I have IE8.

One of my Adobe prgms says to close internet explorer when I try to update using Adobe Updater.

So I close all IE windows.

Same error.

I look in task manager and see one iexplore.exe. So I end task, but the thing pops back open in a few secs .. with a size of ~3.2KB.

Adobe updater cannot update cuz I cannot close (or keep closed) iexplore.exe

I use Windows XP Home.

Any ideas?

I run IE8 on Windows XP Professional and get two instances of iexplore.exe, both running under my username. Both go away and stay away when I close IE8.

I installed no betas or RC's but waited for the final release. How about you?

It seems like you have something running in the background, requiring iexplore.exe.

Ick, sounds like spyware to me.  That's usually the only thing that will come back automatically when you close it (besides OS components, which should warn you before you kill them.) 

Have you tried killing the associated process?

MrMagoo wrote on Jun 6^th, 2009 at 1:57am:

Have you tried killing the associated process?

What is the associated process?

Christer wrote on Jun 6^th, 2009 at 1:05am:

I installed no betas or RC's but waited for the final release. How about you?

Same here.


Christer wrote on Jun 6^th, 2009 at 1:05am:

It seems like you have something running in the background, requiring iexplore.exe.

That seems a reasonable assumption. How to determine what it is?

@ Rad


Quote:

What is the associated process?

Probably the process that's calling the program--the one that is bringing the ie program back to life!

Maybe one of these programs could help show the interdependency associated with the process in question:

Process Monitor v2.04


Process Explorer v11.33


Quote:

I look in task manager and see one iexplore.exe. So I end task, but the thing pops back open in a few secs .. with a size of ~3.2KB.

Where do you see that *size* info in Task Manager?


Quote:

Ick, sounds like spyware to me.  That's usually the only thing that will come back automatically when you close it

That would be my concern--or a virus, key-logger, or trojan!

NightOwl wrote on Jun 6^th, 2009 at 2:13pm:

Where do you see that *size* info in Task Manager?

Processes tab, list under column labeled 'Mem Usage"

I downloaded & installed Process Monitor but I think it provides too much info. Not sure where to start or what to look for. Hundreds of thousands of entries.

When I open 1 instance of IE8 (the Rad home page), I get 2 more instances of iexplore.exe in task manager (for a total of 3).

1 is ~ 20K, and the other ~55K.

When I close home page, these 2 go away, and I'm left with the 4K-ish iexplore.exe that won't go awaywith anything less than a tactical nuclear weapon.

I'd say run msconfig and disable any start-up programs you don't need, then reboot and see if it helps.  Other than that, my bet is still on malware.

I agree it sounds like malware.  Besides the usual startup locations and registry [Run] keys, there are a lot of other places malware can insert itself to avoid detection.

In addition to the other suggestions, I'd try SysInternals Autoruns.  Checkmark the 'Hide Microsoft Entries' option to screen out some of Windows' own stuff, and press F5 to refresh.

You might also try HiJackThis and look for a BHO somewhere, though Autoruns should probably do just as well.

here is my autoruns with ie tab selected. anything look hokey?

i do not know how to tell exactly what is launching ie .. even when no browser window is open.

Here's the first part of my hijack. Anything look suspect?


Quote:

edited out

here's more hijack scan. forum is set to limit posts to 6k, so posting in parts:


Quote:

edited out

this should be last section:


Quote:

edited out

here's the last of it:


Quote:

edited out End of file - 18304 bytes

I haven't used HijackThis in a long time, so I can't be much help there.  In your autorun, I see some interesting stuff.

If memory serves, Roboform is a critter you don't want crawling around.  That CjmBrowserHelperObject by MindJet (who I'm not familiar with) sounds suspicious.  As Dan mentioned, BHO's are often not your friend.  The "SnagIt" IE add-on also sounds suspicious to me.

I'd start by disabling at least those 4 items (SnagIt is listed at least twice,) rebooting, and see if its any better.  Either way, a thorough malware scan from safe mode is never a bad idea in cases like this.

RoboForm is a password-saving app .. for all the forums I frequent.

SnagIt is the best screen capture utility I know of, since I do a lot of that.

MindJet makes a cool think-on-paper prgm that's great for collecting & organizing thoughts & ideas.

Wow.  You got lotsa stuff.  My HiJackThis scan is only 25 lines long (not counting the processes report), and my Autoruns IE tab has only one item in it.  Then again, I don't install extra IE toolbars (I hate 'em), and I use virtual machines for a lot of my websurfing.

The HJT log shows several "missing file" lines... that wouldn't be causing your problem, but it's worth cleaning those up while you're at it.

The only obvious baddy is WO.exe in the last line.  You never want to see something running out of your temp directory on startup, so that's always a tipoff.  OTOH, it's one of the "file missing" entries, so maybe a prior problem that got cleaned in a virus scan later?

The rest looks legit (not that I'm all that familiar with a lot of it), but that doesn't mean it couldn't be causing the problem.  I'd zero in on the O2, O4, and O23 lines, as the others probably don't autostart.

In particular, I notice a lot of license verification or authentication kind of services starting up... maybe one of those is launching an IE stub and hanging--maybe a file got corrupted, or maybe there's a problem at the other end of the internet that the service is trying to connect to for authentication?

(Not that I'm familiar with how they're designed to operate, but are all those authentication services shown in 'Running processes' supposed to be there?  I can understand something starting when you launch the program, but even if you're not using the program?  I'm not saying you should try to shut them off, but just that it might be a clue worth investigating whether one of them is not shutting down when it's supposed to and hanging IE.)

You've also got some "updater" kinds of services autostarting... not that they're necessarily bad, but maybe one of them is stalling.  FWIW, I always remove those update-checker items from my startup.

One that caught my eye is GoogleToolbarNotifier.exe, one of the O4 startup lines.  Okay, I've seen that in the startup sequence on a lot of clients' systems, but I assumed it just launched on startup, checked your toolbar version, and shut down if you were up to date.  Does it really leave a process running, as shown in the 'Running processes' list?  Wow.

You've also got Startup Delayer and Outpost Firewall loading at startup... maybe one of those is interfering with one of the internet verification services?  I'd try disabling both of those and seeing if it makes any difference.

Thanks.

Seems like I'm always demo'ing new stuff, then uninstalling later. I know it probably gums up the works, but I like to see what software does.

I'll look closer after I fire up these steaks on the grill.

I appreciate you taking the time to scan these entries, cuz they're so long.

I am always running scans, both online and offline.

I even use NOD32 boot CD and scan from there, so as to catch critters that might hide themselves after Windows load.

I've also used web scans from other AV manufacturrers, such as Panda, etc. Ones I don't normally use/install.

Spanky wrote on Jun 7^th, 2009 at 8:38pm:

Seems like I'm always demo'ing new stuff, then uninstalling later. I know it probably gums up the works, but I like to see what software does.

That's what virtual machines are for.   ;)



Spanky wrote on Jun 7^th, 2009 at 8:38pm:

I've also used web scans from other AV manufacturrers, such as Panda, etc. Ones I don't normally use/install.

Well, okay... but didn't I see Panda in your HJT scan?

Dan Goodell wrote on Jun 8^th, 2009 at 1:17am:

That's what virtual machines are for.

Yeah, that's what I do now, but I didn't discover the wonders of virtualization until recently, and I've had this laptop .. for years. Live-n-learn. Better late than never.