IE will not close down unless I terminate the IEXPLORE process


A user reported a problem with IE5 that when he went into a browser session he couldn't close the window.  I had a look and the 'X', File>Close or Alt+F4 wouldn't close IE only killing the IEXPLORE.EXE process would.

I then upgraded to IE6, and the same problem persists.

I then upgraded from SP3 to SP4 thinking some windows files may have been corrupted, still no joy.
(I was going to run SFC /SCANNOW but didn't have SP3 on a CDR at hand so upgraded to SP4)

I have reset all the Internet Options back to default as well.

Does anyone have any idea's on what to do?

LVL 15
Rob StoneAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Try doing these

Repair IE :

Start > Run rundll32 setupwbv.dll,IE6Maintenance "C:\Program Files\Internet Explorer\Setup\SETUP.EXE" /g


Start > Run rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\ie.inf

Reinstall IE:

Description of the Internet Explorer Repair Tool

How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP

Repair Internet Explorer 6

Also check to see if he/she has got the latest updates for IE

The 7 Worst Nightmares of a Sysadmin

Fear not! To defend your business’ IT systems we’re going to shine a light on the seven most sinister terrors that haunt sysadmins. That way you can be sure there’s nothing in your stack waiting to go bump in the night.

Rob StoneAuthor Commented:
Will check for spyware but would be suprised if thats it.

Tried the first rundll32 option and that didn't fix it and the repair didn't either.  I will try the  rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\ie.inf as I've not seen that one before.

Will check updates for IE too. It was IE6 SP1 but I think there is a new update.


Running Norton? (
Disable auto-protect from Norton's tray icon and see if IE comes back to life (may take a few moments).
Rob StoneAuthor Commented:
Not running Norton.

Ran Ad/Spyware and it did detect a few files but after cleaning still have the same problem.

The other rundll32 command also didn't fix it.

I have emailed my mate at MS to see if he can find anything out on this (its about time I used his resources).

I have also searched google and found one other forum with the same problem but no answer :-(  

I'm not going to do all what symantec say to do a clean boot, that would take bloody ages and I don't think that will help to be honest.  If the worst happens I will use him as the test subject for the new XP build being sent out in a few weeks (which he is hoping for I think!)  

If I find the answer I'll let you guys know.
does this problem exist in all user profiles?  if not just log in as an admin, rename the users folder to name_old (or what ever) and log off admin and have that user log back in.  it will recreate the profile using the default users settings.  all that is left is to copy documents (they should be on a network share for security) , internet favorites, remap network drives, install printers, and set up mail.  it seems like a lot, but it is a sure thing and better than uninstalling and reinstalling.

Hope it helps,

Rob StoneAuthor Commented:
Sorry, I remembered that I never mentioned that I tried different profiles on my way home last night so unfortuantly that doesn't work either.
can i get a list of processes that are running when you try and close IE.   you probably dont want to hear it, but a rebuild may be necessary.
Boot to Safe Mode with networking and see if the problem still exists.  
If not, you can try weeding through the services to find the culprit.  
Start->Run->MSCONFIG will allow you to disable all non-MS services.
Identify the critical ones that you need and load those as well (Blkviper's site that I commented on above should help with explanations of each service).  Reboot and determine if the problem is still present.
If not, continue to add servcies back in your configuration until you've found the bugger.
More often than not, one of these services, and thus its underlying application, will be the source of your conflict.
I had a simmilar problem with outlook not closing and in the end it was a problem of the antivirus. The user logged in did not have permissions over the antivirus log file. McAfee would leave outlook in a "closing" state. Once the permissions for the log file were modified everything went back to normal (yes, I know, what's the point of an antivirus log file when everyone can modify it...)

If you have some time, you could try regmon and filemon (from and see what files are accessed while you try to close IE. Then try to see what registry keys are accessed. Usually "Access Denied" or "file not found" -style messages are your biggest chances of finding the problem.
some other wild guess.

From the IE properties, in the temporary internet files' settings, view the "objects". Maybe you have some activeX control that is behaving improperly.

Does the problem exist if you just open a local html file?

Have you tried to uninstall all antivirus-like software?
what about uninstalling IE completely and reinstall?
Rob StoneAuthor Commented:

Little update for everyone.

I thought maybe the NoClose virus was on the machine so updated AV signatures but it found nothing.

Ralonso, I have tried uninstalling IE (as far as I can) and reinstalling but no luck.
I will check out the local HTML file and ActiveX controller.

Don't think its a permission issue as it happens with local admin too.

Still waiting to go through the services too.
I think I found it! (forget the las comment)

there's a policy:
User Configuration\administrative templates\windows components\internet explorer\browser menus
"File menu: disable closing the browser and explorer windows"

(this setting includes alt+f4)

This will map to some key in the registry in
File Menu: Disable closing the browser and Explorer windows
KEY: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions
DWORD: NoBrowserClose = 1

Someone may have used a tool like ilock, registrytuner, tweakingtoolbox or simmilar.
By the way, you may want to take a look at this page

that has the mappings of group policies to registry keys (microsoft is always so helpful with this sort of stuff...)

I hope that one worked
Rob StoneAuthor Commented:

Gave it ago but still didn't fix it.
The NoBrowserClose was set to 0?

Does the problem happen if logging in with a freshly created local user account (no existing profile)?

is there any registry activity when attempting to close IE?

have you tried to remove all registry information in
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer
and then install again IE?

Does the problem happen in outlook express?
Rob StoneAuthor Commented:
NoBrowserClose was set to 0 and 1 (tried both)
freshly created local user account - still happens
Haven't checked if there was any activity with regmon
Don't use OE but will try tomorrow (hopefully)
Rob StoneAuthor Commented:
Newest update.

Ghosted dodgy 2K build to another laptop so I can have more time on this baby!

Problem persists after disableing nearly all services, only left the major ones running.

I am about to create the local user account and test OE.  The user also pointed out that when in a secure site he just gets Done appear with a white screen.  I've seen that before too but never managed to fix that either (updates didn't fix), and I am wondering if its releated.
Rob StoneAuthor Commented:

Found the answer on a very hard to find forum.

Deleting the registry key below does the trick:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

I will refund the points and leave this on here as someone may find this easier than what I had to go through.
Sounds like a great forum (wouldn't be, now would it? :-)
I think I found that forum :)

by the way, did you keep a copy of the CLSIDs present in your registry?

It looks like some software (maybe spyware) had a problem and by tracking the CLSID you could find what it actually was

(maybe a spyware removal tool deleted the related keys in CLASSESS_ROOT but left that key there)
Rob StoneAuthor Commented:
This was what was there.  Doesn't mean much to me to be honest.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39AF31DD-EAFC-45EA-A56C-385B52E25CC0}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4CEBBC6B-5CEE-4644-80CF-38980BAE93F6}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6B12DABB-0B7C-44FA-B0B3-4BAFF3790256}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BC0D2038-2DE5-4A6F-92BC-B18A3E0DE32A}]

The first one is ok (Acrobat reader, you may need to reinstall it)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

But for the rest...
The first one is SnagIT (SnagITBHO.dll)

The following three are from some other spyware (inetspeak)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39AF31DD-EAFC-45EA-A56C-385B52E25CC0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4CEBBC6B-5CEE-4644-80CF-38980BAE93F6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6B12DABB-0B7C-44FA-B0B3-4BAFF3790256}]

Look at:

And the last one is WurldMedia:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BC0D2038-2DE5-4A6F-92BC-B18A3E0DE32A}] -


You will have tons of crap in your machine (registered dll's, registry entries,...) Consider reinstalling it and giving a shout to the user

Rob StoneAuthor Commented:
Cheers for that Ralonso.

How did you get the info?
run a search on the CLSIDs in google (i.e. 06849E9F-C8D7-4D59-B87D-784B7D6BE0B3). I'm not very confident on this but I believe that the CLSIDs are unique identifiers, therefore every application will have its own.

you may also find this page interesting:

The pages in are quite nice too, they tell you what dll's to unregister and remove, registry files and so on. I believe that you will be able to track the same structure of files/registry for snagIT

Rob StoneAuthor Commented:
You were right on the Snag-it as that is used here and adobe.

PAQed, with points refunded (200)

E-E Admin

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.