Extra Dll's loaded by IE6

  • Thread starter Thread starter TomM
  • Start date Start date
T

TomM

have been told that on our corporate LAN, when we load IE6, it also loads
into memory several DLL's, which are related to our AV product. This gives
the impression the IE6 is using a large amount of memory, compared to a
version which is loaded with no AV product.

It has been suggested to me that these Dll's are loaded with each subsequent
launch of IE6. We may therefore have several instances of IE6 open, each
with this seemingly large memory footprint.

I would have thought that these Dll's, would have been loaded into memory
only once, and then referenced by the other instances of IE6. I would not
think that they would be loaded each time a new instance IE6 was launched

Does anyone know how I can prove this either way?

Thanks
 
What Windows version(s), DLLs, and AV app are you referring to?

What has the AV provider had to say about it?
 
Sorry, should have said. It XP SP2.

The AV product is McAfee virusscan Enterprise (managed via EPO)

The AV Dll's have been identified as

Mcscan32.dll AV Scanning Engine McAfee, Inc 5.200.0000.2160
McShield.dll English (09) resources for McShield Network Associates,
Inc 8.00.0000.0251
Mytilus.dll Common Shell - Scanners' interface to the engine Network
Associates, Inc 8.00.0000.0325
Scriptproxy.dll VirusScan Script Proxy Network Associates,
Inc 8.00.0000.0992

There also appear to be two Microsoft Dlls

Rdpsnd.dll Terminal Server Multimedia Driver Microsoft 5.01.2600.2180
WINSTA.dll Winstation Library Microsoft 5.01.2600.2180.

We are still in discussion with the AV Vendior, but nothing forthcoming as
yet, so I'm "going public" hoping to find another approach
 
TomM said:
have been told that on our corporate LAN, when we load IE6, it also loads
into memory several DLL's, which are related to our AV product. This gives
the impression the IE6 is using a large amount of memory, compared to a
version which is loaded with no AV product.

It has been suggested to me that these Dll's are loaded with each subsequent
launch of IE6. We may therefore have several instances of IE6 open, each
with this seemingly large memory footprint.
Click to expand...


Is each IE window open in its own task?

I would have thought that these Dll's, would have been loaded into memory
only once, and then referenced by the other instances of IE6. I would not
think that they would be loaded each time a new instance IE6 was launched

Does anyone know how I can prove this either way?
Click to expand...


Use Process Explorer.
 
I aplologise, I've been away for a bit. Can be a mixture of both.
We run an ORACLE application through the browser, this may open several
windows. However thiey wil all be under one instance of IE6. We may have
other instances of IE open, which wil be running in its own task?

Process Explorer will show up each instance of IE6 which is open. Under the
DLL's window for any one of these instances, I can see the DLL's listed, but
cannot determine if they are being "loaded" more than one and are taking up
memory. On checking any one of the Dll's, for each open instances, the
"load" address is the same, leading me to think that it is only loaded once
and not for each running instance of IE ?
 
TomM said:
I aplologise, I've been away for a bit. Can be a mixture of both.
We run an ORACLE application through the browser, this may open several
windows. However thiey wil all be under one instance of IE6. We may have
other instances of IE open, which wil be running in its own task?

Process Explorer will show up each instance of IE6 which is open. Under the
DLL's window for any one of these instances, I can see the DLL's listed, but
cannot determine if they are being "loaded" more than one and are taking up
memory. On checking any one of the Dll's, for each open instances, the
"load" address is the same, leading me to think that it is only loaded once
and not for each running instance of IE ?
Click to expand...


AFAIK that just means that their base address in each address space
is the same. I suspect they would have to be marked re-enterable
in order to be loaded into a common shared segment but that is just generic
terminology and I'm not sure whether Windows actually does that sort of thing.
Judging by how profligate MS seems to be about storage I wouldn't be surprised
if it doesn't. (Maybe that's when application designers would choose to implement
common processes as services? Then presumably the common client code which
invoked those services could be relatively small.)


In any case if you aren't getting enough clues from Process Explorer
you could also run ProcMon and see how often the modules are loaded.
I suppose you might even be able to see the use of the page file
if any of the others got swapped out as a result but don't know that for sure.
Those "footprints" would have to be huge and your physical memory tiny
to see such an effect, I think. ; )


Good luck

Robert
---
 
Back
Top