Need help in finding why IE6 fails - how to see what's loading

[Steve Howard]

Hello,

I've asked many times how to debug IE6 in these groups but
so far none of the suggestions have resolved my problem.

As I've written before, IE6 starts then ends almost immediately
with no windows or messages of any kinds. IE6 does show as
a process but there is no other evidence IE6 is running
otherwise.

What I hoping far is a suggestion from someone so I can
see what IE6 is loading and doing while it is trying to
launch. My hope is I will see the module or something
at which IE fails at or tries to load last. IE6 will
run ok under a different user-ID therefore I feel something
in my default user-id, such as a plug-in etc.. is causing
IE6 to terminate without showing anything. I have already
tried all the virus cleaning, spyware removal tools but
to no avail. Additionally I've looked at the event viewer
in Win XP but have not seen anything that would lead me
to my problem.

I would rather find the problem that starting over in a
new user profile as I have a large core of installed
programs, tools, compilers, etc. and secondly I occasionally
run into this problem at work (I'm a Systems Programmer).

Can someone please tell me of a method I can use in
Windows XP Pro. to see what IE6 is doing and
trying to load which I hope may lead me to my problem?

Thanks,

Steve

 

[PA Bear]

HijackThis will show you running processes and more:
http://forum.mvps.org/downloads/hijackthis.exe. Do *not* go "fixing" things
without expert advice! Post your log to an appropriate forum, not here,
please.

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

 

[Frank Saunders, MS-MVP IE/OE]

Hello,

I've asked many times how to debug IE6 in these groups but
so far none of the suggestions have resolved my problem.

As I've written before, IE6 starts then ends almost immediately
with no windows or messages of any kinds. IE6 does show as
a process but there is no other evidence IE6 is running
otherwise.

What I hoping far is a suggestion from someone so I can
see what IE6 is loading and doing while it is trying to
launch. My hope is I will see the module or something
at which IE fails at or tries to load last. IE6 will
run ok under a different user-ID therefore I feel something
in my default user-id, such as a plug-in etc.. is causing
IE6 to terminate without showing anything. I have already
tried all the virus cleaning, spyware removal tools but
to no avail. Additionally I've looked at the event viewer
in Win XP but have not seen anything that would lead me
to my problem.

I would rather find the problem that starting over in a
new user profile as I have a large core of installed
programs, tools, compilers, etc. and secondly I occasionally
run into this problem at work (I'm a Systems Programmer).

Can someone please tell me of a method I can use in
Windows XP Pro. to see what IE6 is doing and
trying to load which I hope may lead me to my problem?

Thanks,

Steve

First eliminate any spyware.
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

CAUTION!!!!! Removing some spyware can damage the Winsock stact. Before
you try to remove spyware using any of these programs , download a copy of
LSP-Fix - a free program to repair damaged Winsock 2 stacks (all Windows
versions)
http://www.cexx.org/lspfix.htm
Winsockfix for W95, W98, ME, NT, 2000, XP
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257
WinXP:
Get WinSockxpFix
http://www.spychecker.com/program/winsockxpfix.html
How to Reset Internet Protocol (TCP/IP) in Windows XP
http://support.microsoft.com/kb/299357
In WinXP SP2: You can fix Winsock by going to Start | Run and typing
CMD
In the command window type
netsh winsock reset

See
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated with the program's update function
before every use, even when just downloaded. There's also a lot more to do
than just those two programs. CWShredder is also available here:
http://www.intermute.com/products/cwshredder
**Post your HijackThis log to
http://forums.spywareinfo.com/
http://forums.tomcoyote.org/
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/ or the Spyware forum at
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.

See this link for information about malware:
http://arstechnica.com/articles/paedia/malware.ars

If nothing there helps, please post back to this thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[David Candy]

Type

ntsd "%programfiles%\internet explorer\iexplore"

It will pause after loading and before exiting (known as a breakpoint). Type g to restart program execution. Type Ctrl + C in the debugger screen to pause (or break in tech talk).

You may need symbols (the words the programmers used when writing it) loaded to get more of a sense of what it's doing. SP2 symbols are on the SP2 security CD. NTSD will tell you what configuration changes you need to make when you start it and it says can't find symbols.

You can also download GUI versions of ntsd. http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

You'll still need (maybe) symbols.

Also get filemon and regmon from www.sysinternals.com. This lists file and registry activity and the last entry or failures (many failures are normal and aren't real failures, many registry keys are only there if XP is using a value different from the default) may help pinpoint.

You have looked through event viewer for error messages?

 

[David Candy]

The symbols a a 1/4 gig download if you don't have SP2 Security Update CD.

--
----------------------------------------------------------

"David Candy" <.> wrote in message Type

ntsd "%programfiles%\internet explorer\iexplore"

It will pause after loading and before exiting (known as a breakpoint). Type g to restart program execution. Type Ctrl + C in the debugger screen to pause (or break in tech talk).

You may need symbols (the words the programmers used when writing it) loaded to get more of a sense of what it's doing. SP2 symbols are on the SP2 security CD. NTSD will tell you what configuration changes you need to make when you start it and it says can't find symbols.

You can also download GUI versions of ntsd. http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

You'll still need (maybe) symbols.

Also get filemon and regmon from www.sysinternals.com. This lists file and registry activity and the last entry or failures (many failures are normal and aren't real failures, many registry keys are only there if XP is using a value different from the default) may help pinpoint.

You have looked through event viewer for error messages?

 

[Steve Howard]

The symbols a a 1/4 gig download if you don't have SP2 Security Update CD.

--
----------------------------------------------------------

"David Candy" <.> wrote in message Type

ntsd "%programfiles%\internet explorer\iexplore"

It will pause after loading and before exiting (known as a breakpoint). Type g to restart program execution. Type Ctrl + C in the debugger screen to pause (or break in tech talk).

You may need symbols (the words the programmers used when writing it) loaded to get more of a sense of what it's doing. SP2 symbols are on the SP2 security CD. NTSD will tell you what configuration changes you need to make when you start it and it says can't find symbols.

You can also download GUI versions of ntsd. http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

You'll still need (maybe) symbols.

Also get filemon and regmon from www.sysinternals.com. This lists file and registry activity and the last entry or failures (many failures are normal and aren't real failures, many registry keys are only there if XP is using a value different from the default) may help pinpoint.

You have looked through event viewer for error messages?

David.

I've downloaded the Debugger & symbols. I also have been using the logger
to try to see what's going on. I'm not familar with this logger & debugger
so I don't know how to set up the watch(s), breakpoints, etc.. I need to
find last things done/loaded in hope of finding what may be causing IE to
load without issuing any messages or displaying any windows. I do know I
can find iexplore.exe in processes and IE will run OK under another
User-ID. Any suggestions on using the debugger/logger to find my problem
is greatly appreciated.

Thanks,

Steve

 

[David Candy]

NTSD list the modules as they load. Try pressing Ctrl + C when IE is hiding. For Regmon/filemon use Edit menu - Filter and use iexplore as the filter, its last file access/ registry access is at the bottom. Can explorer view the web (Explorer/iexplore can both browse web or local computer - type a web address in Explorer's address bar)?

I wouldn't expect ntsd to be that useful to a non C programmer but it may give you hints on where the problem lies. And you seemed desperate for something new to try.

What I would do is this

Type in a command prompt (type cmd in Start Run), then type
tasklist /m /fi "imagename eq iexplore.exe"

Then one by one research each of the modules that are loaded. Do the following with each module

1. By finding the file and right clicking it, Properties, Version

2. Searching for the name on google, I've been complaining to google for a while on how they've let log files (similar to tasklist's) take over their index. After you search you can complain too. Once I would have searched for you but not anymore due to a notorious spamming company called HiJack This. Spamming is also a term for manipulating search engine results. Have fun and complain to the help people at google (they'll actually reply to you) not feedback.

3. Most modules are Microsoft's. You can look up MS files here (and avoid google)
http://support.microsoft.com/dllhelp/

Choose By File Only on this page. Use the full filename (shell32.dll not just shell32).

 

[David Candy]

You are looking for a file that doesn't belong.

--
----------------------------------------------------------

"David Candy" <.> wrote in message NTSD list the modules as they load. Try pressing Ctrl + C when IE is hiding. For Regmon/filemon use Edit menu - Filter and use iexplore as the filter, its last file access/ registry access is at the bottom. Can explorer view the web (Explorer/iexplore can both browse web or local computer - type a web address in Explorer's address bar)?

I wouldn't expect ntsd to be that useful to a non C programmer but it may give you hints on where the problem lies. And you seemed desperate for something new to try.

What I would do is this

Type in a command prompt (type cmd in Start Run), then type
tasklist /m /fi "imagename eq iexplore.exe"

Then one by one research each of the modules that are loaded. Do the following with each module

1. By finding the file and right clicking it, Properties, Version

2. Searching for the name on google, I've been complaining to google for a while on how they've let log files (similar to tasklist's) take over their index. After you search you can complain too. Once I would have searched for you but not anymore due to a notorious spamming company called HiJack This. Spamming is also a term for manipulating search engine results. Have fun and complain to the help people at google (they'll actually reply to you) not feedback.

3. Most modules are Microsoft's. You can look up MS files here (and avoid google)
http://support.microsoft.com/dllhelp/

Choose By File Only on this page. Use the full filename (shell32.dll not just shell32).