none
IE 10/11 does not free up, hangs - unkillable process RRS feed

  • Question

  • Hi!

    I have a problem with IE since about 2 years now. IE does not close/exit correctly, i have always to do a system reboot!

    IE 9 worked fine, never had a problem with this version. Since v10 and now v11 i cannot close IE completely. If i close the open tabs and exit IE, the program window closes, but there are still one or more 'iexplore.exe *32' processes running in the background (with massive RAM consumption - non growing). I always try to kill the open process(es), with no luck, it will not exit! I can restart IE again and can use it, but after exiting the hanged processes are still running. So i have always to do a system restart several times a day. This is unacceptable!

    I tried following things till now to get rid of the problem (nothing worked!):
    - starting/using IE 32bit with/without addons, IE 64bit (forced mode) with/without addons.
    - un-/reinstalling Flash v10/v11/v12/v13/v14/v15
    - trying to kill 'iexplore.exe' and 'iexplore.exe *32' with "Windows Task Manager", "Process Explorer", "Process Hacker", "System Explorer", "Advanced Process Termination", "taskkill.exe", "pskill.exe", "killprocess.exe", "process.exe" 

     

    My PC:
    Toshiba Satellite L670D - Win 7 Ultimate SP1 x64 - IE 11.0.9600.17280
     
    IE Addons:
    Adobe Shockwave Flash Object
    Adobe PDF Reader
    DivX Web Player Object
    Microsoft Windows Media Player, Windows Live ID Sign-in Helper/Control, Silverlight, XML DOM Document, XSL Template, XML HTTP, Free Threaded XML DOM Document, VIDEO__X_MS_ASF Moniker Class, VIDEO__QUICKTIME Moniker Class
    Oracle Deployment Toolkit
    Skype Click to Call
    Skype add-on for IE

     

    Your help is very appreciated.
    Thank you, Frank

     

    Thursday, October 9, 2014 3:12 PM

Answers

  • For further testing i disabled "Emsisoft Online Armor" to see if the problem still exists.

    And at the moment i have to say that IE is running fine now, no problems to close/exit IE - all iexplore.exe processes quit on exit as it should be!

    So, as a conclusion, there must occured a TDI conflict between the updated/newer versions of 'afd.sys' and OAmon.sys' around 2012/2013. As i can't/won't revert back to older versions of them, i have unfortunately to uninstall Emsisoft Software now.

    Thanks for the help,
    Frank

    • Marked as answer by Frank Gniffke Wednesday, October 15, 2014 3:22 PM
    Wednesday, October 15, 2014 3:21 PM

All replies

  • Please answer each of the following [admittedly tedious] diagnostic questions in a correspondingly-numbered list in your very next reply, preferably without quoting my post:

    1a. When (approx. date) did you purchase the computer?

    1b. Did Win7 64-bit come preinstalled on the computer when you bought it, did you do a clean install of Win7, or did you upgrade the computer to Win7?

    2. What is the full name of your installed anti-virus application or security suite and when (approx. date) does your current subscription expire? What anti-spyware applications (other than Defender) are installed? What third-party firewall (if any)?

    3. Has a(nother) Norton application or a McAfee application EVER been installed on the computer since you bought it?

    4. Did a Norton free-trial or a McAfee free-trial [PICK ONE] come preinstalled on the computer when you bought it? (Doesn't matter if you never used or Activated it.)

    5. Is KB2977629, KB2972211 & KB2973112; KB2976897, KB2993651, KB2918614, KB2978668, KB2937610 and/or KB2943357 listed in Installed Updates (not Update History)? [1]

    6. Assuming Java is installed => Is Java Version 7 Update 65 (or higher) installed? TEST HERE USING INTERNET EXPLORER ONLY! => http://java.com/en/download/uninstallapplet.jsp [2]

    7. Is Adobe Flash Player v15.0.0.167 (or higher) installed? TEST HERE USING INTERNET EXPLORER ONLY! => http://www.adobe.com/software/flash/about/

    8a. When (exact date) was Internet Explorer 11 installed according to Installed Updates?

    8b. What Update Version & KB number are displayed in the second line of text in IE11's Help | About [Alt+H+A] tab; e.g., Update Version: XX.0.54 (KB1231231) ?

    8c. You were seeing the same behavior in IE10, is that correct?

    9. Is Firefox, Chrome or any other alternate browser installed?

    10. Are you in the habit of using "Registry cleaners" (e.g., Registry Mechanic; System Mechanic; RegCure; RegClean Pro; Advanced SystemCare; Registry Booster; McAfee QuickClean; Glary Utilities; AVG PC TuneUp; Norton Registry Cleaner; PCTools Optimiser; SpeedUpMyPC; PC Doctor; TuneUp Utilities; WinMaximizer; WinSweeper; Comodo System Cleaner; Advanced System Optimizer; CCleaner's Registry Cleaner component)?

    ==============================================
    [1] Start | Control Panel | Programs and Features | View installed updates (in left-hand menu)
    [2] No need to install Java if it's not already installed!


    ~Robear Dyer (PA Bear) MS MVP-Windows Client since 2002 Disclaimer: MS MVPs neither represent nor work for Microsoft

    Friday, October 10, 2014 12:43 AM
  • 1a) Purchase Date: early 2011

    1b) Windows: new clean install

    2) no Antivirus/no Security Suite.
    Antimalware: Emsisoft Anti-Malware 8, Emsisoft HijackFree, Malwarebytes Anti-Malware 2, EMCO Malware Destroyer 7
    (Microsoft Support Emergency Response Tool, ESET Onlinescanner, ComboFix, eScan MWAV, Kaspersky Online Scanner)
    Antirootkit: Malwarebytes Anti-Rootkit, Avast MBR, Bitdefender BootkitRemoval, Kaspersky TDSSKiller, McAfee RootkitRemover, TrendMicro RootkitBuster
    Firewall: Emsisoft Online Armor 7

    3) no Norton, no McAfee

    4) no, dito 3) or see 1b)

    5) KB2977629 = yes, KB2972211 = yes, KB2973112 = yes, KB2976897 = yes, KB2993651 = yes, KB2918614 = yes, KB2978668 = yes, KB2937610 = yes, KB2943357 = yes

    6) uninstalled Java about 4 months ago - never needed it.

    7) Flash v15.0.0.152

    8a) IE11 install date: 2014/04/17

    8b) IE Update Versions: 11.0.12 (KB2977629)

    8c) correct, v9 showed never ever one single behaviour like that, it starts with v10.

    9) i installed about 1 month ago "GreenBrowser", "SlimBrowser", "AvantBrowser", "Lunascape" and "Maxthon" for alternative testing purposes - before that never installed any other browser.

    10) only CCleaners Registry Clean option - no other cleaner/optimizer.

    Should i uninstall/revert back IE to version 8/9? And then reinstall the latest v11?

    Saturday, October 11, 2014 2:38 AM
  • 1. How long has the computer been connected to the internet without a valid anti-virus application installed?

    2. Have one or more of your anti-malware applications/scanners ever detected & removed anything?

    3. Can you successfully upgrade to Flash Player v15.0.0.167 (or higher) by opening Internet Explorer ONLY to this page? => http://www.adobe.com/go/getflash 

    • BEWARE any pre-checked options to "drive-by" install unwanted, third-party software (e.g., Google Toolbar; Google Chrome; McAfee Security Scan)!

    4. Does the behavior persist if you (a) re-assert Internet Explorer as the default Browser in the CUSTOM (<=Important!) section of Set Program Access and Computer Defaults, (b) Reset IE per the manual instructions on this page, and then (c) reboot?

    • For optimal results, check/enable the Delete person settings option.

    5. Do you have backups of ALL the changes CCleaner's Registry Cleaner component has EVER made to the computer? [1]

    COMMENT: If you were seeing the behavior after upgrading IE9 to IE10, chances are reverting back to IE9 or IE8 and then doing a clean install of IE11 wouldn't fix this. That being said, you might give it a try.

    ===========================================================
    [1] Injudicious use of registry cleaners may be playing a role here. TIP: If you ever again think your Registry needs to be cleaned, repaired, boosted, tuned-up, cured, tweaked, fixed, maximized, "swept" or optimised (it doesn't), read this article (and related links cited therein) then draw your own conclusions. Related => http://support.microsoft.com/kb/2563254


    ~Robear Dyer (PA Bear) MS MVP-Windows Client since 2002 Disclaimer: MS MVPs neither represent nor work for Microsoft

    Saturday, October 11, 2014 5:23 PM
  • I tried following things till now to get rid of the problem (nothing worked!):
    - starting/using IE 32bit with/without addons, IE 64bit (forced mode) with/without addons.
    - un-/reinstalling Flash v10/v11/v12/v13/v14/v15
    - trying to kill 'iexplore.exe' and 'iexplore.exe *32' with "Windows Task Manager", "Process Explorer", "Process Hacker", "System Explorer", "Advanced Process Termination", "taskkill.exe", "pskill.exe", "killprocess.exe", "process.exe" 

    With all their Force and Tree options, I assume?  That's an impressive collection of "artillery".  So have you also tried to find out why the tasks are not closing?  E.g. using ProcExp and ResMon and another one from SysInternalsSuite that I am aware of but have not tried myself:  Handle.  Perhaps on that tack you would find out that there is something else that you could kill which was blocking the final cleanup of the IE tasks and then that would either allow them to finish normally or allow your "kill" procedures to succeed?

    Good luck



    Robert Aldwinckle
    ---

    Saturday, October 11, 2014 5:39 PM
    Answerer
  • @Robear:

    1) Since the beginning. (I had on my old PCs some Anti-Virus Packages running, but i dismissed them on my new PCs.)

    2) No, never any virus, trojaner, malware, adware, rootkit etc. (I have them only for verification that my PC is clean) 

    3) Yes, no problems to upgrade Flash.

    4.a) Yes
    4.b) Not done yet, will be my next step.

    5) No. (CCleaner mainly found leftovers in the registry of old/uninstalled programs. Maybe there was some IE related in the past - but am i the only one who uses IE & CCleaner?)
    BTW i follow the discussion about the sense of registry cleaners for years now - i am just the opinion if i uninstall a software, i want it to be uninstalled - including leftover files/folders and registry entries.

    - if i reinstall IE, the installer should rewrite its registry entries, or not?!

    Sunday, October 12, 2014 5:29 PM
  • @Robert:

    Yes, i just can't believe that i can not kill this process. It could be so easy if any of this 'artillery' had worked.

    I had read much about the idea of looking up the "Handles" of a task, but i never got the point of this investigation... what exactly should i am looking for? How should i proceed there?

    If i go to the stucked iexplore.exe process i see following things:

    by Task-Manager: iexplore.exe
    Properties - Security/Permissions:

    "Account Unknown" (S-1-15-2-1) : Read & execute=yes, Read=yes 
    "SYSTEM" : Read & execute=yes, Read=yes
    "Administrators" : Read & execute=yes, Read=yes
    "Users" : Read & execute=yes, Read=yes
    "TrustedInstaller" : Full control=yes, Modify=yes, Read & execute=yes, Read=yes, Write=yes
    Owner="TrustedInstaller"

    by Process Explorer/Process Hacker: iexplore.exe - PID 5028
    Properties - Security/Permissions:

    "Account Unknown" (S-1-5-5-0-105819) : Special permissions=yes/no (greyed) 
    "SYSTEM" : Full control=yes, Read=yes, Write=yes, Special permissions=yes/no (greyed) 
    "Administrators" : Full control=yes, Read=yes, Write=yes, Special permissions=yes/no (greyed) 
    Owner="Administrators"


    Parent process:

    "iexplore.exe" (non-existent process)

    Threads:

    "ntdll.dll!Rt|UserThreadStart" 
    
    ntoskrnl.exe!_misaligned_access+0x17e71, 
    ntoskrnl.exe!KeAcquireSpinLockAtDpcLevel+0x93d2, 
    ntoskrnl.exe!KeWaitForSingleObject+0x19f3, 
    OAmon.sys+0x5e204, 
    OAmon.sys+0x62045, 
    OAmon.sys+0x1e226, 
    OAmon.sys+0x16d57, 
    adgnetworktdi.sys+0x35168, 
    adgnetworktdi.sys+0x18cf9, 
    adgnetworktdi.sys+0xb5b810, 
    OAmon.sys+0x430711, 
    afd.sys+0x57acd12, 
    ntoskrnl.exe!NtMapViewOfSection+0x15a713, 
    ntoskrnl.exe!NtDeviceIoControlFile+0x5614, 
    ntoskrnl.exe!KeSynchronizeExecution+0x3a2315, 
    0x77204120


    Handles:

    Desktop	\Default
    File	\Device\Afd
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OTCFKYT5\like[1].htm
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\rapidworker-1.1[1].js
    File	C:\Windows\SysWOW64\en-US\mlang.dll.mui
    File	\Device\Afd
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQC0D85P\likebox[1].htm
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y6EO28KM\postmessageRelay[1].htm
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2TOLVVLD\like[1].htm
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\KFZn1BJ0LYk[1].htm
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\rapidworker-1.1[1].js
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\rapidworker-1.1[1].js
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TLY2BXE2\grlryt2bdKIyfMSOhzd1eA[1].woff
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\rapidworker-1.1[1].js
    File	\Device\Afd
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\rapidworker-1.1[1].js
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KOKSA3VI\fontello[1].eot
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\rapidworker-1.1[1].js
    File	\Device\Afd
    File	C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9
    File	C:\Windows\SysWOW64\en-US\wdmaud.drv.mui
    File	\Device\Afd
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\rapidworker-1.1[1].js
    File	\Device\Afd
    File	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQ20PYVG\rapidworker-1.1[1].js
    File	\Device\Afd
    Mutant	\Sessions\1\BaseNamedObjects\http://www.blick.ch/
    Mutant	\Sessions\1\BaseNamedObjects\SmartScreen_UrsCacheMutex_4A72F430-B40C-4D36-A068-CE33ADA5ADF9Low_BLACKBOOK_Admin
    Mutant	\Sessions\1\BaseNamedObjects\http://cdn.cxense.com/
    Mutant	\Sessions\1\BaseNamedObjects\https://www.flickr.com/
    Mutant	\Sessions\1\BaseNamedObjects\http://www.bild.de/
    Mutant	\Sessions\1\BaseNamedObjects\https://www.youtube.com/
    Section	\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
    Section	\Sessions\1\BaseNamedObjects\windows_ie_global_counters
    Thread	iexplore.exe(5028): 4344
    Thread	iexplore.exe(5028): 4492
    Thread	iexplore.exe(5028): 3424
    Thread	iexplore.exe(5028): 364
    Thread	iexplore.exe(5028): 5076
    Thread	iexplore.exe(5028): 5852
    Thread	iexplore.exe(5028): 3108
    Thread	iexplore.exe(5028): 2568
    Thread	iexplore.exe(5028): 3052
    Thread	iexplore.exe(5028): 4448
    Thread	iexplore.exe(5028): 4848
    Thread	iexplore.exe(5028): 3352
    Thread	iexplore.exe(5028): 2892
    Thread	iexplore.exe(5028): 6044
    Thread	iexplore.exe(5028): 5196
    Thread	iexplore.exe(5028): 5144
    Thread	iexplore.exe(5028): 6020
    Thread	iexplore.exe(5028): 1108
    Thread	iexplore.exe(5028): 4268
    Thread	iexplore.exe(5028): 3820
    Thread	iexplore.exe(5028): 2068
    Thread	iexplore.exe(5028): 3688
    Thread	iexplore.exe(5028): 4592
    Thread	iexplore.exe(5028): 5032
    Thread	iexplore.exe(5028): 2144
    Thread	iexplore.exe(5028): 3912
    Thread	iexplore.exe(5028): 4152
    Thread	iexplore.exe(5028): 3296
    Thread	iexplore.exe(5028): 4468
    Thread	iexplore.exe(5028): 2860
    Thread	iexplore.exe(5028): 4956
    Thread	iexplore.exe(5028): 5800
    Thread	iexplore.exe(5028): 4016
    Thread	iexplore.exe(5028): 4596
    Thread	iexplore.exe(5028): 3900
    Thread	iexplore.exe(5028): 2288
    Thread	iexplore.exe(5028): 4152
    Thread	iexplore.exe(5028): 2320
    Thread	iexplore.exe(5028): 5676
    Thread	iexplore.exe(5028): 3796
    Thread	iexplore.exe(5028): 2244
    Thread	iexplore.exe(5028): 4208
    Thread	iexplore.exe(5028): 2840
    Thread	iexplore.exe(5028): 2368
    Thread	iexplore.exe(5028): 6088
    Thread	iexplore.exe(5028): 5900
    Thread	iexplore.exe(5028): 3696
    Thread	iexplore.exe(5028): 4480
    Thread	iexplore.exe(5028): 1756
    Thread	iexplore.exe(5028): 5964
    Thread	iexplore.exe(5028): 6040
    Thread	iexplore.exe(5028): 5088
    Thread	iexplore.exe(5028): 4964
    Thread	iexplore.exe(5028): 3288
    Thread	iexplore.exe(5028): 3084
    Thread	iexplore.exe(5028): 2344
    Thread	iexplore.exe(5028): 4128
    Thread	iexplore.exe(5028): 4284
    Thread	iexplore.exe(5028): 3880
    Thread	iexplore.exe(5028): 3532
    Thread	iexplore.exe(5028): 4412
    Thread	iexplore.exe(5028): 2260
    Thread	iexplore.exe(5028): 1664
    Thread	iexplore.exe(5028): 4816
    Thread	iexplore.exe(5028): 3836
    Thread	iexplore.exe(5028): 3936
    Thread	iexplore.exe(5028): 1760
    Thread	iexplore.exe(5028): 3780
    Thread	iexplore.exe(5028): 4444
    Thread	iexplore.exe(5028): 5692
    Thread	iexplore.exe(5028): 4016
    Thread	iexplore.exe(5028): 1784
    Thread	iexplore.exe(5028): 3280
    Thread	iexplore.exe(5028): 5544
    Thread	iexplore.exe(5028): 2760
    Thread	iexplore.exe(5028): 2244
    Thread	iexplore.exe(5028): 4328
    Thread	iexplore.exe(5028): 3600
    Thread	iexplore.exe(5028): 4928
    Thread	iexplore.exe(5028): 4124
    Thread	iexplore.exe(5028): 5908
    Thread	iexplore.exe(5028): 4612
    Thread	iexplore.exe(5028): 5124
    Thread	iexplore.exe(5028): 4908
    Thread	iexplore.exe(5028): 4924
    Thread	iexplore.exe(5028): 5136
    Thread	iexplore.exe(5028): 1140
    Thread	iexplore.exe(5028): 3752
    Thread	iexplore.exe(5028): 3536
    Thread	iexplore.exe(5028): 3544
    Thread	iexplore.exe(5028): 5180
    Thread	iexplore.exe(5028): 4800
    Thread	iexplore.exe(5028): 4580
    Thread	iexplore.exe(5028): 5036
    Thread	iexplore.exe(5028): 3332
    Thread	iexplore.exe(5028): 5712
    Thread	iexplore.exe(5028): 3816
    Thread	iexplore.exe(5028): 2252
    Thread	iexplore.exe(5028): 2692
    Thread	iexplore.exe(5028): 4040
    Thread	iexplore.exe(5028): 4200
    Thread	iexplore.exe(5028): 3788
    Thread	iexplore.exe(5028): 3648
    Thread	iexplore.exe(5028): 2420
    Thread	iexplore.exe(5028): 5780
    Thread	iexplore.exe(5028): 2788
    Thread	iexplore.exe(5028): 4512
    Thread	iexplore.exe(5028): 3476
    Thread	iexplore.exe(5028): 3804
    Thread	iexplore.exe(5028): 5796
    Thread	iexplore.exe(5028): 3376
    Thread	iexplore.exe(5028): 4244
    Thread	iexplore.exe(5028): 4340
    Thread	iexplore.exe(5028): 5576
    Thread	iexplore.exe(5028): 3664
    Thread	iexplore.exe(5028): 3216
    Thread	iexplore.exe(5028): 5280
    Thread	iexplore.exe(5028): 1560
    Thread	iexplore.exe(5028): 1924
    Thread	iexplore.exe(5028): 4436
    Thread	iexplore.exe(5028): 4072
    Thread	iexplore.exe(5028): 5376
    Thread	iexplore.exe(5028): 3228
    Thread	iexplore.exe(5028): 1416
    Thread	iexplore.exe(5028): 2152
    Thread	iexplore.exe(5028): 5244
    Thread	iexplore.exe(5028): 3876
    Thread	iexplore.exe(5028): 4396
    Thread	iexplore.exe(5028): 4944
    Thread	iexplore.exe(5028): 3584
    Thread	iexplore.exe(5028): 4824
    Thread	iexplore.exe(5028): 3092
    Thread	iexplore.exe(5028): 460
    Thread	iexplore.exe(5028): 5504
    Thread	iexplore.exe(5028): 3452
    Thread	iexplore.exe(5028): 1692
    Thread	iexplore.exe(5028): 2396
    Thread	iexplore.exe(5028): 2524
    Thread	iexplore.exe(5028): 4904
    Thread	iexplore.exe(5028): 5148
    Thread	iexplore.exe(5028): 4608
    Thread	iexplore.exe(5028): 5668
    Thread	iexplore.exe(5028): 3104
    Thread	iexplore.exe(5028): 3240
    Thread	iexplore.exe(5028): 5224
    Thread	iexplore.exe(5028): 1900
    Thread	iexplore.exe(5028): 3824
    Thread	iexplore.exe(5028): 272
    Thread	iexplore.exe(5028): 3196
    Thread	iexplore.exe(5028): 1904
    Thread	iexplore.exe(5028): 2912


    Sunday, October 12, 2014 6:43 PM

  • Threads:

    "ntdll.dll!Rt|UserThreadStart" 
    
    ntoskrnl.exe!_misaligned_access+0x17e71, 
    ntoskrnl.exe!KeAcquireSpinLockAtDpcLevel+0x93d2, 
    ntoskrnl.exe!KeWaitForSingleObject+0x19f3, 
    OAmon.sys+0x5e204, 
    OAmon.sys+0x62045, 
    OAmon.sys+0x1e226, 
    OAmon.sys+0x16d57, 
    adgnetworktdi.sys+0x35168, 
    adgnetworktdi.sys+0x18cf9, 
    adgnetworktdi.sys+0xb5b810, 
    OAmon.sys+0x430711, 
    afd.sys+0x57acd12, 
    ntoskrnl.exe!NtMapViewOfSection+0x15a713, 
    ntoskrnl.exe!NtDeviceIoControlFile+0x5614, 
    ntoskrnl.exe!KeSynchronizeExecution+0x3a2315, 
    0x77204120


    What's  OAmon.sys?  Consider removing it?

    http://www.file.net/process/oamon.sys.html

    BTW does the problem occur in a safe mode boot with Networking?  Is OAmon allowed to start then?

    Same thing with  adgnetworktdi.sys

    http://systemexplorer.net/file-database/file/adgnetworktdi-sys 

    Removing them should at least change your diagnostics if not change your symptom.

    Note that these interferers would be impervious to troubleshooting procedures such as using No Add-ons mode and RIES.

     

    Good luck



    Robert Aldwinckle
    ---

    Sunday, October 12, 2014 7:11 PM
    Answerer
  • First let us know if Resetting IE, followed by a reboot, makes any difference.

    Have you been getting unwanted pop-ups?

    Is (or was) Online Armor and/or Adguard installed?

    Does the behavior persist when signed in to a newly-created User Profile?


    ~Robear Dyer (PA Bear) MS MVP-Windows Client since 2002 Disclaimer: MS MVPs neither represent nor work for Microsoft

    Sunday, October 12, 2014 7:47 PM
  • OK, after reading something about "try closing the handles of the process" i tried that... i could close with Process Explorer/Process Hacker all handles EXCEPT 'Desktop \Default', then tried again to kill/terminate the iexplore.exe process... no luck!

    Looking into more detail, we have these components open:
    "ntoskrnl.exe" = MS Windows (NT) OS kernel
    "OAmon.sys" =  Emsisoft Online Armor TDI Helper Monitor (Firewall: installed early 2011)
    "adgnetworktdi.sys" = AdGuard TDI Network driver (Adblocker: installed 1 month ago after removing an IE adblock addon which could have been the reason for hanging)
    "afd.sys" = Ancillary Function driver (Network Winsock?/TDI? driver)

    So, we have 3(4) possible components (see above) that could be the reason for my problem?!
    1) OnlineArmor: why do i got the problem after 1 year i had installed OnlineArmor already - and not from the beginning?!
    2) AdGuard: newly installed program, my problem exists nearly 2 years before that.
    3) AFD: also listed at 'Handles' (\Device\Afd). Maybe some network problems in conjunction with OnlineArmor?!

    OK, as i didn't know too much about Afd.sys i just got curious about and looked up for that file. i found five different versions on my PC:
    a) the current/latest installed: afd.sys v6.1.7601.18489 05/30/2014 08:45 (C:\Windows\system32\drivers)
    b) afd.sys v6.1.7601.22705 05/30/2014 08:41 (C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.22705_none_36a3a0208e215d89)
    c) afd.sys v6.1.7601.22457 09/14/2013 03:11 (C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.22457_none_366f8b668e482477)
    d) afd.sys v6.1.7601.18264 09/14/2013 03:10 (C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.18264_none_35d81beb75355772)
    e) afd.sys v6.1.7601.17514 11/21/2010 04:24 (C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991)

    BTW i just wonder why i.e. Flashpeak's "SlimBrowser" - which uses also the same IE11 trident engine - does NOT show this behaviour like MS IE11 and closes/exits fine - nevertheless which version of afd.sys!?!

    ---

    So, who is responsible for that problem now?!
    Emsisoft's OnlineArmor? Or Microsoft's InternetExplorer/Windows AFD?
    (i will have to do some more tests to see if i get to function IE again...)

    ---

    My way of testing: started IE, opened the homepage google.com, opened flickr.com with several tabs, opened and closed some tabs on youtube.com, started a video stream on rtl-now.rtl.de (all this in no particular order), closed all tabs till the homepage and finally closed IE again. Result was everytime the same: "iexplore.exe *32" hanged!

    Best Regards,
    Frank


    • Edited by Frank Gniffke Monday, October 13, 2014 2:45 PM false positive alarm
    Monday, October 13, 2014 5:35 AM
  • Have you tried resetting IE yet?

    Does the behavior persist when signed in to a newly-created User Profile (with or without Admin privileges)?

    Why is Adguard installed? What is the name of the "IE adblock addon" you removed a month ago? Have you been getting unwanted pop-ups (ads or otherwise)?

    Does the behavior persist if you uninstall Online Armor & make sure the Windows Firewall is enabled?

     

    ~Robear Dyer (PA Bear) MS MVP-Windows Client since 2002 Disclaimer: MS MVPs neither represent nor work for Microsoft

    Monday, October 13, 2014 6:42 PM
  • For further testing i disabled "Emsisoft Online Armor" to see if the problem still exists.

    And at the moment i have to say that IE is running fine now, no problems to close/exit IE - all iexplore.exe processes quit on exit as it should be!

    So, as a conclusion, there must occured a TDI conflict between the updated/newer versions of 'afd.sys' and OAmon.sys' around 2012/2013. As i can't/won't revert back to older versions of them, i have unfortunately to uninstall Emsisoft Software now.

    Thanks for the help,
    Frank

    • Marked as answer by Frank Gniffke Wednesday, October 15, 2014 3:22 PM
    Wednesday, October 15, 2014 3:21 PM
  • have unfortunately to uninstall Emsisoft Software now.

    If you like you could now try reinstalling them, in case they would then get their hooks set better in the processes that they try to monitor.


    Robert Aldwinckle
    ---

    Wednesday, October 15, 2014 6:30 PM
    Answerer
  • Q: Does the behavior persist if you uninstall Online Armor & make sure the Windows Firewall is enabled?

    A: ...i disabled "Emsisoft Online Armor" [and] IE is running fine now [so] I have [to uninstall the software] now.

    Very good.

    You're welcome & thanks for your feedback.


    ~Robear Dyer (PA Bear) MS MVP-Windows Client since 2002 Disclaimer: MS MVPs neither represent nor work for Microsoft

    Wednesday, October 15, 2014 11:15 PM