IEXPLORE.EXE reuses EXLORER.EXE?

[gradiov]

Hi everybody!

Today I have been introduced to a very strange problem that I could not find a resolution for. I started to work on the project that involves coding a client-side IE control. My development machine is running Windows XP Professional. When I had my first draft ready, I tried to run the project in debugger (VC++ 6.0) but strangely enough even though I could see my control being initialized and the program being executed, it would not break at breakpoints I had set. Later I noticed that the debugger would start, attach to the new instance of IE and then will report that the IE has exited and stop debugging. After some research I knew that whenever I run IEXPLORE.EXE on that system (whether it is from the shortcut or from the command line) it starts up the new instance which then exits almost right away event though the explorer window is still up and functional and can be found in the task manager's applicaitons pane. Also it is being shown in the applications pane whenever I right click on it and tell it to "go to process" it ends up going to the explorer.exe in the processes tab also there are no processes for IEXPLORE.EXE running. Given all this, I am assuming that IEXPLORE.EXE starts up, an then "attaches" to the running instance of the explorer.exe (commands it to open a new window, sets window style and tells it where to navigate).

I would assume that there is a setting somewhere that tells IEXPLORE to behave that way (perhaps to save memory and processing resources). My question is where the heck is this setting and what do I do to turn it off.

:-D

Thanks for reading through this entire post! If you have any idea on how to deal with this thing, please let me know.

Once again:
OS: WinXP Proffessional SP1
IE: 6.0.2800 (I also have FireFox installed on that PC if that matters)


Thanks Everybody.
Edit/Delete Message

[jwillcox]

I am getting the same thing... did you ever find an answer?

[HackersInc]

Did you try running IExplorer.exe in VC++? Under the Project/Settings, select the debug tab and add the C:\Program Files\Internet Explorer\IEXPLORE.EXE to the "Executable for Debug Session" edit box. I have in the past used this to attach dll's to Executables and I would like to think this would work for your control in IE.

HackersInc.

[jwillcox]

I have posted to here:

http://forums.wugnet.com/-Internet-explorer-running-explorer.exe-process-ftopict373569.html

And here:
http://www.mcse.ms/showthread.php?s=&postid=4620782#post4620782

Contacted MS. They wouldn't talk to me without paying $35.
Contacted Dell. They had no clue.

This is user account specific. I'm on XP SP2 and if I login as another user iexplore.exe works as normal. I have also tried this in safe mode however the error still occurs.

This effects me because we use a web-application that links to the process session. On certain users... instead of having multiple iexplore.exe sessions I get on *BIG* explorer.exe which doesn't allow us to run multiple sessions (since it is just one process)

I guess what I'm trying to figure out is how/why has explorer 'taken over' my handling of iexplore.exe

I haven't installed anything new recently (that I can remember) and have done all the obvious Anti-virus sweeps, Spyware sweeps etc.

This is on a nice clean machine with all windows updates etc..... there has got to be a reason. Any ideas if this is a registry thing? If so... perhaps there is a way to 'clean' the registry? (just a thought)

[gradiov]

I did. Now I am not sure what exactly I have done to fix it. I was unable to identify any standard registry or other confiuration settings that could cause the described behaviour, but it seems that a misbehaved BHOs could be the reason for it (this is something I worked with when the problem initiated).

Try cleaning up funky BHOs, installed on you system. If that does not do the trick, - try removing and then reinstall all IE and windows updates (via Add/Remove Programs). Hopefully one of the above actions will fix it.

Sorry, that I could not give you more detailed answer but I (stupidly) changed several things at the time and as a result do can not be certain which one got me past the issue.

Regards,


Gradiov.

[jwillcox]

I tossed *all* my BHO and reset all web settings to defaults.

I am able to get this to work with a different profile on the same computer (and profiles seem to share the BHOs)

I also can't find any IE updates or options to reinstall within Add/Remove programs (something which google should fix)

I'll try reinstalling IE as soon as I get my hands on some googled directions... Got any other clues as to what else you may have done?

After removing the BHOs still got the same issue.

[gradiov]

How did you remove BHOs?
Did you reboot?

[gradiov]

What does this mean?

I am able to get this to work with a different profile on the same computer (and profiles seem to share the BHOs)

does it mean that you have had the same problem with another profile and removing BHOs fixed it?

[jwillcox]

Okay I didn't have much in the way of BHOs.

I went through tools, internet options, settings, view objects. This opened up: C:\WINDOWS\Downloaded Program Files

I tossed everything in here..

I had a Siebel Plugin, Acrobat, Windows Update, Office Update, and Flash. (maybe one or two other dinky ones) Nothing major.

I selected all and chose remove. (this deleted all except 2) Loader Class and Loader Class v2 [these appear to be stock for windows]

In any case ... what I meant about the profile thing is if I create another user account on the exact same machine. (just a local account) Explorer funtions normally and I don't get the error. Since we are on a Windows 2000 domain... I went as far as to have a co-worker login to my box and Explorer worked fine. In other words.. whatever is wrong, only effects my user account on this specific PC. The glitch/setting/conflict wherever it is has got to be something unique to my user ID on the machine. If it was for example a patch issue... it should effect all users. (hence my questioning if this might be registry related)

Somewhere windows is making the call to use Explorer.exe to handle my iexplore.exe processes.

I mention the BHOs folder being shared because on a whim I logged in as a local account and as it turns out that folder (the one I gave the path to above) is the same regardless of who logs in. (in other words what effects one user in there should effect another user. (presumably)

I also scoured my add/remove programs list for anything weird. It really is a pretty stock PC. (just some normal apps on it)

The 'weirdness' has got to be stored somewhere within my settings choices or registry or profile. This could be in about a million places so I'm trying to isolate it.

PS: I really appreciate your help on this... this has effected 4 other people in our company and our IT people couldn't figure it out. Ultimatly they wiped their systems. I cannot afford the time to do this and we need to find out what is *really* causing this so we can alert our folks to it.

EDIT: Saw your edit. No, the other profiles worked even before removing the few BTOs that I had. Once removed, they still work, however MY profile still doesn't. (in other words no effect on the issue). Also I don't have any weird toolbars, plugins etc. listed in add/remove programs. Just my basic apps. Anything pertaining to the web has been removed. (but there really wasn't anything there to begin with)

And yes. I rebooted after all this was done.

[gradiov]

Did you look under these registry keys?
HKEY_LOCAL_MACHINE\SOFTWARE\
Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
and
HKEY_CURRENT_USER\SOFTWARE\
Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
and
HKEY_CLASSES_ROOT\software\microsoft\
windows\currentversion\explorer\browser helper objects\

[jwillcox]

First area: 3 keys. 2 I couldn't identify which I deleted. The last was Norton Antivirus which I left.

Second area: didn't exist (HKEY_CURRENT_USER\SOFTWARE\
Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects(didn't exist)

This area: didn't exist (HKEY_CLASSES_ROOT\software\microsoft\
windows(didn't exist)

Rebooting now.

EDIT: Rebooted and still same issue... (darned if this isn't one of the hardest things I've had to attack)

[gradiov]

Somewhere windows is making the call to use Explorer.exe to handle my iexplore.exe processes. No, it does not. If you look closely (as I have described in the initial post) you will see that iexplore.exe is starting up then, very shortly after, it new explorer.exe window opens up and iexplore.exe exits. These can be done by a third party software in a couple of different ways: monitoring newly created processes using WMI (or another method to monitor process/windows creation) and then shutting down IE whenever it is started and then passing control over to explorer.exe (I would say that this is the unlikely case) or using BHO (the most straight-forward way). This gives me the reason to blame the BHO.

P.S. In case of hijaking the CreateProcess API and monitoring for the call to iexplorer.exe, then replacing it with the call to explorer.exe, would not result in creation of iexplore.exe process.

[gradiov]

In regards to your last post: let me check where else these things register.

[gradiov]

Also I am not sure about shell extensions... You mentioned that multiple people in you company got this issue. Were there any common software bits installed on these machines lateley?

[jwillcox]

No, it does not. If you look closely (as I have described in the initial post) you will see that iexplore.exe is starting up then, very shortly after, it new explorer.exe window opens up and iexplore.exe exits. These can be done by a third party software in a couple of different ways: monitoring newly created processes using WMI (or another method to monitor process/windows creation) and then shutting down IE whenever it is started and then passing control over to explorer.exe (I would say that this is the unlikely case) or using BHO (the most straight-forward way). This gives me the reason to blame the BHO.

P.S. In case of hijaking the CreateProcess API and monitoring for the call to iexplorer.exe, then replacing it with the call to explorer.exe, would not result in creation of iexplore.exe process.

Sorry, you are correct. They launch...but then vanish. Now I'm not an *expert* but I recall that Norton has it's own WMI thing..... (just as an aside)... I wonder if it is somehow malfunctioning... (But that would theoretically effect all users on the PC).

On a whim I disabled norton, rebooted, then tried. Still no dice. (but I doubt that is what's causing it... besides.. my norton is a different flavor then other users in my company... and they have the issue too...)

But I figured it was worth mentioning...

[jwillcox]

Also I am not sure about shell extensions... You mentioned that multiple people in you company got this issue. Were there any common software bits installed on these machines lateley? Unfortunatly I wasn't able to get my hands on them prior to them being wiped. I've told them to alert me to this issue next time it comes up... but based on what the users said (those that I talked to) they didn't have anything new or changed. (most of them don't even have admin rights to make changes)

[gradiov]

Did you check if HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions are different in two profiles?

[gradiov]

most of them don't even have admin rights to make changes They do not always need to when making changes to the CURRENT USER's profile, right?

[gradiov]

Well, I need to join a meeting now. Will be back in a couple of hours or later this evening. Let me know if you have any progress and I will try to think of what else could cause this behaviour and how to fix it - I am still really **** curious to find out whats causing it. :confused:

[jwillcox]

Did you check if HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions are different in two profiles?
I took screen shots of both locations under both profiles. No difference. Both had the same items in there...

I had to run to a meeting also. I'll take another swing at this tomorrow morning. Perhaps sleeping on this will lend a clue. (prays to the microsoft gods that it does)

I also started doing searches and looking at such stuff as

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

All kinds of nifty stuff in here....

[jwillcox]

I slept on it and......

http://www.winguides.com/registry/display.php/964/

Registry Settings
User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
BrowseNewProcess]
Value Name: BrowseNewProcess
Data Type: REG_SZ (String Value)
Value Data: Yes

IT WORKS!!!!!!!

[gradiov]

Hmm, looks like your issue had roots different from mine - BrowseNewProcess="Yes" was the first thing I looked for but that did not fix the problem for me. Everything was back to normal after cleaning out the BHOs. Oh well, as they say there is more than one way to skin a cat, right? And thanks for the info too.