IE hold ups when opened from OE or O

[Guest]

Experiencing hold ups and shut down hangs when IE is opened from within OE
or O.

In Outlook the result is that a version of IE remains in programmes in
Process Explorer after it has been supposedly shut down - presumably
shutting the version that opens as a service from within O leaves the other
one incompletely shut down. This is accompanied by a 'closing programme
autocomplete' message that prevents shutdown, when O has been used as the
mail handler.

When OE is used as the mail handler IE still opens as a service, rather than
the programme itself, from links in mails. The 'service IE' tends to search
for ages, or even hang over the links. However, if the programme IE itself
is opened first, they go through OK - though the service version still runs.

I have noted the mail on a similar topic below, and had a look at the
files/open with.
In our case (XP Pro) the URL file type was set to open with "Shell Doc
Object & Control Library" (?)
However, resetting this to IE still opens it as a service and it still takes
ages.

What is going on?

Cheers,

S

 

[PA Bear [MS MVP]]

IE version? WinXP SP3 or SP3?

There is a very good chance are that you are seeing the affects of a
hijackware infection (especially in light of your other recent threads in MS
newsgroups).

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

2. Run the Windows Live Safety Center's 'Protection' scan (only!) in Safe
Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or other appropriate forums.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[Guest]

Hi PA,

Apologies for delay in getting back to you: as you may have noticed from my
other postings, your message did not get picked up by the OE on our pc for
some reason.

The pc uses IE6 XPPro SP2 at the mo and is regularly updated. I am in the
process of tidying up prior to updating to IE7 and SP3.

I'm now using a laptop and your message has downloaded here alright, so it
must be something on the pc, as this is using the same line/isp/router.

I downloaded the MSRT and ran it in deep scan mode, and it came up with
nothing.
Also ran Avast in thorough mode. This picked up and deleted one virus from
the temp int files of an account that rarely gets used. Otherwise it has
nothing to report except that it can't scan inside the write protected
spybot files.

As I have noted elsewhere I do try to keep up to date with security and
scan regularly and have TeaTimer and HostsSecure running, so, whilst I only
have the windows basic firewall, and a free antivirus, I think things ought
to be safer than many people get away with.

Why I posted in this group was that I was hoping someone would explain to me
why IE runs as a service when it is opened from within OE or O, so that I
could begin to understand what might be going on a little better.

Cheers,

S

 

[PA Bear [MS MVP]]

I would recommend that you disable Spybot Tea Timer before doing anything
else and that you leave it disabled until you've got the machine completely
cleaned up, installed SP3, and then installed IE7. See
http://aumha.net/viewtopic.php?f=26&t=32409

NB: If you don't fully understand what Tea Timer does and how it does it,
leave it permanently disabled.

What do you mean by "IE runs as a service when it is opened from within OE
or [OL]"? Is an IE window already opened when you click on a link in an
email? If so, does the link open in the existing window or a new one?

I downloaded the MSRT and ran it in deep scan mode, and it came up with
nothing.
Also ran Avast in thorough mode. This picked up and deleted one virus
from
the temp int files of an account that rarely gets used.

I would strongly advise doing Steps #2 and #3 now! I don't think you're out
of the woods yet.

...I am in the
process of tidying up prior to updating to IE7 and SP3.

I would NOT install IE7 or SP3 until an expert in one of the forums I listed
gave the machine a clean bill of health.

Furthermore, you will want to install SP3 before installing IE7. See
http://blogs.msdn.com/ie/archive/2008/05/05/ie-and-xpsp3.aspx

 

[Guest]

Thanks Robear,

I do find that TeaTimer slows things down at start up and had half a mind
not to use it, but did find that on this lap top for example, it picked up a
registry change associated with a virus before the AVG I was then using
kicked in, so I have tended to err on the side of caution and let it run.
It does come in handy for notifying me when progs like Google Toolbar and
Adobe try to install their annoying update programmes too...

When IE is normally opened Process Explorer shows it running as an open
programme at the bottom of its list. When a link is clicked in Outlook or
Outlook Express, a second IE is shown running as a Service.

In the case of Outlook, when that prog is shut down, all the IE windows
disappear, but PE still shows it running, and opening the thread lists shows
that it is still awaiting responses on several. The thread descriptors are
meaningless to me though, so I have just been killing the whole thing.

In the Outlook case, when the pc is shut down the 'invisible' IE keeps
running, and a pop up appears saying autocomplete needs to close, but it
won't unless you kill it. If you remember to go to Process Explorer first
and kill the invisible IEs - in service and progs section -, then the pc
shuts down without the pop up.

In my own user account - where I rarely use Outlook - I had not had the shut
down problem, but recently noticed the reluctance of OE to open links, and
only then noticed that these were opening IE in the services section, even
when I had it already open as a prog. However, if I did have it open as a
prog first then the links open ok.

Possibly another indicator to these is a further observation that sometimes
when an IE window is closed, it is still shown as open on the task bar until
the phantom is clicked and then goes away.

A further observation is that when the Outlook user tries to fill in some on
line doc that is in Word, the system freezes. I had concluded that this was
probably because she uses Word as her editor in Outlook and the version then
encountered on line was incompatible with her own. I had not related this
to the other observations, but you may know better.

I have to fit these tests around the work schedule of the pc's main user so
it can take some time to work through your suggestions. On past experience
I have posted logs at AumHa before, when the pc was behaving oddly, but
nothing untoward showed up, so I am more inclined to believe this is some
bug in the pc than an actual attack. I will, however, run another check
when I can get another crack at it.

Thanks very much for all your kind advice,

Steve

I would recommend that you disable Spybot Tea Timer before doing anything
else and that you leave it disabled until you've got the machine completely
cleaned up, installed SP3, and then installed IE7. See
http://aumha.net/viewtopic.php?f=26&t=32409

NB: If you don't fully understand what Tea Timer does and how it does it,
leave it permanently disabled.

What do you mean by "IE runs as a service when it is opened from within OE
or [OL]"? Is an IE window already opened when you click on a link in an
email? If so, does the link open in the existing window or a new one?

I downloaded the MSRT and ran it in deep scan mode, and it came up with
nothing.
Also ran Avast in thorough mode. This picked up and deleted one virus
from
the temp int files of an account that rarely gets used.

I would strongly advise doing Steps #2 and #3 now! I don't think you're
out of the woods yet.

...I am in the
process of tidying up prior to updating to IE7 and SP3.

I would NOT install IE7 or SP3 until an expert in one of the forums I
listed gave the machine a clean bill of health.

Furthermore, you will want to install SP3 before installing IE7. See
http://blogs.msdn.com/ie/archive/2008/05/05/ie-and-xpsp3.aspx
--
~PA Bear

Hi PA,

Apologies for delay in getting back to you: as you may have noticed from
my
other postings, your message did not get picked up by the OE on our pc
for
some reason.

The pc uses IE6 XPPro SP2 at the mo and is regularly updated. I am in
the
process of tidying up prior to updating to IE7 and SP3.

I'm now using a laptop and your message has downloaded here alright, so
it
must be something on the pc, as this is using the same line/isp/router.

I downloaded the MSRT and ran it in deep scan mode, and it came up with
nothing.
Also ran Avast in thorough mode. This picked up and deleted one virus
from
the temp int files of an account that rarely gets used. Otherwise it has
nothing to report except that it can't scan inside the write protected
spybot files.

As I have noted elsewhere I do try to keep up to date with security and
scan regularly and have TeaTimer and HostsSecure running, so, whilst I
only
have the windows basic firewall, and a free antivirus, I think things
ought
to be safer than many people get away with.

Why I posted in this group was that I was hoping someone would explain to
me
why IE runs as a service when it is opened from within OE or O, so that I
could begin to understand what might be going on a little better.

 

[Guest]

PS,

Just noticed your gmail connection, and this probably explains why I missed
you on the pc. A while back usenet folks were advising blocking gmail as
this seemed to be where much spam originated: I still have a message rule
running to that effect. Will turn off... hopefully not to immediately get
swamped with r^l*x offers...

S

I would recommend that you disable Spybot Tea Timer before doing anything
else and that you leave it disabled until you've got the machine completely
cleaned up, installed SP3, and then installed IE7. See
http://aumha.net/viewtopic.php?f=26&t=32409

NB: If you don't fully understand what Tea Timer does and how it does it,
leave it permanently disabled.

What do you mean by "IE runs as a service when it is opened from within OE
or [OL]"? Is an IE window already opened when you click on a link in an
email? If so, does the link open in the existing window or a new one?

I downloaded the MSRT and ran it in deep scan mode, and it came up with
nothing.
Also ran Avast in thorough mode. This picked up and deleted one virus
from
the temp int files of an account that rarely gets used.

I would strongly advise doing Steps #2 and #3 now! I don't think you're
out of the woods yet.

...I am in the
process of tidying up prior to updating to IE7 and SP3.

I would NOT install IE7 or SP3 until an expert in one of the forums I
listed gave the machine a clean bill of health.

Furthermore, you will want to install SP3 before installing IE7. See
http://blogs.msdn.com/ie/archive/2008/05/05/ie-and-xpsp3.aspx
--
~PA Bear

Hi PA,

Apologies for delay in getting back to you: as you may have noticed from
my
other postings, your message did not get picked up by the OE on our pc
for
some reason.

The pc uses IE6 XPPro SP2 at the mo and is regularly updated. I am in
the
process of tidying up prior to updating to IE7 and SP3.

I'm now using a laptop and your message has downloaded here alright, so
it
must be something on the pc, as this is using the same line/isp/router.

I downloaded the MSRT and ran it in deep scan mode, and it came up with
nothing.
Also ran Avast in thorough mode. This picked up and deleted one virus
from
the temp int files of an account that rarely gets used. Otherwise it has
nothing to report except that it can't scan inside the write protected
spybot files.

As I have noted elsewhere I do try to keep up to date with security and
scan regularly and have TeaTimer and HostsSecure running, so, whilst I
only
have the windows basic firewall, and a free antivirus, I think things
ought
to be safer than many people get away with.

Why I posted in this group was that I was hoping someone would explain to
me
why IE runs as a service when it is opened from within OE or O, so that I
could begin to understand what might be going on a little better.

 

[PA Bear [MS MVP]]

I'm not saying Tea Timer's not worthwhile, only that it may cause problems
if you don't completely understand what it does and how it does it.
Meanwhile, Windows Defender and WinPatrol (both free) would have detected
that Registry change, too...as would an AV app most-robust & reliable than
AVG Free.

Do you have IE configured such that a link in an email opens in a new
window? If so, that explains the second instance (service) of IE.

In the case of Outlook, when that prog is shut down, all the IE windows
disappear, but PE still shows it running, and opening the thread lists
shows
that it is still awaiting responses on several.

The above and the rest of your last reply strongly suggests that
hijackware's causing this. See Steps #1 thru #3 of my first reply.

Thanks Robear,

I do find that TeaTimer slows things down at start up and had half a mind
not to use it, but did find that on this lap top for example, it picked up
a
registry change associated with a virus before the AVG I was then using
kicked in, so I have tended to err on the side of caution and let it run.
It does come in handy for notifying me when progs like Google Toolbar and
Adobe try to install their annoying update programmes too...

When IE is normally opened Process Explorer shows it running as an open
programme at the bottom of its list. When a link is clicked in Outlook or
Outlook Express, a second IE is shown running as a Service.

In the case of Outlook, when that prog is shut down, all the IE windows
disappear, but PE still shows it running, and opening the thread lists
shows
that it is still awaiting responses on several. The thread descriptors
are
meaningless to me though, so I have just been killing the whole thing.

In the Outlook case, when the pc is shut down the 'invisible' IE keeps
running, and a pop up appears saying autocomplete needs to close, but it
won't unless you kill it. If you remember to go to Process Explorer first
and kill the invisible IEs - in service and progs section -, then the pc
shuts down without the pop up.

In my own user account - where I rarely use Outlook - I had not had the
shut
down problem, but recently noticed the reluctance of OE to open links, and
only then noticed that these were opening IE in the services section, even
when I had it already open as a prog. However, if I did have it open as a
prog first then the links open ok.

Possibly another indicator to these is a further observation that
sometimes
when an IE window is closed, it is still shown as open on the task bar
until
the phantom is clicked and then goes away.

A further observation is that when the Outlook user tries to fill in some
on
line doc that is in Word, the system freezes. I had concluded that this
was
probably because she uses Word as her editor in Outlook and the version
then
encountered on line was incompatible with her own. I had not related this
to the other observations, but you may know better.

I have to fit these tests around the work schedule of the pc's main user
so
it can take some time to work through your suggestions. On past
experience
I have posted logs at AumHa before, when the pc was behaving oddly, but
nothing untoward showed up, so I am more inclined to believe this is some
bug in the pc than an actual attack. I will, however, run another check
when I can get another crack at it.

Thanks very much for all your kind advice,

Steve

I would recommend that you disable Spybot Tea Timer before doing anything
else and that you leave it disabled until you've got the machine
completely
cleaned up, installed SP3, and then installed IE7. See
http://aumha.net/viewtopic.php?f=26&t=32409

NB: If you don't fully understand what Tea Timer does and how it does it,
leave it permanently disabled.

What do you mean by "IE runs as a service when it is opened from within
OE
or [OL]"? Is an IE window already opened when you click on a link in an
email? If so, does the link open in the existing window or a new one?

I downloaded the MSRT and ran it in deep scan mode, and it came up with
nothing.
Also ran Avast in thorough mode. This picked up and deleted one virus
from
the temp int files of an account that rarely gets used.

I would strongly advise doing Steps #2 and #3 now! I don't think you're
out of the woods yet.

...I am in the
process of tidying up prior to updating to IE7 and SP3.

I would NOT install IE7 or SP3 until an expert in one of the forums I
listed gave the machine a clean bill of health.

Furthermore, you will want to install SP3 before installing IE7. See
http://blogs.msdn.com/ie/archive/2008/05/05/ie-and-xpsp3.aspx
--
~PA Bear

Hi PA,

Apologies for delay in getting back to you: as you may have noticed from
my
other postings, your message did not get picked up by the OE on our pc
for
some reason.

The pc uses IE6 XPPro SP2 at the mo and is regularly updated. I am in
the
process of tidying up prior to updating to IE7 and SP3.

I'm now using a laptop and your message has downloaded here alright, so
it
must be something on the pc, as this is using the same line/isp/router.

I downloaded the MSRT and ran it in deep scan mode, and it came up with
nothing.
Also ran Avast in thorough mode. This picked up and deleted one virus
from
the temp int files of an account that rarely gets used. Otherwise it
has
nothing to report except that it can't scan inside the write protected
spybot files.

As I have noted elsewhere I do try to keep up to date with security and
scan regularly and have TeaTimer and HostsSecure running, so, whilst I
only
have the windows basic firewall, and a free antivirus, I think things
ought
to be safer than many people get away with.

Why I posted in this group was that I was hoping someone would explain
to
me
why IE runs as a service when it is opened from within OE or O, so that
I
could begin to understand what might be going on a little better.

:
IE version? WinXP SP3 or SP3?

There is a very good chance are that you are seeing the affects of a
hijackware infection (especially in light of your other recent threads
in
MS newsgroups).

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

2. Run the Windows Live Safety Center's 'Protection' scan (only!) in
Safe
Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the
requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or other appropriate forums.**

If the procedures look too complex - and there is no shame in admitting
this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

spamlet wrote:
Experiencing hold ups and shut down hangs when IE is opened from
within
OE
or O.

In Outlook the result is that a version of IE remains in programmes in
Process Explorer after it has been supposedly shut down - presumably
shutting the version that opens as a service from within O leaves the
other
one incompletely shut down. This is accompanied by a 'closing
programme
autocomplete' message that prevents shutdown, when O has been used as
the
mail handler.

When OE is used as the mail handler IE still opens as a service,
rather
than
the programme itself, from links in mails. The 'service IE' tends to
search
for ages, or even hang over the links. However, if the programme IE
itself
is opened first, they go through OK - though the service version still
runs.

I have noted the mail on a similar topic below, and had a look at the
files/open with.
In our case (XP Pro) the URL file type was set to open with "Shell Doc
Object & Control Library" (?)
However, resetting this to IE still opens it as a service and it still
takes
ages.