Orphaned IExplorer Process

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

When I exit IExplorer, the process doesn't end. I have to manually end the
process. Anyone know why?

Thanks.
 
Our Man Flint said:
When I exit IExplorer, the process doesn't end. I have to manually
end the process. Anyone know why?

Thanks.
Click to expand...

First eliminate any spyware.
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

CAUTION!!!!! Removing some spyware can damage the Winsock stact. Before
you try to remove spyware using any of these programs , download a copy of
LSP-Fix - a free program to repair damaged Winsock 2 stacks (all Windows
versions)
http://www.cexx.org/lspfix.htm
Winsockfix for W95, W98, ME, NT, 2000, XP
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257
WinXP:
Get WinSockxpFix
http://www.spychecker.com/program/winsockxpfix.html
How to Reset Internet Protocol (TCP/IP) in Windows XP
http://support.microsoft.com/kb/299357
In WinXP SP2: You can fix Winsock by going to Start | Run and typing
CMD
In the command window type
netsh winsock reset

See
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated with the program's update function
before every use, even when just downloaded. There's also a lot more to do
than just those two programs. CWShredder is also available here:
http://www.intermute.com/products/cwshredder
**Post your HijackThis log to
http://forums.spywareinfo.com/
http://forums.tomcoyote.org/
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/ or the Spyware forum at
http://aumha.net/viewforum.php?f=30 for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.

See this link for information about malware:
http://arstechnica.com/articles/paedia/malware.ars

If nothing there helps, please post back to this thread.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/
 
Thanks for the suggestions. If I can made sense of all the stuff below, I
should try and "fix WINSOCK" since I am running WinXP SP2 with IE6 and I
have NOT lost my Internet connection. So, I did that by typing "netsh
winsock reset" in the command window. It does not seem to have worked. I
still open IE and, after I close it, I still have an orphaned "IEXPLORE.EXE"
process in Task manager. Sometimes, I even get 3 or 4 of that same orphaned
process using >20Mb of memory each.

I have used Microsoft Anti-Spyware, Ad-Aware and Spybot S&D. Recently, I
DID use the "System Explorers" Advanced Tools in Microsoft Anti-Spyware. It
told me that I had some IE BHOs that were missing (?) and it recommended
deletion to fix it. So, I deleted them. That's the only thing I can think
of recently that I have done. However, I'm not sure how long this problem
has existed.

Did I get all that right?

OMF
 
Our Man Flint said:
When I exit IExplorer, the process doesn't end. I have to manually end the
process. Anyone know why?
Click to expand...


It could be legitimate. What other apps are still open when you check?
E.g. I have seen your symptom and been able to avoid having to kill the
IE process by finding another apparently associated window to close.
The simplest example would an Explorer window which had been lauched
from IE's Settings dialog. (e.g. Alt-T,O,Alt-S,V). However, I have also
seen it with OE windows and other apps which need to render HTML too.


HTH

Robert Aldwinckle
---
 
Our Man Flint said:
Thanks for the suggestions. If I can made sense of all the stuff
below, I should try and "fix WINSOCK" since I am running WinXP SP2
with IE6 and I have NOT lost my Internet connection. So, I did that
by typing "netsh winsock reset" in the command window. It does not
seem to have worked. I still open IE and, after I close it, I still
have an orphaned "IEXPLORE.EXE" process in Task manager. Sometimes, I
even get 3 or 4 of that same orphaned process using >20Mb of memory
each.
I have used Microsoft Anti-Spyware, Ad-Aware and Spybot S&D. Recently, I
DID use the "System Explorers" Advanced Tools in
Microsoft Anti-Spyware. It told me that I had some IE BHOs that were
missing (?) and it recommended deletion to fix it. So, I deleted
them. That's the only thing I can think of recently that I have done.
However, I'm not sure how long this problem has existed.

Did I get all that right?

OMF
Click to expand...

1. The Winsock repair part is, as I said, for AFTER you remove the spyware
IF you lose connectivity.

2. Please provide a link for where you posted your HijackThis log.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/
 
Thanks for the idea. Strangely enough, when I try to "View Files" as you
suggest below (Alt-T,O,Alt-S,V), IE tells me that it needs to shut down. I'm
thinking I need to reinstall?

OMF
 
Our Man Flint said:
Thanks for the idea. Strangely enough, when I try to "View Files" as you
suggest below (Alt-T,O,Alt-S,V), IE tells me that it needs to shut down.
I'm thinking I need to reinstall?
Click to expand...


Not so fast. That could just mean that you have a corrupt TIF.
In fact a corrupt TIF could conceivably account for your other
symptom too.

First try clearing the TIF in the standard way but make sure that
all possible users of it are stopped including IE. Also, note that
some antivirus scanners are known to interfere with its operation too.
Once everything else is stopped use the Internet Properties tool
to clear it. E.g. Run... inetcpl.cpl

If that doesn't allow you to use the "TIF viewer" (after you have done
some browsing, of course), stronger measures are called for.
E.g. you need to delete the complete TIF folder (more specifically
its Content.IE5\index.dat.) You can't do that using the account of
the affected user. (Well, actually you might be able to by stopping
explorer.exe and running just an application which doesn't try to open
the TIF but I'm not sure if cmd.exe fits that description or not. Try it
if you like. You'll need to know the rd command and its options.)
The usual suggestion is to logon on to a different account with Administrator
authority and do the deletion more conventionally. ;)


Good luck

Robert
---
 
I fixed it! Turns out it was the Yahoo Toolbar that was causing the problem.
Once I disabled it in the "Manage Add-ons" section, the problem went away.

Thanks,

OMF
 
Our Man Flint said:
I fixed it! Turns out it was the Yahoo Toolbar that was causing the problem. Once I disabled it in the "Manage Add-ons" section,
the problem went away.

Thanks,
Click to expand...


Thanks for the feedback.

That's a new error symptom to blame on that utility I think.
Usually the problem that users complain about which is fixed
by removing that thing is an inability to use Open in a New Window.
Perhaps you are just the first to notice what is really happening
instead.


Robert
---
 
Back
Top