Updater starting IE [still] at login

"MowGreen [MVP]" <> wrote in
news::

> My HOST file is clean and my home page is set correctly. This is a
> run-once type of deal at either start up or boot up. At first start or
> reboot IE will open on it's own and go to
> http://update.microsoft.com/microsof....aspx?ln=en-us
> Closing out IE or simply navigating somewhere else see's the end of
> the update page until the next startup or reboot.

>> I've seen this behavior before, Markus. Resetting the Home page, even
>> though it appears to be set the way you want it, *usually* resolves
>> the issue. Plus, deleting Cookies, History, TIF.
>> As to why IE does this ...
>>
>> As for StopSign :
>> http://www.spywarewarrior.com/rogue_...re.htm#ss_note
>>
>> It was on a Rogue/Suspect Anti-Spyware Products page but has been
>> delisted.

I usually get suspicious when a site tells you their competitor is
"rogue." In fact, I think I saw spywarewarrior listed as rouge itself
on castle cops. I had the bad experience with Ad-Aware calling many of
their competitor's files as malware thus breaking them (not to mention
that Ad-Aware's free program only downloads definitions that are 6
months old or older)

My finale word, MS Security Center didn't pick up on your Kaspersky, but
does recognize and lists as trusted the StopSign stuff I have (and OK,
I'll be real honest here, SS comes with a online game called the 4th
coming ;-) $5 month (pkg deal--used to be $10 when I was using them as
my dialup ISP...using broadband now), and all the free support I
need--can't beat it. YMMV

Think about it, what if everyone believed everything written about
Microsoft?

Anyhow, I'm begging you here, I've done everything you've asked, and yet
nothing. I've gone into administrative tools->services and disabled
both BITS and Automatic Updates; I've gone into IE->tools->add-ons and
disabled anything even remotely related to updates. Now IE still starts
but goes to simply www.windowsupdate.com and is just a blank page. I'm
getting closer me thinks

Do you, or anyone reading this, know of a tool that will log system
calls or maybe registry calls? Something has to be calling IE and
loading the address bar with the string www.windowsupdate.com. I get a
few seconds after startup to play with. Tried viewing processes with
taskman but all that came up new was IEXPLORE.EXE*32 when it started.
The calling process either started/ended too fast, or is just a registry
or dll call. Arrrrrrggggh!

Oh, and a little note here: The trouble seemed to start when I
downloaded and installed Microsoft Update (of which I think I've
removed)

Thanks for any help,
Markus

One thing I forgot to ask: Is there an uninstaller for the updater? Or how
about a tool or good instructions on how to completely remove IE?

Markus

It is most likely due to a setting in your Internet Explorer browser.
Bring up I.E.
Select Tools > Internet Options > Advanced tab
Look at "Browsing" category

Uncheck the line "Automatically check for Internet Explorer updates"

Apply change. Press OK.

Then see if problem is gone. Otherwise, only if you know how to use Regedit: :

Take a look at this key
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

What is the value for Start Page
What is the value for NoUpdatecheck

--
Maurice N
MS-MVP Windows (Shell / User), Aumha.net VSOP , DTS-L
-----

"Markus" wrote in message news:Xns97B3CAE47DE53markus4uwavecablecom@216.196. 97.142...
> I usually get suspicious when a site tells you their competitor is
> "rogue." In fact, I think I saw spywarewarrior listed as rouge itself
> on castle cops. I had the bad experience with Ad-Aware calling many of
> their competitor's files as malware thus breaking them (not to mention
> that Ad-Aware's free program only downloads definitions that are 6
> months old or older)
>
> My finale word, MS Security Center didn't pick up on your Kaspersky, but
> does recognize and lists as trusted the StopSign stuff I have (and OK,
> I'll be real honest here, SS comes with a online game called the 4th
> coming ;-) $5 month (pkg deal--used to be $10 when I was using them as
> my dialup ISP...using broadband now), and all the free support I
> need--can't beat it. YMMV
>
> Think about it, what if everyone believed everything written about
> Microsoft?
>
> Anyhow, I'm begging you here, I've done everything you've asked, and yet
> nothing. I've gone into administrative tools->services and disabled
> both BITS and Automatic Updates; I've gone into IE->tools->add-ons and
> disabled anything even remotely related to updates. Now IE still starts
> but goes to simply www.windowsupdate.com and is just a blank page. I'm
> getting closer me thinks
>
> Do you, or anyone reading this, know of a tool that will log system
> calls or maybe registry calls? Something has to be calling IE and
> loading the address bar with the string www.windowsupdate.com. I get a
> few seconds after startup to play with. Tried viewing processes with
> taskman but all that came up new was IEXPLORE.EXE*32 when it started.
> The calling process either started/ended too fast, or is just a registry
> or dll call. Arrrrrrggggh!
>
> Oh, and a little note here: The trouble seemed to start when I
> downloaded and installed Microsoft Update (of which I think I've
> removed)
>
> Thanks for any help,
> Markus

P.S. As noted by Robear Dyer:
<q> NB: Anti-malware tools like Ad-Watch, Spybot (Tea Timer; Immunize) and Spysweeper have settings which may prevent changes such as the above from "sticking".
</q>

--
Maurice N
MS-MVP Windows (Shell / User), Aumha.net VSOP , DTS-L
-----

"Maurice N ~ MVP" <> wrote in
news:#:

> It is most likely due to a setting in your Internet Explorer browser.
> Bring up I.E.
> Select Tools > Internet Options > Advanced tab
> Look at "Browsing" category
>
> Uncheck the line "Automatically check for Internet Explorer
> updates"
>
> Apply change. Press OK.

Was already unchecked.

> Then see if problem is gone.

Nope.

> Otherwise, only if you know how to use
> Regedit: :
>
> Take a look at this key
> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
>
> What is the value for Start Page

http://weather.yahoo.com/forecast/USWA0406_f.html

> What is the value for NoUpdatecheck

1

> P.S. As noted by Robear Dyer:
> <q> NB: Anti-malware tools like Ad-Watch, Spybot (Tea Timer;
Immunize) and Spysweeper have settings which may prevent changes such as
the above from "sticking".
> </q>

Don't have any of those products installed.

As a refresher...Sequence of events:

- Start up, reboot, or log off/log in to account will see windows start.
- A few seconds go by and IE will open on it's own with
www.windowsupdate.com in the address bar.

NOTE: If I open IE right away it goes to my home page on yahoo, but then
it goes to the update site.

- Navigate away from the update site by any means, to include hitting
the "home" icon on the IE toolbar, and as long as I don't log off or
reboot, I'll never see the www.windowsupdate.com page again.

-Markus

STRESS: Resisting the desire to choke the living **** out of a computer
that desperately needs it....

This is still a mystery. One possibility is that you have "something" set in the startup vectors.

Check these folders , and their contents :
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\<Your-USER-Account>\Start Menu\Programs\Startup

If you're a complete novice, please take extreme care. You should probably defer this next section; but rather logoff / reboot pc/ and see if problem re-occurs.

Registry lookup:

Go to Sart | Run | Regedit <enter>
In Registry Editor, select My Computer (on left tree view) by clicking once,
then choose File , Export. This will begin a dialog to save a copy of the
whole registry.
Give it a name. It has a .reg extension.

Then do a search for the Keys noted below and review carefully .

Programs may "autorun" due to entries in the system registry. "Run" keys cause
programs to automatically run each time that a user logs on.

You would be looking for any mention of IEXPLORE or WUPDMGR that "may" be listed under a RUN key.

The Windows XP registry includes the following Run keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunOnce

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
and ...ditto ....\RunServices

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnce

If you find any references to IEXPLORE or WUPDMGR is these keys (and these keys only) remove the sub-key that has that value.

If all else fails, change your home page to something other than the weather page.

--
Maurice N
MS-MVP Windows (Shell / User), Aumha.net VSOP , DTS-L
-----


"Markus" wrote in message news:Xns97B3DEA25765markus4uwavecablecom@216.196.9 7.142...
> "Maurice N ~ MVP" wrote in
> news:#:
>
>> It is most likely due to a setting in your Internet Explorer browser.
>> Bring up I.E.
>> Select Tools > Internet Options > Advanced tab
>> Look at "Browsing" category
>>
>> Uncheck the line "Automatically check for Internet Explorer
>> updates"
>>
>> Apply change. Press OK.
>
> Was already unchecked.
>
>> Then see if problem is gone.
>
> Nope.
>
>> Otherwise, only if you know how to use
>> Regedit: :
>>
>> Take a look at this key
>> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
>>
>> What is the value for Start Page
>
> http://weather.yahoo.com/forecast/USWA0406_f.html
>
>> What is the value for NoUpdatecheck
>
> 1
>
>> P.S. As noted by Robear Dyer:
>> <q> NB: Anti-malware tools like Ad-Watch, Spybot (Tea Timer;
> Immunize) and Spysweeper have settings which may prevent changes such as
> the above from "sticking".
>> </q>
>
> Don't have any of those products installed.
>
> As a refresher...Sequence of events:
>
> - Start up, reboot, or log off/log in to account will see windows start.
> - A few seconds go by and IE will open on it's own with
> www.windowsupdate.com in the address bar.
>
> NOTE: If I open IE right away it goes to my home page on yahoo, but then
> it goes to the update site.
>
> - Navigate away from the update site by any means, to include hitting
> the "home" icon on the IE toolbar, and as long as I don't log off or
> reboot, I'll never see the www.windowsupdate.com page again.
>
> -Markus
>
> STRESS: Resisting the desire to choke the living **** out of a computer
> that desperately needs it....
>
>
>