Unexplained launches of Internet Explorer

Philocalist

Explorer.exe keep launching iexplore.exe, repeatedly (though no window ever opens). I can kill iexplore.exe in Task Manager easily enough, but it immediately relaunches. Changing the name of the iexplore.exe file just results in ANOTHER iexplore.exe file being generated, and the process begins again, ad infinitum.
Both the explore.exe and iexplore.exe files appear to be the genuine article, in the correct locations.
Antivirus / spyware / trojan / malware scans show up nothing ... have tried ALL the usual suspects bar none!
Sometime CPU usage of the launched iexplore.exe is very small, at others considerably larger, and PC seems to slow down considerably.
Suspect something strange, but no idea where to go next ... any ideas / advice please?

Peter W

User: inactive Posts:

Hi

You havn't said what AV, Anti-Spyware or A.Trojan you have. Please tell us. "Try" to download the following bolded items, update them and re-boot into "Safe Mode".

Run all three SEPARATELY!! Let us know how you got on please.

You can download the following at:
AntiVirus = AVG: HERE
Spyware = Ewido: HERE
Spyware = SpybotS&D: HERE (ignore the donation part. Also download SpywareBlaster at this address)
Firewall = Sygate: HERE. (As an added prevention)
AntiTrojan = ASquared: HERE

pcrattail · Joined: Jun 11, 2004 Posts: 406

Lots of things could be doing this...

BUT.... I always go with..
1. An extentions is wanting access to the Internet.
If you have "toolbars" aka... (google toolbar, AOL/AIM toolbar, Yahoo toolbar, Smileys toolbar,.....etc. (these are ALL extras for IE)) they tend to want Internet for updates, etc.

2. An extention that is "really" a "plugin" that wants Internet.
THESE include..... Shockwave Plugin/Player, Flash Plugin/Player, Quicktime Plugin/Player, Acrobat Reader Plugin/Player, Real Player/Audio/etc... , IMusic/IPod/etc...., ALL these are considered "Plug-ins".... EVEN JavaScript is a "Plugin".

3. The "wild blue yonder" programs that just "HAVE TO" check for updates.
THESE include...... almost ALL PRINTER COMPANIES must have your PC "call home" to see if there are ANY new software/firmware updates. "SOME" other "hardware' companies do the same, ALL the AOL crapolla calls home, NERO calls home for updates, other software call home for updates (NON critical software).

4. The "critical" to "almost" critical software calling in for updates.
THESE include...... Windows XP (if you have auto-updates) installed and running, Nortons AV/etc..., ALL "GOOD" Anti-Virus programs, Ad-Aware, Spybot S&D, Trojan Hunter,.....etc.....

.......... IF you RULE out ALL of those.... THEN start getting concered about ... Virus/Trojan/Adware/Spyware/etc....

P.S. BE carefull about those "Plugins and toolbars" they can SOMETIMES be virus/trojan/adware/spyware/etc.. in DISQUISE.

..
.

goretsky

Hello,

Does Internet Explorer go to any particular web site when this occurs?

Regards,

Aryeh Goretsky

usasma · Joined: May 06, 2003 Posts: 5007

Here's a new freeware toy that I found at Shell Extension City. It's supposed to tell what traffic is going out of your network - and what programs are causing the traffic. It may help in this instance (I haven't tried it yet).

It's called Vision and is available here: http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&am...ubconte

Philocalist

Thanks Basherz .. have already run ALL of these, and more, as a matter of course before listing on here .. still have problem as initially outlined Sad

Philocalist

Yep, tried all of this too before posting pcrattail but problems still there Sad

Philocalist

Hi Goretsky ... the launched executable does't actually result in a window of IE opening at a particular site! It merely shows as iexplore being active in Task Manager. This can happen either as a single launch (when I do not have IE running), or as an additional unwanted launch at randon while I surf. It also happens if I happen to be browsing with Opera or Firefox instead of IE6 or not browsing at all! In all such cases, no window opens, it just runs, taking up resources.
Only thing that I seem to be able to establish is that it appears to be the legitimate iexplore exe file from within the Windows folder, launched by what is apparently the legit explore.exe file, also from within the Windows folder?????? ... and sytem is much slower, overall.

Philocalist

Hey usasma ... nice find, and great site ... Vision seems to be a very handy tool, though unfortunately it gives no further insight in this case Sad

... still strugglin'

usasma · Joined: May 06, 2003 Posts: 5007

OK, another thing to try.

Since you know that explorer.exe is calling up IE - try this free utility to see what's going on "under the hood" of explorer.exe: http://www.sysinternals.com/Utilities/ProcessExplorer.html

Also, you can try blocking explorer.exe and IE temporarily with a software firewall. You may get something interesting when reviewing the errors that it generates.

Another thing to try is to kill any "spare" processes that are running. Then, one-by-one re-enable them until it occurs again.

goretsky

Hello,

If you open a Command Prompt (filename: CMD.EXE) and type in "NETSTAT.EXE -A -B" you should get a list back of all open connections and the application originating the request. What shows up for IEXPLORE.EXE in the list?

Regards,

Aryeh Goretsky

pcrattail · Joined: Jun 11, 2004 Posts: 406

I agree with "goretsky" with one proviso...........

Do the "Command Prompt" thing directly AFTER you see the iexplorer.exe show up unwarrented.

This will assure that you "capture" it in the listing.
..
.

usasma · Joined: May 06, 2003 Posts: 5007

Found another free tool for this: http://www.fiddlertool.com/fiddler/

The TechNet article that I read says that it will reveal the address of the site that IE is trying to connect to. I'd suggest having no other internet capable tools running at the same time so that you can isolate the problem packets more easily.