In the past few weeks I'm been having many problems with IE (both IE7 and
IE6). IE has huge use of GDI handles which is causing GDI allocation
failures in other applications. After a few hours of use IE7, for example,
racks up over 2,700 in use GDI objects. When I close all tabs (open new tab
then close all others), GDI handle usage only goes down just below 2,000).
When IE7 starts it's only using 377 or so GDI handles.

--
http://www.peterRitchie.com/blog/
Microsoft MVP, Visual Developer - Visual C#

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L.ORG http://66.39.69.143/

Peter Ritchie [C# MVP] wrote:
> In the past few weeks I'm been having many problems with IE (both IE7 and
> IE6). IE has huge use of GDI handles which is causing GDI allocation
> failures in other applications. After a few hours of use IE7, for
> example,
> racks up over 2,700 in use GDI objects. When I close all tabs (open new
> tab
> then close all others), GDI handle usage only goes down just below 2,000).
> When IE7 starts it's only using 377 or so GDI handles.

This has nothing to do with what I'm seeing. I'm viewing GDI Objects in Task
Manager and Process explorer and witnessing it on a freshly created Windows
XP SP2 computer with IE7 and spyware, virus and firewals installed.

--
Browse http://connect.microsoft.com/VisualStudio/feedback/ and vote.
http://www.peterRitchie.com/blog/
Microsoft MVP, Visual Developer - Visual C#


"PA Bear" wrote:

> Unexplained computer behavior may be caused by deceptive software
> http://support.microsoft.com/kb/827315
>
> Run a /thorough/ check for hijackware, including posting your hijackthis log
> to an appropriate forum.
>
> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
> http://aumha.org/a/quickfix.htm
> http://aumha.net/viewtopic.php?t=5878
> http://wiki.castlecops.com/Malware_R...:_Introduction
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine2.blogspot.com/
> http://www.elephantboycomputers.com/...moving_Malware
>
> When all else fails, HijackThis v2.0.2
> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
> It will help you to both identify and remove any hijackware/spyware with
> assistance from an expert. **Post your log to
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://castlecops.com/forum67.html,
> http://forums.subratam.org/index.php?showforum=7,
> http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
> analysis, not here.**
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin http://aumha.net
> DTS-L.ORG http://66.39.69.143/
>
> Peter Ritchie [C# MVP] wrote:
> > In the past few weeks I'm been having many problems with IE (both IE7 and
> > IE6). IE has huge use of GDI handles which is causing GDI allocation
> > failures in other applications. After a few hours of use IE7, for
> > example,
> > racks up over 2,700 in use GDI objects. When I close all tabs (open new
> > tab
> > then close all others), GDI handle usage only goes down just below 2,000).
> > When IE7 starts it's only using 377 or so GDI handles.
>
>

I'd most certainly have posted a much different reply if you'd included that
information in your first post, Peter. We're not mind-readers here. <w>

1. Does this behavior persist if you start IE7 in No Add-ons mode? To start
IE7 in No Add-ons mode:

Right-click on the blue IE desktop icon and select Start without Add-ons; or

Start > (All) Programs > Accessories > System Tools > Internet Explorer (No
add-ons).

Troubleshooting and Internet Explorer’s (No Add-ons) Mode:
http://blogs.msdn.com/ie/archive/2006/07/25/678113.aspx

2. Does the problem persist if you Reset IE7 Settings (RIES)?
http://support.microsoft.com/kb/923737 <= Read before using!

3. If you uninstall (a) IE7 (which automatically returns you to IE6), (b)
all toolbars and (c) all third-party Windows Themes (including Window
Blinds) and do NOT reinstall IE7, does this behavior persist? If it does,
do NOT reinstall IE7.

Uninstalling IE7
http://www.ie-vista.com/kbase2.html

How to uninstall Internet Explorer 7:
http://support.microsoft.com/kb/927177

IE7 (Un)Installation and Anti-Malware Applications:
http://blogs.msdn.com/ie/archive/200...lications.aspx

4. Required reading IMHO before reinstalling IE7:

Sandi's Installation Tips <= FOLLOW THESE TIPS TO THE LETTER!
http://www.ie-vista.com/known_issues.html#pre-install

[And I strongly recommend using
http://www.microsoft.com/windows/dow.../getitnow.mspx as the
installation source, not Automatic/Windows Update.]

Make *certain* that you check in at Windows Update immediately after
reinstalling IE7 to install any critical updates offered. If Optional
Updates category offers Root Certificates update, I recommend installing it
to take full advantage of IE7's additional security.
--
~PA Bear

Peter Ritchie [C# MVP] wrote:
> This has nothing to do with what I'm seeing. I'm viewing GDI Objects in
> Task Manager and Process explorer and witnessing it on a freshly created
> Windows XP SP2 computer with IE7 and spyware, virus and firewals
> installed.
>
>
>> Unexplained computer behavior may be caused by deceptive software
>> http://support.microsoft.com/kb/827315
>>
>> Run a /thorough/ check for hijackware, including posting your hijackthis
>> log to an appropriate forum.
>>
>> Checking for/Help with Hijackware
>> http://aumha.org/a/parasite.htm
>> http://aumha.org/a/quickfix.htm
>> http://aumha.net/viewtopic.php?t=5878
>> http://wiki.castlecops.com/Malware_R...:_Introduction
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://defendingyourmachine2.blogspot.com/
>> http://www.elephantboycomputers.com/...moving_Malware
>>
>> When all else fails, HijackThis v2.0.2
>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
>> It will help you to both identify and remove any hijackware/spyware with
>> assistance from an expert. **Post your log to
>> http://forums.spybot.info/forumdisplay.php?f=22,
>> http://castlecops.com/forum67.html,
>> http://forums.subratam.org/index.php?showforum=7,
>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
>> expert
>> analysis, not here.**
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-Windows (IE, OE, Security, Shell/User)
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L.ORG http://66.39.69.143/
>>
>> Peter Ritchie [C# MVP] wrote:
>>> In the past few weeks I'm been having many problems with IE (both IE7
>>> and
>>> IE6). IE has huge use of GDI handles which is causing GDI allocation
>>> failures in other applications. After a few hours of use IE7, for
>>> example,
>>> racks up over 2,700 in use GDI objects. When I close all tabs (open new
>>> tab
>>> then close all others), GDI handle usage only goes down just below
>>> 2,000).
>>> When IE7 starts it's only using 377 or so GDI handles.

"Peter Ritchie [C# MVP]" <PRSoCo@newsgroups.nospam> wrote in message
news:4F3D6EBB-307E-42EB-9401-24C114D325E6@microsoft.com...
> In the past few weeks I'm been having many problems with IE (both IE7 and
> IE6). IE has huge use of GDI handles which is causing GDI allocation
> failures in other applications. After a few hours of use IE7, for example,
> racks up over 2,700 in use GDI objects. When I close all tabs (open new tab
> then close all others), GDI handle usage only goes down just below 2,000).
> When IE7 starts it's only using 377 or so GDI handles.


Post an example publicly accessible site? E.g. perhaps this one is still
available... <eg>

Subject: Re: IE7 gif image problem. 10/7/2007 1:49 PM PST

By: dowelld


http://www.microsoft.com/communities...632&sloc=en-us

Also, there was a postscript in another thread concerning my speculation
about win32k.sys

<quote>
BTW I have since come to the opinion that it may be better to wait for XPsp3
to provide a fully patched version of win32k.sys. E.g. although there are QFE
versions of it available in recent security patches it then comes with other
modules which you might not want the QFE version for and if you only extracted
the QFE version of win32k.sys from it who knows whether you would be missing
some unexpected dependencies as a result? Still, if someone is keen to try
the idea, it's there... <eg>
</quote>

(Community Alt-7 search of this newsgroup for
"GDI Objects" aldwinckle
)


BTW is your symptom reproducible? Then get on the beta tests for both
IE8 and XPsp3... <eg>


HTH

Robert Aldwinckle
---

The only information I didn't originally provide was that I was using XPsp2.

The behaviour does not seem to persist in no add-on mode. (I wasn't aware
of this shortcut, thanks). The only add-on that I've installed was Google
Toolbar. I've removed that and the problem persists. I disabled all the
add-ons that are "currently loaded in Internet Explorer", restarted and the
problem still persists. I have 24 add-ons in "Add-ons that have been used by
Internet Explorer" some are still enabled. Will disabling all add-ons be the
same as No-Addon-Mode?

The problem occurs on another machine with IE6 (also XPsp2), so I'll assume
uninstalling IE7 won't make a difference...

--
Browse http://connect.microsoft.com/VisualStudio/feedback/ and vote.
http://www.peterRitchie.com/blog/
Microsoft MVP, Visual Developer - Visual C#


"PA Bear" wrote:

> I'd most certainly have posted a much different reply if you'd included that
> information in your first post, Peter. We're not mind-readers here. <w>
>
> 1. Does this behavior persist if you start IE7 in No Add-ons mode? To start
> IE7 in No Add-ons mode:
>
> Right-click on the blue IE desktop icon and select Start without Add-ons; or
>
> Start > (All) Programs > Accessories > System Tools > Internet Explorer (No
> add-ons).
>
> Troubleshooting and Internet Explorer’s (No Add-ons) Mode:
> http://blogs.msdn.com/ie/archive/2006/07/25/678113.aspx
>
> 2. Does the problem persist if you Reset IE7 Settings (RIES)?
> http://support.microsoft.com/kb/923737 <= Read before using!
>
> 3. If you uninstall (a) IE7 (which automatically returns you to IE6), (b)
> all toolbars and (c) all third-party Windows Themes (including Window
> Blinds) and do NOT reinstall IE7, does this behavior persist? If it does,
> do NOT reinstall IE7.
>
> Uninstalling IE7
> http://www.ie-vista.com/kbase2.html
>
> How to uninstall Internet Explorer 7:
> http://support.microsoft.com/kb/927177
>
> IE7 (Un)Installation and Anti-Malware Applications:
> http://blogs.msdn.com/ie/archive/200...lications.aspx
>
> 4. Required reading IMHO before reinstalling IE7:
>
> Sandi's Installation Tips <= FOLLOW THESE TIPS TO THE LETTER!
> http://www.ie-vista.com/known_issues.html#pre-install
>
> [And I strongly recommend using
> http://www.microsoft.com/windows/dow.../getitnow.mspx as the
> installation source, not Automatic/Windows Update.]
>
> Make *certain* that you check in at Windows Update immediately after
> reinstalling IE7 to install any critical updates offered. If Optional
> Updates category offers Root Certificates update, I recommend installing it
> to take full advantage of IE7's additional security.
> --
> ~PA Bear
>
> Peter Ritchie [C# MVP] wrote:
> > This has nothing to do with what I'm seeing. I'm viewing GDI Objects in
> > Task Manager and Process explorer and witnessing it on a freshly created
> > Windows XP SP2 computer with IE7 and spyware, virus and firewals
> > installed.
> >
> >
> >> Unexplained computer behavior may be caused by deceptive software
> >> http://support.microsoft.com/kb/827315
> >>
> >> Run a /thorough/ check for hijackware, including posting your hijackthis
> >> log to an appropriate forum.
> >>
> >> Checking for/Help with Hijackware
> >> http://aumha.org/a/parasite.htm
> >> http://aumha.org/a/quickfix.htm
> >> http://aumha.net/viewtopic.php?t=5878
> >> http://wiki.castlecops.com/Malware_R...:_Introduction
> >> http://mvps.org/winhelp2002/unwanted.htm
> >> http://inetexplorer.mvps.org/data/prevention.htm
> >> http://inetexplorer.mvps.org/tshoot.html
> >> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> >> http://defendingyourmachine2.blogspot.com/
> >> http://www.elephantboycomputers.com/...moving_Malware
> >>
> >> When all else fails, HijackThis v2.0.2
> >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
> >> It will help you to both identify and remove any hijackware/spyware with
> >> assistance from an expert. **Post your log to
> >> http://forums.spybot.info/forumdisplay.php?f=22,
> >> http://castlecops.com/forum67.html,
> >> http://forums.subratam.org/index.php?showforum=7,
> >> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
> >> expert
> >> analysis, not here.**
> >> --
> >> ~Robear Dyer (PA Bear)
> >> MS MVP-Windows (IE, OE, Security, Shell/User)
> >> AumHa VSOP & Admin http://aumha.net
> >> DTS-L.ORG http://66.39.69.143/
> >>
> >> Peter Ritchie [C# MVP] wrote:
> >>> In the past few weeks I'm been having many problems with IE (both IE7
> >>> and
> >>> IE6). IE has huge use of GDI handles which is causing GDI allocation
> >>> failures in other applications. After a few hours of use IE7, for
> >>> example,
> >>> racks up over 2,700 in use GDI objects. When I close all tabs (open new
> >>> tab
> >>> then close all others), GDI handle usage only goes down just below
> >>> 2,000).
> >>> When IE7 starts it's only using 377 or so GDI handles.
>
>

Different OSS make a big difference when it comes to diagnosing IE(7)
problems.

Resetting IE Settings (RIES; see previous reply) will disable all Add-ons.
You can then enable Add-ons, one at a time, until you discover the
miscreant(s). (Kinda like the IE7 version of Clean Boot troubleshooting.)

It may be worth your while to return the machine to IE6 and see if the
behavior persists. If it doesn't, you may have had a horked install of IE7.

Required reading IMHO before installing IE7:

Sandi's Installation Tips <= FOLLOW THESE TIPS TO THE LETTER!
http://www.ie-vista.com/known_issues.html#pre-install

[And I strongly recommend using
http://www.microsoft.com/windows/dow.../getitnow.mspx as the
installation source, not Automatic/Windows Update. Make *certain* that you
check in at Windows Update immediately after installing IE7 and install any
critical updates offered. If Optional Updates category offers Root
Certificates update, I recommend installing it to take full advantage of
IE7's additional security.]

IEBlog : IE7 Installation and Anti-Malware Applications
http://blogs.msdn.com/ie/archive/200...lications.aspx
--
~PA Bear


Peter Ritchie [C# MVP] wrote:
> The only information I didn't originally provide was that I was using
> XPsp2.
>
> The behaviour does not seem to persist in no add-on mode. (I wasn't aware
> of this shortcut, thanks). The only add-on that I've installed was Google
> Toolbar. I've removed that and the problem persists. I disabled all the
> add-ons that are "currently loaded in Internet Explorer", restarted and
> the
> problem still persists. I have 24 add-ons in "Add-ons that have been used
> by Internet Explorer" some are still enabled. Will disabling all add-ons
> be the same as No-Addon-Mode?
>
> The problem occurs on another machine with IE6 (also XPsp2), so I'll
> assume
> uninstalling IE7 won't make a difference...
>
>> I'd most certainly have posted a much different reply if you'd included
>> that information in your first post, Peter. We're not mind-readers here.
>> <w>
>>
>> 1. Does this behavior persist if you start IE7 in No Add-ons mode? To
>> start IE7 in No Add-ons mode:
>>
>> Right-click on the blue IE desktop icon and select Start without Add-ons;
>> or
>>
>> Start > (All) Programs > Accessories > System Tools > Internet Explorer
>> (No
>> add-ons).
>>
>> Troubleshooting and Internet Explorer’s (No Add-ons) Mode:
>> http://blogs.msdn.com/ie/archive/2006/07/25/678113.aspx
>>
>> 2. Does the problem persist if you Reset IE7 Settings (RIES)?
>> http://support.microsoft.com/kb/923737 <= Read before using!
>>
>> 3. If you uninstall (a) IE7 (which automatically returns you to IE6), (b)
>> all toolbars and (c) all third-party Windows Themes (including Window
>> Blinds) and do NOT reinstall IE7, does this behavior persist? If it
>> does,
>> do NOT reinstall IE7.
>>
>> Uninstalling IE7
>> http://www.ie-vista.com/kbase2.html
>>
>> How to uninstall Internet Explorer 7:
>> http://support.microsoft.com/kb/927177
>>
>> IE7 (Un)Installation and Anti-Malware Applications:
>> http://blogs.msdn.com/ie/archive/200...lications.aspx
>>
>> 4. Required reading IMHO before reinstalling IE7:
>>
>> Sandi's Installation Tips <= FOLLOW THESE TIPS TO THE LETTER!
>> http://www.ie-vista.com/known_issues.html#pre-install
>>
>> [And I strongly recommend using
>> http://www.microsoft.com/windows/dow.../getitnow.mspx as the
>> installation source, not Automatic/Windows Update.]
>>
>> Make *certain* that you check in at Windows Update immediately after
>> reinstalling IE7 to install any critical updates offered. If Optional
>> Updates category offers Root Certificates update, I recommend installing
>> it
>> to take full advantage of IE7's additional security.
>> --
>> ~PA Bear
>>
>> Peter Ritchie [C# MVP] wrote:
>>> This has nothing to do with what I'm seeing. I'm viewing GDI Objects in
>>> Task Manager and Process explorer and witnessing it on a freshly created
>>> Windows XP SP2 computer with IE7 and spyware, virus and firewals
>>> installed.
>>>
>>>
>>>> Unexplained computer behavior may be caused by deceptive software
>>>> http://support.microsoft.com/kb/827315
>>>>
>>>> Run a /thorough/ check for hijackware, including posting your
>>>> hijackthis
>>>> log to an appropriate forum.
>>>>
>>>> Checking for/Help with Hijackware
>>>> http://aumha.org/a/parasite.htm
>>>> http://aumha.org/a/quickfix.htm
>>>> http://aumha.net/viewtopic.php?t=5878
>>>> http://wiki.castlecops.com/Malware_R...:_Introduction
>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>> http://inetexplorer.mvps.org/tshoot.html
>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>> http://defendingyourmachine2.blogspot.com/
>>>> http://www.elephantboycomputers.com/...moving_Malware
>>>>
>>>> When all else fails, HijackThis v2.0.2
>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to
>>>> use.
>>>> It will help you to both identify and remove any hijackware/spyware
>>>> with
>>>> assistance from an expert. **Post your log to
>>>> http://forums.spybot.info/forumdisplay.php?f=22,
>>>> http://castlecops.com/forum67.html,
>>>> http://forums.subratam.org/index.php?showforum=7,
>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
>>>> expert
>>>> analysis, not here.**
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-Windows (IE, OE, Security, Shell/User)
>>>> AumHa VSOP & Admin http://aumha.net
>>>> DTS-L.ORG http://66.39.69.143/
>>>>
>>>> Peter Ritchie [C# MVP] wrote:
>>>>> In the past few weeks I'm been having many problems with IE (both IE7
>>>>> and
>>>>> IE6). IE has huge use of GDI handles which is causing GDI allocation
>>>>> failures in other applications. After a few hours of use IE7, for
>>>>> example,
>>>>> racks up over 2,700 in use GDI objects. When I close all tabs (open
>>>>> new
>>>>> tab
>>>>> then close all others), GDI handle usage only goes down just below
>>>>> 2,000).
>>>>> When IE7 starts it's only using 377 or so GDI handles.

"Peter Ritchie [C# MVP]" <PRSoCo@newsgroups.nospam> wrote in message
news:53184E13-8736-451B-ACD6-20BFCDFCEE4F@microsoft.com...
> The only information I didn't originally provide was that I was using
> XPsp2.
>
> The behaviour does not seem to persist in no add-on mode. (I wasn't aware
> of this shortcut, thanks). The only add-on that I've installed was Google
> Toolbar. I've removed that and the problem persists. I disabled all the
> add-ons that are "currently loaded in Internet Explorer", restarted and
> the
> problem still persists. I have 24 add-ons in "Add-ons that have been used
> by
> Internet Explorer" some are still enabled. Will disabling all add-ons be
> the
> same as No-Addon-Mode?
>
> The problem occurs on another machine with IE6 (also XPsp2), so I'll
> assume
> uninstalling IE7 won't make a difference...


Do a thorough check for malware, following all of the steps at one of these
Web pages.
Help with malware:
All MS-MVP Sites.
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://www.elephantboycomputers.com/...moving_Malware
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/darnit.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Unexplained computer behavior may be caused by deceptive software.
http://support.microsoft.com/kb/827315

So How Did I Get Infected Anyway?
For quite a few people it's by installing programs like Messenger Plus,
whose ads for malware don't identify the malware as such and try to convince
you that you owe it to the author. See also:
http://www.wilderssecurity.com/showthread.php?t=27971
Don't ever do a "default" install of anything. Always choose Custom and see
what else is being carried along. Don't install any extras you're not sure
of.

--
Frank Saunders MS-MVP IE,OE/WM
www.fjsmjs.com
Do not send email