add-ons and test? (Internet Options,
Programs
tab,
Manage Add-Ons button.Use IE, open a few instances, shut them all
down
then
check Task Manager Processes tab for iexplore.exe. Another
possibility
that
occurs to me is that some program (I'm thinking of Office, for
example)
may
open a hidden instance of IE for it own inscrutable purposes and do
to
in
such a way as to prevent IE from being killed by Shutdown in a
normal
manner (as it would kill most open apps.)


I intend to next week. I looked at it once a couple months back,
rebooted and opened, surfed and closed IE repeatedly and couldn't
replicate it. So whatever the user is using or doing, it's causing
the
problem. He also doesn't shut down or restart very often and that
may
be complicating the issue.

If it was just one process of IE, it wouldn't be as big a deal. But
the
times I've found it in this condition, there were 5 to 10 instances
running.

I'll post back next Wednesday, which is the next time I'm onsite.

Thanks,

 

[Terry R.]

The date and time was 8/29/2008 7:57 PM, and on a whim, Gary S. Terhune
pounded out on the keyboard:

Well, let's see what results, if any, Terry comes up with over the weekend,
or over several months, considering the symptoms present so slowly, and
maybe he'll eventually talk himself into doing some malware scanning just to
be thorough, ;-)

I've run scans, using four or five methods. Nothing has come up, and
other than the IE processes, the workstation runs fine.

Let you know more Wednesday,

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.

 

[Terry R.]

The date and time was 8/29/2008 8:16 PM, and on a whim, PA Bear [MS MVP]
pounded out on the keyboard:

And/or log the user's online activities. ("The dog ate my homework!")

At this point, the user hasn't warranted any reason. But you never
know. He is Hispanic, and some of the sites he visits are all in
Spanish, so there could possibly be some bad scripting he's running into.


--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.