Windows 2003 Enterprise (32 bit), Citrix XenApp 5, RES Workspace Manager 2011, McAfee VirusScan Enterprise 8.7.0i.
When a opening an Excel workbook from Sharepoint the whole session freezes.
I asked the user to open an Excel workbook from Sharepoint and I noticed the following popup:
So my first thought was that the user somehow clicked this message to the background and IE was waiting for a response.
This message appears because the option “Confirm open after download” is active in the file type options:
I knew this setting was stored in the registry but couldn’t remember where, so I used Process Monitor to quickly determine it’s location. I set a filter on “Process is explorer.exe” and “Operation is RegSetValue”:
First line is a direct hit, the registry key is “HKCR\Excel.Sheet.8\EditFlags”:
HKEY_CLASSES_ROOT is actually a merged view of HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes so you can set this value either per user or for all users.
In my case I set this value in RES Workspace Manager as an Application Specific Configuration:
After this change the warning wasn’t shown anymore but the workbook still didn’t open.
After a little wait Explorer didn’t respond any more, which in the user’s experience makes the whole session freeze. The RES Dialog was indicating it was still launching Excel:
So I opened Process Monitor to see what was going on and I noticed a recurring sequence of several NotifyChangeDirectory operations from Explorer. I filtered on this operation:
As you can see in the screenshot there is a massive number of entries, each taking up about a second. And after waiting several minutes Excel was launched.
I then tried to open Excel directly and this showed the same behavior.
So I doubleclicked one of the entries and inspected the Stack. As you can see the last 6 operations are related to virus scanning because fltMgr.sys is the File Filter Filter Manager (virus scanners usually use a filter driver):
And mfehidk.sys is a driver from McAfee:
To see whether the Virus Scanner was at fault, I deselected “When reading from disk” (for performance reasons it’s I would recommended to turn this off anyway) from the Scan Items in the On-Access Scan Properties:
After that change Excel launched almost immediately!
I am not really satisfied with this workaround so I will ask the customer to report this to McAfee. I will update this article if I get any feedback.