multiple instances of IE on reboot

  • Thread starter Thread starter Terry R.
  • Start date Start date
T

Terry R.

Guest
I have one workstation on a network, that whenever I go to reboot it, it
gives the error dialog that IEXPLORE.EXE needs to close. After clicking
on End Now multiple times, if I cancel the reboot, I can see multiple
IEXPLORE.EXE in Task Manager, often a dozen or more instances. What
would be causing this behavior, and how can I correct it? I've never
seen that on any other workstation before. I'm beginning to wonder
whether I should just make Firefox the default browser.

XP Pro sp2 w/IE 7 and all updates.

Thanks,
--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

I'm tired and I'm just going to steal this from PA Bear:
--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/


"Terry R." <F1Com@NOSPAMpobox.com> wrote in message
news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl...
>I have one workstation on a network, that whenever I go to reboot it, it
>gives the error dialog that IEXPLORE.EXE needs to close. After clicking on
>End Now multiple times, if I cancel the reboot, I can see multiple
>IEXPLORE.EXE in Task Manager, often a dozen or more instances. What would
>be causing this behavior, and how can I correct it? I've never seen that
>on any other workstation before. I'm beginning to wonder whether I should
>just make Firefox the default browser.
>
> XP Pro sp2 w/IE 7 and all updates.
>
> Thanks,
> --
> Terry R.
>
> ***Reply Note***
> Anti-spam measures are included in my email address.
> Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

Hi Gary.
I have seen it on mine; and it is not Spyware, or shy of updates; XP SP3.
If you are at a site which is still downloading the page, and you cancel
download, and attempt to close IE7, it freezes.
You then bring up Task Manager, click the END NOW windows, and that is when
you get multiples in the Task Bar.
You can get out of it with Task Manger.
It is a human error, lol.
--
Mick Murphy - Qld - Australia


"Gary S. Terhune" wrote:

> I'm tired and I'm just going to steal this from PA Bear:
> --
> Gary S. Terhune
> MS-MVP Shell/User
> http://grystmill.com
>
> Unexplained computer behavior may be caused by deceptive software
> http://support.microsoft.com/kb/827315
>
> Run a /thorough/ check for hijackware, including posting your hijackthis log
> to an appropriate forum.
>
> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
> http://aumha.org/a/quickfix.htm
> http://aumha.net/viewtopic.php?t=5878
> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine2.blogspot.com/
> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>
> When all else fails, HijackThis v2.0.2
> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
> conjuction with some other utilities). HijackThis will NOT fix anything on
> its own, but it will help you to both identify and remove any
> hijackware/spyware with assistance from an expert. **Post your log to
> http://aumha.net/viewforum.php?f=30,
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://castlecops.com/forum67.html, or other appropriate forums for review
> by an expert in such matters, not here.**
>
> If the procedures look too complex - and there is no shame in admitting this
> isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
>
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
>
> "Terry R." <F1Com@NOSPAMpobox.com> wrote in message
> news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl...
> >I have one workstation on a network, that whenever I go to reboot it, it
> >gives the error dialog that IEXPLORE.EXE needs to close. After clicking on
> >End Now multiple times, if I cancel the reboot, I can see multiple
> >IEXPLORE.EXE in Task Manager, often a dozen or more instances. What would
> >be causing this behavior, and how can I correct it? I've never seen that
> >on any other workstation before. I'm beginning to wonder whether I should
> >just make Firefox the default browser.
> >
> > XP Pro sp2 w/IE 7 and all updates.
> >
> > Thanks,
> > --
> > Terry R.
> >
> > ***Reply Note***
> > Anti-spam measures are included in my email address.
> > Delete NOSPAM from the email address after clicking Reply.
>
>
>
 
Re: multiple instances of IE on reboot

Thanks for watching my back!

Gary S. Terhune wrote:
> I'm tired and I'm just going to steal this from PA Bear:
> --
> Gary S. Terhune
> MS-MVP Shell/User
> http://grystmill.com
>
> Unexplained computer behavior may be caused by deceptive software
> http://support.microsoft.com/kb/827315
>
> Run a /thorough/ check for hijackware, including posting your hijackthis
> log
> to an appropriate forum.
>
> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
> http://aumha.org/a/quickfix.htm
> http://aumha.net/viewtopic.php?t=5878
> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine2.blogspot.com/
> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>
> When all else fails, HijackThis v2.0.2
> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
> (in
> conjuction with some other utilities). HijackThis will NOT fix anything
> on
> its own, but it will help you to both identify and remove any
> hijackware/spyware with assistance from an expert. **Post your log to
> http://aumha.net/viewforum.php?f=30,
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://castlecops.com/forum67.html, or other appropriate forums for review
> by an expert in such matters, not here.**
>
> If the procedures look too complex - and there is no shame in admitting
> this
> isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
>
>
> "Terry R." <F1Com@NOSPAMpobox.com> wrote in message
> news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl...
>> I have one workstation on a network, that whenever I go to reboot it, it
>> gives the error dialog that IEXPLORE.EXE needs to close. After clicking
>> on
>> End Now multiple times, if I cancel the reboot, I can see multiple
>> IEXPLORE.EXE in Task Manager, often a dozen or more instances. What
>> would
>> be causing this behavior, and how can I correct it? I've never seen that
>> on any other workstation before. I'm beginning to wonder whether I
>> should
>> just make Firefox the default browser.
>>
>> XP Pro sp2 w/IE 7 and all updates.
>>
>> Thanks,
>> --
>> Terry R.
>>
>> ***Reply Note***
>> Anti-spam measures are included in my email address.
>> Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

The date and time was 8/28/2008 4:07 PM, and on a whim, PA Bear [MS MVP]
pounded out on the keyboard:

> Thanks for watching my back!
>
> Gary S. Terhune wrote:
>> I'm tired and I'm just going to steal this from PA Bear:
>> --
>> Gary S. Terhune
>> MS-MVP Shell/User
>> http://grystmill.com
>>
>> Unexplained computer behavior may be caused by deceptive software
>> http://support.microsoft.com/kb/827315
>>

Malware is not the issue here.

Thanks,

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

Terry R. wrote:
> The date and time was 8/28/2008 4:07 PM, and on a whim, PA Bear [MS MVP]
> pounded out on the keyboard:
>
>> Thanks for watching my back!
>>
>> Gary S. Terhune wrote:
>>> I'm tired and I'm just going to steal this from PA Bear:
>>> --
>>> Gary S. Terhune
>>> MS-MVP Shell/User
>>> http://grystmill.com
>>>
>>> Unexplained computer behavior may be caused by deceptive software
>>> http://support.microsoft.com/kb/827315
>>>
>
> Malware is not the issue here.

Post your HijackThis log in an appropriate forum and prove it, please.
 
Re: multiple instances of IE on reboot

Haven't run into that one. I don't run IE7 on XP but I'll try to replicate
the behavior when I'm next in Vistaland.

So, it's either a problem with IE7 or one of its add-ons, or it's user error
for not giving the app time to respond? I know I have to tell people
regularly that "frozen" apps or Windows usually means it's so busy trying to
do what it's been told to do that it doesn't have the time or resources to
keep you informed. Eventually they recover. Lots of people are too quick on
the draw with Task Manager.

But that cascading stuff on the Task bar... Those represent real windows?
Real instances of IE? While I'd like to give you the benefit of the doubt,
I'd still recommend the scans, but my best guess is that it's caused by an
add-on.

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"Mick Murphy" <MickMurphy@discussions.microsoft.com> wrote in message
news:15555B87-0498-4C79-8F36-79970B2D7FF8@microsoft.com...
> Hi Gary.
> I have seen it on mine; and it is not Spyware, or shy of updates; XP SP3.
> If you are at a site which is still downloading the page, and you cancel
> download, and attempt to close IE7, it freezes.
> You then bring up Task Manager, click the END NOW windows, and that is
> when
> you get multiples in the Task Bar.
> You can get out of it with Task Manger.
> It is a human error, lol.
> --
> Mick Murphy - Qld - Australia
>
>
> "Gary S. Terhune" wrote:
>
>> I'm tired and I'm just going to steal this from PA Bear:
>> --
>> Gary S. Terhune
>> MS-MVP Shell/User
>> http://grystmill.com
>>
>> Unexplained computer behavior may be caused by deceptive software
>> http://support.microsoft.com/kb/827315
>>
>> Run a /thorough/ check for hijackware, including posting your hijackthis
>> log
>> to an appropriate forum.
>>
>> Checking for/Help with Hijackware
>> http://aumha.org/a/parasite.htm
>> http://aumha.org/a/quickfix.htm
>> http://aumha.net/viewtopic.php?t=5878
>> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://defendingyourmachine2.blogspot.com/
>> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>>
>> When all else fails, HijackThis v2.0.2
>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
>> (in
>> conjuction with some other utilities). HijackThis will NOT fix anything
>> on
>> its own, but it will help you to both identify and remove any
>> hijackware/spyware with assistance from an expert. **Post your log to
>> http://aumha.net/viewforum.php?f=30,
>> http://forums.spybot.info/forumdisplay.php?f=22,
>> http://castlecops.com/forum67.html, or other appropriate forums for
>> review
>> by an expert in such matters, not here.**
>>
>> If the procedures look too complex - and there is no shame in admitting
>> this
>> isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair
>> shop.
>>
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>>
>> "Terry R." <F1Com@NOSPAMpobox.com> wrote in message
>> news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl...
>> >I have one workstation on a network, that whenever I go to reboot it, it
>> >gives the error dialog that IEXPLORE.EXE needs to close. After clicking
>> >on
>> >End Now multiple times, if I cancel the reboot, I can see multiple
>> >IEXPLORE.EXE in Task Manager, often a dozen or more instances. What
>> >would
>> >be causing this behavior, and how can I correct it? I've never seen
>> >that
>> >on any other workstation before. I'm beginning to wonder whether I
>> >should
>> >just make Firefox the default browser.
>> >
>> > XP Pro sp2 w/IE 7 and all updates.
>> >
>> > Thanks,
>> > --
>> > Terry R.
>> >
>> > ***Reply Note***
>> > Anti-spam measures are included in my email address.
>> > Delete NOSPAM from the email address after clicking Reply.
>>
>>
>>
 
Re: multiple instances of IE on reboot

Question: Is IE obviously open at the time you initiate a restart or
shutdown, or is the fact that it's even still loaded a surprise to you?
Because if it isn't obviously open but an instance exists in Task Manager,
then you almost certainly do have a malware infection, or something almost
the same, a bad add-on.

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"Terry R." <F1Com@NOSPAMpobox.com> wrote in message
news:%23SD2pbMCJHA.4576@TK2MSFTNGP05.phx.gbl...
>I have one workstation on a network, that whenever I go to reboot it, it
>gives the error dialog that IEXPLORE.EXE needs to close. After clicking on
>End Now multiple times, if I cancel the reboot, I can see multiple
>IEXPLORE.EXE in Task Manager, often a dozen or more instances. What would
>be causing this behavior, and how can I correct it? I've never seen that
>on any other workstation before. I'm beginning to wonder whether I should
>just make Firefox the default browser.
>
> XP Pro sp2 w/IE 7 and all updates.
>
> Thanks,
> --
> Terry R.
>
> ***Reply Note***
> Anti-spam measures are included in my email address.
> Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

The date and time was 8/28/2008 6:51 PM, and on a whim, Gary S. Terhune
pounded out on the keyboard:

> Question: Is IE obviously open at the time you initiate a restart or
> shutdown, or is the fact that it's even still loaded a surprise to you?
> Because if it isn't obviously open but an instance exists in Task Manager,
> then you almost certainly do have a malware infection, or something almost
> the same, a bad add-on.
>

Everything appears to be closed, so I restart the workstation. I get the
dialog that IEXPLORE.EXE needs to be closed, so I click on End Now. It
comes up again and again, so I stop the shutdown and look in Task
Manager and see there are many instances in memory. After I shut them
all down, I can restart easily.

I know there isn't any malware. I'm suspecting a bad add-on myself.
Next week when I'm onsite, I'll talk with the user and see if IE can be
run with no add-ons for a while for testing.

Thanks,

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

So, why not disable all add-ons and test? (Internet Options, Programs tab,
Manage Add-Ons button.Use IE, open a few instances, shut them all down then
check Task Manager Processes tab for iexplore.exe. Another possibility that
occurs to me is that some program (I'm thinking of Office, for example) may
open a hidden instance of IE for it own inscrutable purposes and do to in
such a way as to prevent IE from being killed by Shutdown in a normal manner
(as it would kill most open apps.)

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"Terry R." <F1Com@NOSPAMpobox.com> wrote in message
news:Oh95B4YCJHA.4368@TK2MSFTNGP06.phx.gbl...
> The date and time was 8/28/2008 6:51 PM, and on a whim, Gary S. Terhune
> pounded out on the keyboard:
>
>> Question: Is IE obviously open at the time you initiate a restart or
>> shutdown, or is the fact that it's even still loaded a surprise to you?
>> Because if it isn't obviously open but an instance exists in Task
>> Manager, then you almost certainly do have a malware infection, or
>> something almost the same, a bad add-on.
>>
>
> Everything appears to be closed, so I restart the workstation. I get the
> dialog that IEXPLORE.EXE needs to be closed, so I click on End Now. It
> comes up again and again, so I stop the shutdown and look in Task Manager
> and see there are many instances in memory. After I shut them all down, I
> can restart easily.
>
> I know there isn't any malware. I'm suspecting a bad add-on myself. Next
> week when I'm onsite, I'll talk with the user and see if IE can be run
> with no add-ons for a while for testing.
>
> Thanks,
>
> --
> Terry R.
>
> ***Reply Note***
> Anti-spam measures are included in my email address.
> Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune
pounded out on the keyboard:

> So, why not disable all add-ons and test? (Internet Options, Programs tab,
> Manage Add-Ons button.Use IE, open a few instances, shut them all down then
> check Task Manager Processes tab for iexplore.exe. Another possibility that
> occurs to me is that some program (I'm thinking of Office, for example) may
> open a hidden instance of IE for it own inscrutable purposes and do to in
> such a way as to prevent IE from being killed by Shutdown in a normal manner
> (as it would kill most open apps.)
>

I intend to next week. I looked at it once a couple months back,
rebooted and opened, surfed and closed IE repeatedly and couldn't
replicate it. So whatever the user is using or doing, it's causing the
problem. He also doesn't shut down or restart very often and that may
be complicating the issue.

If it was just one process of IE, it wouldn't be as big a deal. But the
times I've found it in this condition, there were 5 to 10 instances running.

I'll post back next Wednesday, which is the next time I'm onsite.

Thanks,

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

> If it was just one process of IE, it wouldn't be as big a deal. But the
> times I've found it in this condition, there were 5 to 10 instances
> running.

Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that
you have hijackware problem, Terry.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Terry R. wrote:
> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune
> pounded out on the keyboard:
>
>> So, why not disable all add-ons and test? (Internet Options, Programs
>> tab,
>> Manage Add-Ons button.Use IE, open a few instances, shut them all down
>> then
>> check Task Manager Processes tab for iexplore.exe. Another possibility
>> that
>> occurs to me is that some program (I'm thinking of Office, for example)
>> may
>> open a hidden instance of IE for it own inscrutable purposes and do to in
>> such a way as to prevent IE from being killed by Shutdown in a normal
>> manner (as it would kill most open apps.)
>>
>
> I intend to next week. I looked at it once a couple months back,
> rebooted and opened, surfed and closed IE repeatedly and couldn't
> replicate it. So whatever the user is using or doing, it's causing the
> problem. He also doesn't shut down or restart very often and that may
> be complicating the issue.
>
> If it was just one process of IE, it wouldn't be as big a deal. But the
> times I've found it in this condition, there were 5 to 10 instances
> running.
>
> I'll post back next Wednesday, which is the next time I'm onsite.
>
> Thanks,
 
Re: multiple instances of IE on reboot

But are there not "legitimate" components that behave just like hijackware?

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl...
>> If it was just one process of IE, it wouldn't be as big a deal. But the
>> times I've found it in this condition, there were 5 to 10 instances
>> running.
>
> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that
> you have hijackware problem, Terry.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> Terry R. wrote:
>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune
>> pounded out on the keyboard:
>>
>>> So, why not disable all add-ons and test? (Internet Options, Programs
>>> tab,
>>> Manage Add-Ons button.Use IE, open a few instances, shut them all down
>>> then
>>> check Task Manager Processes tab for iexplore.exe. Another possibility
>>> that
>>> occurs to me is that some program (I'm thinking of Office, for example)
>>> may
>>> open a hidden instance of IE for it own inscrutable purposes and do to
>>> in
>>> such a way as to prevent IE from being killed by Shutdown in a normal
>>> manner (as it would kill most open apps.)
>>>
>>
>> I intend to next week. I looked at it once a couple months back,
>> rebooted and opened, surfed and closed IE repeatedly and couldn't
>> replicate it. So whatever the user is using or doing, it's causing the
>> problem. He also doesn't shut down or restart very often and that may
>> be complicating the issue.
>>
>> If it was just one process of IE, it wouldn't be as big a deal. But the
>> times I've found it in this condition, there were 5 to 10 instances
>> running.
>>
>> I'll post back next Wednesday, which is the next time I'm onsite.
>>
>> Thanks,
>
 
Re: multiple instances of IE on reboot

Big clue (assuming he didn't have "5 to 10 [separate] instances" open at the
time):
>> If it was just one process of IE, it wouldn't be as big a deal. But the
>> times I've found it in this condition, there were 5 to 10 instances
>> running.
--
~PAÞ

Gary S. Terhune wrote:
> But are there not "legitimate" components that behave just like
> hijackware?
>
>
> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
> news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl...
>>> If it was just one process of IE, it wouldn't be as big a deal. But the
>>> times I've found it in this condition, there were 5 to 10 instances
>>> running.
>>
>> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that
>> you have hijackware problem, Terry.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>> Terry R. wrote:
>>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S. Terhune
>>> pounded out on the keyboard:
>>>
>>>> So, why not disable all add-ons and test? (Internet Options, Programs
>>>> tab,
>>>> Manage Add-Ons button.Use IE, open a few instances, shut them all down
>>>> then
>>>> check Task Manager Processes tab for iexplore.exe. Another possibility
>>>> that
>>>> occurs to me is that some program (I'm thinking of Office, for example)
>>>> may
>>>> open a hidden instance of IE for it own inscrutable purposes and do to
>>>> in
>>>> such a way as to prevent IE from being killed by Shutdown in a normal
>>>> manner (as it would kill most open apps.)
>>>>
>>>
>>> I intend to next week. I looked at it once a couple months back,
>>> rebooted and opened, surfed and closed IE repeatedly and couldn't
>>> replicate it. So whatever the user is using or doing, it's causing the
>>> problem. He also doesn't shut down or restart very often and that may
>>> be complicating the issue.
>>>
>>> If it was just one process of IE, it wouldn't be as big a deal. But the
>>> times I've found it in this condition, there were 5 to 10 instances
>>> running.
>>>
>>> I'll post back next Wednesday, which is the next time I'm onsite.
>>>
>>> Thanks,
 
Re: multiple instances of IE on reboot

The date and time was 8/29/2008 1:17 PM, and on a whim, PA Bear [MS MVP]
pounded out on the keyboard:

>> If it was just one process of IE, it wouldn't be as big a deal. But the
>> times I've found it in this condition, there were 5 to 10 instances
>> running.
>
> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you that
> you have hijackware problem, Terry.

I check the workstations regularly. I know there's not an issue. As I
stated, I can reboot, go in and out of IE repeatedly and can't replicate
it. It's only after the user has had it on for a couple weeks.

I'll report more next Wednesday.

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

Well, let's see what results, if any, Terry comes up with over the weekend,
or over several months, considering the symptoms present so slowly, and
maybe he'll eventually talk himself into doing some malware scanning just to
be thorough, ;-)

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
news:%23GenPRiCJHA.4576@TK2MSFTNGP05.phx.gbl...
> Big clue (assuming he didn't have "5 to 10 [separate] instances" open at
> the time):
>>> If it was just one process of IE, it wouldn't be as big a deal. But the
>>> times I've found it in this condition, there were 5 to 10 instances
>>> running.
> --
> ~PAÞ
>
> Gary S. Terhune wrote:
>> But are there not "legitimate" components that behave just like
>> hijackware?
>>
>>
>> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
>> news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl...
>>>> If it was just one process of IE, it wouldn't be as big a deal. But
>>>> the
>>>> times I've found it in this condition, there were 5 to 10 instances
>>>> running.
>>>
>>> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you
>>> that
>>> you have hijackware problem, Terry.
>>> --
>>> ~Robear Dyer (PA Bear)
>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>> AumHa VSOP & Admin http://aumha.net
>>> DTS-L http://dts-l.net/
>>>
>>> Terry R. wrote:
>>>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S.
>>>> Terhune
>>>> pounded out on the keyboard:
>>>>
>>>>> So, why not disable all add-ons and test? (Internet Options, Programs
>>>>> tab,
>>>>> Manage Add-Ons button.Use IE, open a few instances, shut them all down
>>>>> then
>>>>> check Task Manager Processes tab for iexplore.exe. Another possibility
>>>>> that
>>>>> occurs to me is that some program (I'm thinking of Office, for
>>>>> example)
>>>>> may
>>>>> open a hidden instance of IE for it own inscrutable purposes and do to
>>>>> in
>>>>> such a way as to prevent IE from being killed by Shutdown in a normal
>>>>> manner (as it would kill most open apps.)
>>>>>
>>>>
>>>> I intend to next week. I looked at it once a couple months back,
>>>> rebooted and opened, surfed and closed IE repeatedly and couldn't
>>>> replicate it. So whatever the user is using or doing, it's causing the
>>>> problem. He also doesn't shut down or restart very often and that may
>>>> be complicating the issue.
>>>>
>>>> If it was just one process of IE, it wouldn't be as big a deal. But
>>>> the
>>>> times I've found it in this condition, there were 5 to 10 instances
>>>> running.
>>>>
>>>> I'll post back next Wednesday, which is the next time I'm onsite.
>>>>
>>>> Thanks,
>
 
Re: multiple instances of IE on reboot

And/or log the user's online activities. ("The dog ate my homework!")

Gary S. Terhune wrote:
> Well, let's see what results, if any, Terry comes up with over the
> weekend,
> or over several months, considering the symptoms present so slowly, and
> maybe he'll eventually talk himself into doing some malware scanning just
> to
> be thorough, ;-)
>
>
> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
> news:%23GenPRiCJHA.4576@TK2MSFTNGP05.phx.gbl...
>> Big clue (assuming he didn't have "5 to 10 [separate] instances" open at
>> the time):
>>>> If it was just one process of IE, it wouldn't be as big a deal. But
>>>> the
>>>> times I've found it in this condition, there were 5 to 10 instances
>>>> running.
>> --
>> ~PAÞ
>>
>> Gary S. Terhune wrote:
>>> But are there not "legitimate" components that behave just like
>>> hijackware?
>>>
>>>
>>> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
>>> news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl...
>>>>> If it was just one process of IE, it wouldn't be as big a deal. But
>>>>> the
>>>>> times I've found it in this condition, there were 5 to 10 instances
>>>>> running.
>>>>
>>>> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you
>>>> that
>>>> you have hijackware problem, Terry.
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>> AumHa VSOP & Admin http://aumha.net
>>>> DTS-L http://dts-l.net/
>>>>
>>>> Terry R. wrote:
>>>>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S.
>>>>> Terhune
>>>>> pounded out on the keyboard:
>>>>>
>>>>>> So, why not disable all add-ons and test? (Internet Options, Programs
>>>>>> tab,
>>>>>> Manage Add-Ons button.Use IE, open a few instances, shut them all
>>>>>> down
>>>>>> then
>>>>>> check Task Manager Processes tab for iexplore.exe. Another
>>>>>> possibility
>>>>>> that
>>>>>> occurs to me is that some program (I'm thinking of Office, for
>>>>>> example)
>>>>>> may
>>>>>> open a hidden instance of IE for it own inscrutable purposes and do
>>>>>> to
>>>>>> in
>>>>>> such a way as to prevent IE from being killed by Shutdown in a normal
>>>>>> manner (as it would kill most open apps.)
>>>>>>
>>>>>
>>>>> I intend to next week. I looked at it once a couple months back,
>>>>> rebooted and opened, surfed and closed IE repeatedly and couldn't
>>>>> replicate it. So whatever the user is using or doing, it's causing
>>>>> the
>>>>> problem. He also doesn't shut down or restart very often and that may
>>>>> be complicating the issue.
>>>>>
>>>>> If it was just one process of IE, it wouldn't be as big a deal. But
>>>>> the
>>>>> times I've found it in this condition, there were 5 to 10 instances
>>>>> running.
>>>>>
>>>>> I'll post back next Wednesday, which is the next time I'm onsite.
>>>>>
>>>>> Thanks,
 
Re: multiple instances of IE on reboot

Yeah, that idea was lurking at the back of my mind, too, but refusing to
coalesce. I so detest any type of spyware, but then again, I'm not an
admin-type like Terry.

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
news:OiFcW9kCJHA.3668@TK2MSFTNGP05.phx.gbl...
> And/or log the user's online activities. ("The dog ate my homework!")
>
> Gary S. Terhune wrote:
>> Well, let's see what results, if any, Terry comes up with over the
>> weekend,
>> or over several months, considering the symptoms present so slowly, and
>> maybe he'll eventually talk himself into doing some malware scanning just
>> to
>> be thorough, ;-)
>>
>>
>> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
>> news:%23GenPRiCJHA.4576@TK2MSFTNGP05.phx.gbl...
>>> Big clue (assuming he didn't have "5 to 10 [separate] instances" open at
>>> the time):
>>>>> If it was just one process of IE, it wouldn't be as big a deal. But
>>>>> the
>>>>> times I've found it in this condition, there were 5 to 10 instances
>>>>> running.
>>> --
>>> ~PAÞ
>>>
>>> Gary S. Terhune wrote:
>>>> But are there not "legitimate" components that behave just like
>>>> hijackware?
>>>>
>>>>
>>>> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
>>>> news:uPOcSThCJHA.4368@TK2MSFTNGP06.phx.gbl...
>>>>>> If it was just one process of IE, it wouldn't be as big a deal. But
>>>>>> the
>>>>>> times I've found it in this condition, there were 5 to 10 instances
>>>>>> running.
>>>>>
>>>>> Assuming you're not running IE8 Beta 1 or Beta 2, I can *assure* you
>>>>> that
>>>>> you have hijackware problem, Terry.
>>>>> --
>>>>> ~Robear Dyer (PA Bear)
>>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>>> AumHa VSOP & Admin http://aumha.net
>>>>> DTS-L http://dts-l.net/
>>>>>
>>>>> Terry R. wrote:
>>>>>> The date and time was 8/29/2008 10:36 AM, and on a whim, Gary S.
>>>>>> Terhune
>>>>>> pounded out on the keyboard:
>>>>>>
>>>>>>> So, why not disable all add-ons and test? (Internet Options,
>>>>>>> Programs
>>>>>>> tab,
>>>>>>> Manage Add-Ons button.Use IE, open a few instances, shut them all
>>>>>>> down
>>>>>>> then
>>>>>>> check Task Manager Processes tab for iexplore.exe. Another
>>>>>>> possibility
>>>>>>> that
>>>>>>> occurs to me is that some program (I'm thinking of Office, for
>>>>>>> example)
>>>>>>> may
>>>>>>> open a hidden instance of IE for it own inscrutable purposes and do
>>>>>>> to
>>>>>>> in
>>>>>>> such a way as to prevent IE from being killed by Shutdown in a
>>>>>>> normal
>>>>>>> manner (as it would kill most open apps.)
>>>>>>>
>>>>>>
>>>>>> I intend to next week. I looked at it once a couple months back,
>>>>>> rebooted and opened, surfed and closed IE repeatedly and couldn't
>>>>>> replicate it. So whatever the user is using or doing, it's causing
>>>>>> the
>>>>>> problem. He also doesn't shut down or restart very often and that
>>>>>> may
>>>>>> be complicating the issue.
>>>>>>
>>>>>> If it was just one process of IE, it wouldn't be as big a deal. But
>>>>>> the
>>>>>> times I've found it in this condition, there were 5 to 10 instances
>>>>>> running.
>>>>>>
>>>>>> I'll post back next Wednesday, which is the next time I'm onsite.
>>>>>>
>>>>>> Thanks,
>
 
Re: multiple instances of IE on reboot

The date and time was 8/29/2008 7:57 PM, and on a whim, Gary S. Terhune
pounded out on the keyboard:

> Well, let's see what results, if any, Terry comes up with over the weekend,
> or over several months, considering the symptoms present so slowly, and
> maybe he'll eventually talk himself into doing some malware scanning just to
> be thorough, ;-)
>

I've run scans, using four or five methods. Nothing has come up, and
other than the IE processes, the workstation runs fine.

Let you know more Wednesday,

--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.
 
Re: multiple instances of IE on reboot

The date and time was 8/29/2008 8:16 PM, and on a whim, PA Bear [MS MVP]
pounded out on the keyboard:

> And/or log the user's online activities. ("The dog ate my homework!")
>

At this point, the user hasn't warranted any reason. But you never
know. He is Hispanic, and some of the sites he visits are all in
Spanish, so there could possibly be some bad scripting he's running into.


--
Terry R.

***Reply Note***
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.
 
Back
Top