ie windows/pages erratically closing

[Experi-Mentor]

this is a strange problem ...

win xp pro (sp1)
ie pages/windows keep closing 80% of the time
normal explorer window(s) is never effected (only ie pages/windows).
this has happend before, but mysteriously vanished/ended on it's own after a few weeks. sadly, not this time

- pc's not infected (100% sure).
- well maintained hdd.
- i've checked-out the java settings & tried other settings (no change).
- surfed for answers & tried other related remedies (no luck).
- tried closing running progs, as a possibility of conflicts.

anybody encountered the same ?

[blutach]

Try repairing the installation. If no good, reinstall.

Regards

[paglamon]

win xp pro (sp1)

Install sp2.

pc's not infected (100% sure)

How so sure?

[Chewy]

sounds like driveby malware to me, my IE was crashing like crazy, I had outerinfo and others installed

[Experi-Mentor]

- nothing to reinstall, blu. haven't installed anything in over 2 months.

- sp2 was crap before & i've done well staying away from it.
- how sure ? very !

- not malware, chewy. btw, what was it you had ?


i think i may have found it (i think).
just need a day or so to confirm it. don't wanna go blowing the horn till i'm sure.
so far it seems to be pointing to a "venus-fly-trap" setting being active on one of my security measures (one of many).
keeping my fingers crossed that it's this simple. i really don't wanna do a reinstall

thanks will keep you informed.

ps. before anybody makes the suggestion of too many security progs running .... i have used these progs over'n'over without any probs, but i am also aware that updates etc can strangely effect some pc's/progs (keeping a very open mind).

[Experi-Mentor]

so much for the "venus-fly-trap" setting
back to drawingboard

[Chewy]

post a hijackthis log

[Experi-Mentor]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:39 AM, on 14/08/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\GIANT Company Software\GIANT AntiSpyware\gcasServ.exe
C:\Program Files\GIANT Company Software\GIANT AntiSpyware\gcasDtServ.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Program Files\IFTPPRO\IFTPMonitor.exe
C:\Program Files\DVD-RB PRO\Rebuilder.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\to burn\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cable.optusnet.com.au/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.rarlab.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\GIANT Company Software\GIANT AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: IglooFTP PRO Monitor.lnk = C:\Program Files\IFTPPRO\IFTPMonitor.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4349 bytes

[Chewy]

well having duplicate services running at the same time is a conflict and an accident
waiting to happen, I use more than one anti-spyware but don't let them run at the same time

the nvidia and soundmax are optional and problematic

I disable them in msconfig, that way they can be turned back on if needed

IE really needs sp2

IglooFTP PRO is an award winning FTP Client??

C:\WINDOWS\System32\RUNDLL32.EXE

could be dangerous

have you run a trojan scan from safe mode lately?

[Experi-Mentor]

well having duplicate services running at the same time is a conflict and an accident waiting to happen.

i've just switched to another isp 2 weeks ago, however, this problem was already active with the old isp. i will remove it.
------------------------------------

I use more than one anti-spyware but don't let them run at the same time.

if they all used the same identical principal, then i would have to agree with you.
------------------------------------

the nvidia and soundmax are optional and problematic.

they're only the installed drivers & are needed. i know of the nvidia bugs, but, i've also had this problem with win98 & on it was a totally different pc (with no nvidia vid card). i will test with them off.
------------------------------------

sp2 ? after all the crap that this caused ?
i patched most of the holes/fixes directly from ms.
------------------------------------

IglooFTP PRO is an award winning FTP Client??

it was years ago, & i still use it for uploading stuff.
------------------------------------

C:\WINDOWS\System32\RUNDLL32.EXE - could be dangerous

a few of my other installed progs require this. i understand your suspicion & i looked into it, but i will try to look into it it further, or disable it.
------------------------------------

have you run a trojan scan from safe mode lately?

as my security progs have always detected & prevented any crap from forming, i haven't done a scan in safe mode for years. i will do that too.
------------------------------------

as originally stated, this has happened before, but always managed to fix itself (somehow). it's happened 3 times in total, & only lasted a week to 2 weeks, & it vanished. seems to happen every 18 months to 2 years.
i've disabled all running progs (1-by-1 & all-at-once). made no difference. it doesn't do it with every ie page i open & has no effect on other ie pages open (only on a new ie page opened - whenever), & usually when i least expect it (murphy's law).

one more thing, i can now tell when it's about to happen. the mouse pointer goes into the hourglass shape for 3-5secs & then the page closes (other pages are not effected).
i've changed mice & drivers. no change.

i will try the above mentioned. thanks muchly for your effort chewy

strange, you didn't say anything about flashget ? many security progs report it as unsafe

[Chewy]

FlashGet is a leading download manager and has the highest amount of users on the internet

I am no security expert but common sense says it's semi-safe

the soundmax and nvidia programs are not the drivers but known helper apps that I disable to lower the chance of conflicts

we had a problem a while back with our normal installed protections when someone loaded aol suite, sooner or later the computers got totally hosed, I learned to let the aol
stuff take control and turned off my standard programs

regarding IE, it's what you need to have sp2 running on, not necessarily on XP.

keep your cache down to 40-50 MB and clean often

with all those services running I can see why xp's sp2 would hose your computer

run as a repair disk would be much safer, or even a clean install

since sp3 is in the pre-beta testing I might wait a while and limp along

[Experi-Mentor]

please don't laugh but, i'm really trying to avoid posting this
since my last reply (around 2 days ago) & reading your reply, it was late night here, i powered off & went to bed - with the intention to start with the suggested remedies the next day.

what can i say, it looks like ie is back to normal (touch wood !!!). i didn't get a chance to test/use any of the suggestions. however, i will still do scan in safe-mode, whenever i remember it during power-up.

i powered-up the next day, went to check the usual email etc, then spent a few quiet moments waiting for ie to close so i can start with the suggestions.
it didn't happen !
i altered nothing & ran pc all day (& today), re-booted & powered-up several times & ie is still holding. i ran the progs that usually run everyday, i even did a few trial burns to rw's. just couldn't provoke or possibly imitate the problem to start.

i could have been wrong about it previously lasting 2 weeks, as it happend a long time ago & i simply got the time span wrong.
i'm speachless. got all dressed up with nowhere to go

if all goes as before, i'll see this weird problem return in 2 years or so.

- ## the soundmax and nvidia programs are not the drivers but known helper apps that I disable to lower the chance of conflicts ## -

my mistake, i thought you were talking about their drivers

i'm greatful for your time & effort. thank you

upon it's return, i'll be sure to revive this thread.