none
Oct and Nov Rollups (KB3185330 and KB3197868) Cause Internet Explorer 11 to Crash RRS feed

  • Question

  • Issue:

    After installing KB3185330 or KB3197868, Internet Explorer intermittently hangs with the classic "Not Responding" error and you need to end task all instances of IE to get it working again.  There seems to be a connection between multiple tabs being open and IE crashing and I have not reproduced the issue running IE 11 with a single tab open.

    Resolution:

    In all cases, removing either KB3185330 (if the November Rollup has not yet been installed) or KB3197868 resolved the issue.

    The obvious problem is both are critical updates so they will simply be installed again during standard update cycles.  And since this issue exists in BOTH the October Rollup and the November Rollup, manually excluding these updates will likely accomplish little as the rollups are inclusive so the December (or whatever month it is released in) will reintroduce the issue.

    Note:

    I own an IT consulting firm and have now seen this at 10 totally unrelated sites.  I have also seen plenty of other people complaining about it on the Web but there has been no answer from Microsoft.  I have completed extensive testing at these sites and the Rollups are 100% the cause of the issue.

    Can anyone from Microsoft acknowledge this is a known issue and provide feedback on when it will be resolved?

    And please, no "update your drivers", "disable add-ons", "start in safe mode", etc. checklist responses. 


    Sunday, November 27, 2016 9:51 PM

All replies

  • Hi Potomac,

    <quote>

    I own an IT consulting firm and have now seen this at 10 totally unrelated sites. 

    </quote>

    I would guess they (the 10 sites) use Flash...(If possible please include any websites you are having problems with your questions) and/or they are on the IE ActiveX Filtering lists...

    You can disable your 'flash cookies' from Start>Control Panel>Flash 32>Storage tab

    (Search>Control Panel>Flash 32>Storage tab on Windows 10).

    You may like to have a look at some of the domains that are already storing flash cookies on your computer... They are most likely to be CDN's....

    Note: that there are separate instructions for disabling 'flash cookies' on other web browsers that you may have installed on your machines.

    There are covenants.... disabling flash cookies will...

    Some sites use ActiveX control feature detection which has been depreciated in IE11 (edge aka IE11 mode) and some sites using a legacy flash framework will fail to load or correctly detect flash support in the browser.... There is also IE's ActiveX Filtering (by site) which is a frequent cause of confusion for users.... You will see a blue circle icon with a line through it in the rhs of the IE Address bar when content has been blocked on a site/page. Double click it to toggle the settings for ActiveX Filtering or Tracking Protection for the CURRENT SITE.

    Silverlight controls can also store information on the client also....and there has been an upgrade version of the client runtimes released in the proceeding months. You can adjust your client Silverlight settings by right clicking on any hosted control and selecting settings from the context menu.... there is a link there to the MS update page.... !important... turn off all ActiveX filtering before going to the update page... Tools>ActiveX Filtering... after installation of the update you will have to uninstall the previous version from Start>Control Panel>Add/Remove Programs. Full instructions are on the update page.

    I may be totally wrong... but without example web addresses, answers can only be guesses.

    Regards.


    Rob^_^

    Sunday, November 27, 2016 11:46 PM
  • Rob,

    If it was Flash related, I don't see why the Oct or Nov Rollup would make a difference.

    There is no pattern in terms of specific sites it is happening on.  Open 4-5 tabs, open various sites on the tabs and close the tabs one by one.  Repeat this process and IE will freeze and display the "Not Responding" error.  Remove the updates I noted above and I can no longer reproduce the issue.

    For the sake of testing I removed Flash from (2) computers and ran the tests again.  Without Flash installed / enabled, the issue still occurs when the noted updates are installed.  And after removing these updates the issue no longer happens.

    Thanks.



    Monday, November 28, 2016 12:46 AM
  • Hi,

    thx for the edification....

    Please see https://technet.microsoft.com/library/security/ms16-118 (my research) which hints it is a 'specially crafted web site' issue....which is a broad statement.... a 'crashing' browser symptom indicates that a browser addon is also involved, rather than just a specially crafted webpage...Q. 3 below should indicate immediately if that is so.

    Please bear with me...

    1. I understand you have already tested in noAddons mode? - iexplore.exe -extoff  is different from using the Addons Manager from within an IE session...the Addons manager changes only take affect when the browser is closed and restarted, any opened tabs that have an COM addon attached still allow the Addon to attach to the tab, until the tab or browser window is closed. Close all open IE windows before launching with iexplore.exe -extoff .

    2. Is it reproducible in an InPrivate session? iexplore.exe -private , by default COM addons  are disabled (see Internet Options>Privacy tab) and storage (DOM and TIF) is sandboxed. You can start an InPrivate session from Tools>InPrivate browsing.... the parent IE window does not leak anything to the IP session window.

    3. Are there any error logs? Start>Control Panel>Administrative tools>Event Viewer>Windows Logs>Application

    a 'Crashing' browser usually indicates an Addon issue... there should be error logs with the "Faulting Module" name which you can use to identify which one.

    4. Does your AV product use an IE Toolbar addon (Nortons)? see my first question.... check for updates to their software products....

    Yours is the first post here, that has had 'crashing' browser problems that are resolved by removing those two updates.

    Regards.


    Rob^_^


    Monday, November 28, 2016 10:14 AM
  • I will do some more testing later but here is some initial feedback for you:

    1.  I will run this test later.

    2.  I will run this test later.

    3.  Nothing in the logs other than the IE hang / crash.  Nothing at all leading up to the issue.

    4.  Of the (10) sites unrelated sites I referenced, there is a mix of AV products.  None has a toolbar component enabled.  All have the exact same issue.

    Please note that (2) additional accounts reported the exact same issue this AM so we are now up to (12) totally unrelated accounts / companies.  Totally different companies, totally different physical locations, totally different computers (and multiple computers from each company), all accessing different sites relative to their industry (doctors, lawyers, plumbing, design firms, etc.).  So getting a list of sites and trying the suggested troubleshooting steps is very difficult because they are totally unrelated companies.  The only constant here is removing the rollups resolves the issues.

    I have multiple links referencing the same issue but I am unable to post them in the forum for some reason. 

    I need to head out to some field calls and will update later.

    Thanks!

    Monday, November 28, 2016 5:40 PM
  • Hi,

    I was assuming that you were referring to your own machines/configurations. Your client machines are bound to be problematic... different AV products, different browser configurations, different browser extensions installed.

    When you said 'sites' I thought web sites, not client sites. Some sample web sites gives us a hint as to what may be the cause (as some websites interact with flash and browser addons). We can visit the sites (if they are publicly accessible) and look at the coding for links with browser addons/extensions.

    Your customers' computers may be using Home editions of windows. They (home editions) do not have the diagnostic tools that Pro and Enterprise editions do. Individual user accounts on pro and enterprise editions, may not have access to some administrative/diagnostic tools.

    Please see http://www.sevenforums.com/tutorials/89919-troubleshooting-internet-explorer-issues.html for an over-view of methods and techniques for 'fixing' IE 'problems'.

    To test if a customers' computer has a browser addon that is causing a problem(highly likely).

    1. On their user account, close all open IE windows, then go Start>Control Panel>Internet Options>Advanced tab, uncheck "Enable third-party browser extensions"

    - also observe their settings for

    Internet Options>Security tab, they should be accepting the default, click "Reset all zones to default"

    Internet Options>Advanced tab, check "Use Software rendering instead of GPU rendering"... !important - you must restart the computer for this change to take affect. This setting affects IE's performance/crashing on websites that use Flash

    OR

    Intenet Options>Advanced tab, just click the "Reset" button, when prompted uncheck any options to delete their cookies or favorites or website data. This resets their IE settings back to their defaults AND disables any COM Addons (toolbars or browser helpers) from being loaded into new windows.

    2.Restart the computer if required or Restart IE and try to reproduce the problem.

    a crashing browser is always associated with a third-party (non MS) product.... always...

    IF its available on the client computer/user account... any crashing browser will log an error event to the windows logs. You may have to log off the user account and use the Administrators account to access the Windows Event Viewer. In those error event records for iexplore.exe you should see entries for the "Faulting Module".... this is the name of the dll 'program/IE addon' that is causing the problem. You can then use that name to identify which IE addon is the cause....

    I am 100% certain that your problem clients' computers crashing browser problem will be caused by one or more of the browser addons that they have installed on their machines and NOT the actual Internet Explorer Security Updates. 100%.

    You can then go to Control Panel>Add/Remove Programs, and locate the addon in the list and uninstall it..... remove it completely from the computer.. (restarts may be required)

    If you want a quick fix for all client computers......

    Just un-check "Enable third-party browser extensions" on the Advanced tab of Internet Options. Close and restart IE for the changes to take affect..... (on domain networked computers you can use GPO to completely lock down the client machines.... preventing users from changing settings or installing unauthorized third-party software).

    Third-party AV products.... must be up-to-date, paid for (trial editions are hawked)...Many of them have browser extensions that are hooked into web browsers... and are the cause of many support calls to MS....these addons are just fluff and serve no purpose other than to collect surfing statistics and malware holistic's.

    Windows Defender is built in to all windows editions, Start>Control Panel>Window Defender... it should be turned on and using the 'real time protection' option... Windows defender helps prevent the installation of known malware and virus.

    Regards.


    Rob^_^

    Monday, November 28, 2016 8:35 PM
  • Rob,

    I am referring to business accounts that we provide managed services for.  So rather than significant differences, they are all very similar with the exception of the sites they access since they are in different vertical markets.

    1.  All are running Window 7 Pro 64-bit.

    2.  All have the latest MS updates installed.

    3.  All have the latest versions of Flash (and Reader) and Java installed.

    4.  90% of our account run Norton Business (Norton Security) the other 10% run MSE.

    I appreciate your feedback but you are pointing to add-ons when I have proven without a doubt that at (12) separate accounts the rollup updates caused issues and uninstalling the rollup resolved the issue.  I have also proven at all (12) sites that the user reporting this issue only see it when multiple tabs are being used. 

    How can you state "I am 100% certain that your problem clients' computers crashing browser problem will be caused by one or more of the browser addons that they have installed on their machines and NOT the actual Internet Explorer Security Updates. 100%."

    What is the logic? 

    (12) sites all start having the exact same problem within a week of each other because of add-ons or (12) sites all start having the exact same problem within a week of each other after the November rollup is installed.  These are businesses I have been managing for anywhere from 6 months to 5 years.  I control everything installed at these sites and there is absolutely not a mish mash of garbage installed on any computer at any of the (12) sites.

    1.  I already uninstalled flash and the issue continues (until the rollup is uninstalled).

    2.  I already reset IE settings and this made no difference whatsoever.

    3.  This is happening on computers running Norton Business and MSE, both of which are completely up to date and for Norton, all add-ons are disabled.

    4.  There are no active add-ons with the exception of Java and Flash.  Both have been disabled (and removed for that matter) as part of troubleshooting and this makes no difference at all.

    5.  I did all of the above before posting to this forum...I only posted after exhausting all reasonable troubleshooting.

    Any additional feedback you have would be appreciated but the add-on angle just doesn't seem logical to me.

    Tuesday, November 29, 2016 5:12 AM
  • YM,

    And you have multiple tabs open.  Multiple tabs being used and the updates are the common factors at all sites that have reported the issue.

    My guess is you will continue to see this issue as long as you have multiple tabs open.  It would be helpful if you would post again to verify if you continue to see this.

    Thanks.

    Tuesday, November 29, 2016 5:15 AM
  • Hi,

    no I don't see that on my machines.... because I don't have third-party addons (COM toolbars and browser helpers) installed.

    Apparently your customers are the only handful.

    please see this search result. http://www.bing.com/search?q=KB3185330+causes+IE11+to+crash

    "doubt that at (12) separate accounts the rollup updates caused issues and uninstalling the rollup resolved the issue."

    I am sure it does, because

    The SECURITY UPDATES are blocking one of the Installed Addons (probably Nortons)

    please see these search results http://www.bing.com/search?q=nortons+causes+IE11+to+crash+after+installing+KB3185330

    here is a link to the Nortons support forum that identifies that IPSEng32.dll is the culprit https://support.norton.com/sp/en/us/home/current/solutions/v108623038_EndUserProfile_en_us

    from doing something that MS and we (I accept security updates with blind faith) (and presumably your clients!) would not want it to do.....they are critical updates! There is software on those machines that is causing IE to crash because it conflicts with the security updates... remove one or the other resolves the problem... make a choice..

    apparently Nortons have already issued a patch for their products (see their forum post above)... please try it on those machines that have Nortons installed,

    In all probability (1/0%) though...

    All iexplore.exe 'crashes' are logged in the Windows logs.

    Your 'fix' is to remove the SECURITY UPDATES.

    My suggested fix is to find out WHY the SECURITY UPDATES cause one of the installed addons to raise errors (which are logged in the Windows logs.)

    You can remove the SECURITY UPDATES if your want... but I'm suggesting ....

    Start>Control Panel>Administrative Tools>Event Viewer>

    Please see these instructions for enabling and using Event Viewer http://www.windowsnetworking.com/kbase/WindowsTips/Windows7/AdminTips/Miscellaneous/EnablingeventloggingforInternetExplorer.html

    Please see  http://www.sevenforums.com/tutorials/89919-troubleshooting-internet-explorer-issues.html

    In the error reports, there will be an entry for the "Faulting module"... it may not be IPSEng32.dll (nortons), it may be something else...

    If you would like to post back with the Windows Error logs for IE, we could help you do your job and figure out which third party product it is.... there is pleasure in finding things out for yourself though.

    I do not work for, nor represent MS...

    I think the thread has crashed.... thx


    Rob^_^




    Tuesday, November 29, 2016 6:00 AM
  • sample of an IE11 crash.

    Put that way I can say Me too!   ; )

    Have you looked in the Reliability Monitor for what the details are?  If it is an APPCRASH you can open the associated WER report and get the list of loaded modules.

    Hmm...  mine are APPCRASH

    <dir>

    APPCRASH

    Application Name: IEXPLORE.EXE

    Application Version: 11.0.14393.0

    Application Timestamp: 57899082

    Fault Module Name: StackHash_1bf2

    Fault Module Version: 10.0.14393.447

    Fault Module Timestamp: 5819be95

    Exception Code: c0000374

    Exception Offset: PCH_AA_FROM_ntdll+0x0006E2CC

    OS Version: 10.0.14393.2.0.0.256.48

    </dir>

    The Exception Code is a Heap corruption supposedly.

    It has happened often enough that there is a Bucket ID: 

    8c7d068cd7cbf98ceb10463a7cef416c (108548930916)

    I used this PowerShell to see that there were a flood of them on the 12th and 16th, just a few lately

    $IEAC = LS -Re -Fi *.WER -Fo -Ea "SilentlyContinue" | Where FullName -match "IEXPLORE" | Sort LastWriteTime

    $ieac | Select LastWriteTime, FullName | Out-String -Stream | Group -Property {$_.Substring(0,10)} | where Name -match "2016" | ft Count, Name

    I will try to check what the Bucket ID are.  Maybe I will be able to use Select-XML for that.   <eg>



    Robert Aldwinckle
    ---

    Tuesday, November 29, 2016 6:13 AM
    Answerer
  • Rob,

    Again, I appreciate your help but there is no logic pointing a finger at "add-ons" when you have no idea what add-ons even exist and when I have told you until I am blue in the face that all add-ons have been disabled and 3rd party products have been removed as part of troubleshooting.  I have also told you repeatedly that this is also happening on computers running MSE.

    And your Norton link was from July 2016....totally irrelevant.

    Appreciate your time but not interested in the add-on theory as it simply does not apply here. 

    No need for the condescending nonsense.  Just because someone doesn't agree with you doesn't mean you need to throw sarcasm and insults. 


    Tuesday, November 29, 2016 6:40 AM
  • Robert A.,

    Any additional feedback would be appreciated.  As I indicated, I really believe this is tied to multiple tabs being open and does not occur when running an instance of IE w/ a single tab.

    Tuesday, November 29, 2016 6:42 AM
  • Internet Explorer crashes frequently when I have a Norton ...

    <cite>https://support.norton.com/sp/en/us/home/current/solutions/v...</cite>

    11/07/2016 · How to fix "Internet Explorer Has Stopped ... run LiveUpdate in your Norton product. PRODUCTS ... Internet Explorer crashes frequently when I have a ...DOCID: v108623038_EndUserProfile_en_us
    Operating System: Windows
    Last modified: 07/11/2016


    Rob^_^

    Tuesday, November 29, 2016 7:04 AM
  • Rob,

    Get a grip, learn to read before you post redundant, pointless information and please leave this thread.  You are only here to antagonize at this point and offer no value.

    Tuesday, November 29, 2016 7:30 AM
  • $IEAC = LS -Re -Fi *.WER -Fo -Ea "SilentlyContinue" | Where FullName -match "IEXPLORE" | Sort LastWriteTime

    $ieac | Select LastWriteTime, FullName | Out-String -Stream | Group -Property {$_.Substring(0,10)} | where Name -match "2016" | ft Count, Name

    I will try to check what the Bucket ID are.  Maybe I will be able to use Select-XML for that.  

    Apparently I was wrong.  WER file are not XML.  They are a kind of list of values.  Anyway, here is a way of summarizing mine since the 12th.

    PS>$ieac12 = $ieac | where LastWriteTime -GT "2016-11-12"
    PS>$ieac12.FullName | Out-String -Stream | Select-String "AppCrash" | ForEach-Object {GC $_ | Select-String "Bucket"} | sort | group | ft Count, Name -AutoSize
    
    Count Name
    ----- ----
       30 Response.BucketId=164debefe56ef41b39796321d728984d
        2 Response.BucketId=513704dbdadfd9a31b95caa5406011cb
        8 Response.BucketId=8c7d068cd7cbf98ceb10463a7cef416c
       18 Response.BucketId=958db85b6527caa2cc94b4bc19f606cf
        6 Response.BucketId=b412581ec2f297000ab07ff6af083ff9
        6 Response.BucketId=c49e5ddbcd099227a56fb48b613045d0
        6 Response.BucketId=fadc37914d38ee1c79361bb7c7ec61d9
       14 Response.BucketTable=1
        2 Response.BucketTable=4
       60 Response.BucketTable=5
        8 Response.LegacyBucketId=108548930916
        6 Response.LegacyBucketId=108558336476
       30 Response.LegacyBucketId=116217225962
       18 Response.LegacyBucketId=116280930376
        6 Response.LegacyBucketId=116280996176
        6 Response.LegacyBucketId=116281007477
        2 Response.LegacyBucketId=120615092323
    
    
    Are BucketId a per user thing or common to all?  Also, I don't know what a BucketTable is.  Note that the total count in each category is 76, so each crash report presumably had one of each.



    Robert Aldwinckle
    ---

    Tuesday, November 29, 2016 2:36 PM
    Answerer
  • Rob,

    I am referring to business accounts that we provide managed services for.  So rather than significant differences, they are all very similar with the exception of the sites they access since they are in different vertical markets.

    1.  All are running Window 7 Pro 64-bit.

    2.  All have the latest MS updates installed.

    3.  All have the latest versions of Flash (and Reader) and Java installed.

    4.  90% of our account run Norton Business (Norton Security) the other 10% run MSE.

    I appreciate your feedback but you are pointing to add-ons when I have proven without a doubt that at (12) separate accounts the rollup updates caused issues and uninstalling the rollup resolved the issue.  I have also proven at all (12) sites that the user reporting this issue only see it when multiple tabs are being used. 

    How can you state "I am 100% certain that your problem clients' computers crashing browser problem will be caused by one or more of the browser addons that they have installed on their machines and NOT the actual Internet Explorer Security Updates. 100%."

    What is the logic? 

    (12) sites all start having the exact same problem within a week of each other because of add-ons or (12) sites all start having the exact same problem within a week of each other after the November rollup is installed.  These are businesses I have been managing for anywhere from 6 months to 5 years.  I control everything installed at these sites and there is absolutely not a mish mash of garbage installed on any computer at any of the (12) sites.

    1.  I already uninstalled flash and the issue continues (until the rollup is uninstalled).

    2.  I already reset IE settings and this made no difference whatsoever.

    3.  This is happening on computers running Norton Business and MSE, both of which are completely up to date and for Norton, all add-ons are disabled.

    4.  There are no active add-ons with the exception of Java and Flash.  Both have been disabled (and removed for that matter) as part of troubleshooting and this makes no difference at all.

    5.  I did all of the above before posting to this forum...I only posted after exhausting all reasonable troubleshooting.

    Any additional feedback you have would be appreciated but the add-on angle just doesn't seem logical to me.

    Sorry for the trouble. Did you try disabling your Norton completely to check if there are any issues repeating? Let us know if you need any help.

    Thanks

    Raj

    Norton Support

     
    Wednesday, November 30, 2016 3:04 AM
  • Raj,

    Are you aware of any specific Norton related issues that cause problems only after KB3185330 or KB3197868 are installed?

    To answer your question, yes.  Norton has been disabled, the toolbar was never installed in the 1st place and none of this makes any difference. 

    But again, if you are aware of a known issue it would definitely be helpful to get specific feedback from you.

    Thanks.

    Monday, December 5, 2016 10:31 PM
  • Reported by (5) more totally unrelated businesses this week. Including (2) that received brand new computers with a fresh install of Windows 7, all Windows 7 updates, NO ANTI-VIRUS (for the sake of troubleshooting) and NO ADD-ONS.

    Someone from Microsoft has to be able to provide assistance.

    Wednesday, December 7, 2016 10:56 PM
  • Raj,

    Are you aware of any specific Norton related issues that cause problems only after KB3185330 or KB3197868 are installed?

    To answer your question, yes.  Norton has been disabled, the toolbar was never installed in the 1st place and none of this makes any difference. 

    But again, if you are aware of a known issue it would definitely be helpful to get specific feedback from you.

    Thanks.

    Sorry, there is no known issue. As disabling Norton does not eliminate the issue, it might not be related to Norton. Let me know if you need any help with your Norton. 

    Thanks

    Raj

    Norton Support


    Saturday, December 10, 2016 2:53 AM
  • Reported by (5) more totally unrelated businesses this week. Including (2) that received brand new computers with a fresh install of Windows 7, all Windows 7 updates, NO ANTI-VIRUS (for the sake of troubleshooting) and NO ADD-ONS.

    Someone from Microsoft has to be able to provide assistance.

    NO-ADDONS does not stop Flash ActiveX controls from being loaded. Tools>Manage Addons>Show All Addons

    do they have the Shockwave flash ActiveX control installed? (flash.ocx now distributed by MS, was previously Macromedia Flash>Adobe Flash)

    Name:                   Shockwave Flash Object
    Publisher:              Microsoft Windows Third Party Application Component
    Type:                   ActiveX Control
    Architecture:           32-bit and 64-bit
    Version:                23.0.0.207
    File date:              ‎Saturday, ‎29 ‎October ‎2016, ‏‎10:56 AM
    Date last accessed:     ‎Today, ‎10 ‎December ‎2016, ‏‎3 minutes ago
    Class ID:               {D27CDB6E-AE6D-11CF-96B8-444553540000}
    Use count:              3779
    Block count:            16952
    File:                   Flash.ocx
    Folder:                 C:\Windows\System32\Macromed\Flash

    To test.... disable the ActiveX component from Manage Addons... close all open IE windows and retest...
    All crashes are logged in the Windows Event Viewer..... there SHOULD be entries in there...

    Without links to problem websites or Windows logs details our guesses are well....guesses.


    Rob^_^

    Saturday, December 10, 2016 4:10 AM
  • Rob,

    If nothing else you are persistent.  If you would for once in your life read the information that was already provided to you, you would see the issue exists without flash even being installed.  The issue exists with NO ADD-ONS!!!!!

    BTW Add-On Rob, the issue seems to have been fixed in the December roll-up.

    Wednesday, December 14, 2016 6:01 AM