Diagnosing: Windows cannot find ....

[PA Bear [MS MVP]]

Here's the closest MS will ever come to pointing a finger at third-party
security apps:
http://blogs.msdn.com/ie/archive/2006/10/11/IE7-Installation-and-Anti_2D00_Malware-Applications.aspx
(applies to IE8 and any other IE upgrades, as well).

 

[Sam Hobbs]

I have seen many replies such as this one in which the message is a reply
but there is nothing added. Since this one came from me I can say that it
must be another bug. I did not send it intentionally and I am not aware of
it being sent. Since Gary's message did not get the reply prefixes (I hope
understand what I mean by that) I would not have intentionally posted the
message that way.

I know there is nothing that can be done but I hope it helps to know that it
is a burp.

 

[Sam Hobbs]

That is entirely about IE 7; there is nothing about IE 8. It also clearly
indicates that Microsoft is doing as much as they can to prevent the
problem. You are second-guessing what the problem is. Problems such as this
are often a moving target; if you aim at a previous location you are likely
to miss. Microsoft has dealt with the problem of antivirus software being a
problem during an install.

You might be correct that the problem is caused by antivirus software, but
do you have any evidence of that being a problem for IE 8 installation?

Also note that some of the comments for that blog say essentially the same
thing as I said about issuing warning prior to install and supporting a
procedure for disabling and enabling the antivirus software and the
internet.

 

[Gary VanderMolen]

When you say "reply prefixes" it implies using the so-called Communities
features. Those features are widely acknowledged to be rather buggy,
and can even result in inability to see one's own posts. I recommend
disabling that option in Windows mail.

 

[Sam Hobbs]

No I mean the characters that are added (prefixed) to lines that are being
replied to. You are using the feature, since the lines of my message that
you replied to have a "<" prefixed to them. What I mean by "reply prefixes"
is the "<" characters. For OE those characters could be configured but I
don't see a way to change them using WinMail. The only reason I searched for
the option is so I could use whatever terminology that Microsoft uses.

You are also doing something that causes my reply to you to not get the
prefixes, which causes replies to be confusing since anyone reading the
reply cannot be sure what is the reply and what is being replied to. That is
why I cleared ("clipped") everything out.

 

[Gary VanderMolen]

Actually I'm quite familiar with that issue.
Windows Mail (and OE) can't indent quoted text with the '>'
character, if (and only if) the original text was posted using
'Quoted Printable' MIME format. I tend to use that format
because it ensures that long URLs won't get broken.
BTW, that longstanding inability was fixed in Windows Live Mail.

 

[PA Bear [MS MVP]]

Sam, feel free to review my 8+ year posting history in IE General, Windows
Update, WinXP General, Win98 General, and other IE- and Windows-specific
newsgroups and judge for yourself whether I know what I'm talking about or
not.

And thank you for fully quoting the previous message in your last reply, at
least.

 

[Sam Hobbs]

I don't doubt that you are very knowledgeable and experienced and that you
help very many people. My comments are not meant to indicate otherwise. My
comments should be interpreted in the context of just the one issue.

My experience includes many years of maintenance programming that included
diagnosing and fixing or modifying programs that have been highly modified
by many others. I also have (like you) voluntarily answered many questions.
I have credit for answering nearly a thousand questions in the MSDN forums.
The reason that is relevant is that I know that people tend to be
non-methodical in diagnosing problems. Often it is critical to verify
assumptions. You are assuming that because the problem existed for IE 7 it
is likely to exist in IE 8 also. I am saying that might be true but it would
help to have a little more evidence of that.

More specifically, if the problem was as simple as an incorrect registry
setting then it is likely it would have been diagnosed already. Based on the
article you provided, Microsoft understands the registry problem quite well.
They are capable of detecting the problem if it were to exist for IE 8.
Obviously there is nearly certainly a problem with something that IE 8 does
but there is no evidence that it is caused by an antivirus program. If it
were caused by an antivirus program then it would occur for specific
vendor's software and that would result in a pattern that can be recognized.
As far as I know, the problem usually occurs when some antivirus program
other than Avast is used.

 

[Sam Hobbs]

The problem went away on it's own. I assume it will re-occur but I am not
aware of anything I did to fix it except restart my system. There are some
fixes that Windows Update applied yesterday so it is possible that the
problem was fixed that way.

More specifically, the jpeg attachment that could not be opened in WinMail
is now opening when I double-click it in WinMail. I have verified that the
file exists in the temporary files location when it is being shown.

 

[Rainald Taesler]

Thanks for your success report.
I'd really hope it would be persistent.

Two others have reported this too.
And I had hoped that the update might fix the problem. But it does not
cure it on my computers. The situation is unchanged.

Pls keep an eye an eye in the issue and test with TXT and JPG files from
time to time.

And pls stay tune. I am in the state if preparing a report in my
findings as a reply to your conclusions in this thread.

Rainald

 

[Sam Hobbs]

It is just a few hours later and the problem has already retuned.

I saw in a previous thread the suggestion to use Process Monitor. I tried
using it but I got distracted. I will try using it some more sometime. Is
there anything specific that you can suggest I look at? I had intended to
create a filter so that I got only WinMail activity and I assume I will
figure that out.

 

[Sam Hobbs]

I got the filter working in Process Monitor. I think the main problem I had
is that I did not turn capture back on after turning it off. So now I have a
capture of when WinMail does not work. If possible, I will do the same with
WinMail working.

 

[Rainald Taesler]

I got the filter working in Process Monitor. I think the main problem
I had is that I did not turn capture back on after turning it off. So
now I have a capture of when WinMail does not work. If possible, I
will do the same with WinMail working.

I still have not got it.
I'm totally illiterate as far as ProcMon is concerned.
I do not even know where to start {siiiigh}

The interesting part would be to monitor what WinMail does when the
users fires the command to open an attachment.
The most interesting part would be the processes of opening JPG and TXT
files.

Rainald

 

[Sam Hobbs]

I still have not got it.
I'm totally illiterate as far as ProcMon is concerned.
I do not even know where to start {siiiigh}

The interesting part would be to monitor what WinMail does when the
users fires the command to open an attachment.
The most interesting part would be the processes of opening JPG and TXT
files.

Rainald

In case it helps you or anyone else, here is what I have done. Assuming you
have downloaded and installed Procmon, execute it and then immediately do
"File | Capture Events" to turn of event captures. Then "Edit | Clear
Display" to clear out the events that have been captured. Then do "Filter |
Filter" to edit the filter. In the Process Monitor Filter dialog, click on
the Reset button. Then in the combo boxes and such, create a filter that
says "Process Name is not WinMail.exe Exclude". I am sure the filter could
be refined but that one line should be enough. Then turn event capture back
on with "File | Capture Events" and try opening an attachment. Turn off
event capture as soon as you are done opening the attachment or at least
trying to. Save the filter for later use and save the log of the captured
events.

For me, opening attachments work after I have started the system but
sometime during the session it stops working. I need to get two sets of
captured events using the same filter but on with the problem not happening
and another with the problem happening. Then I will try to compare.

I think that I have already seen that when the problem exists, the jpeg file
is in the root profile directory as I described originally and when the
problem does not exist the file is in the temporary folder. If we are lucky
then Procmon will show why that is happening but I am not optimistic.

 

[Gary VanderMolen]

Interesting stuff. Thanks for that report.
Hope you find the final piece to the puzzle.

 

[Sam Hobbs]

I still have not got it.
I'm totally illiterate as far as ProcMon is concerned.
I do not even know where to start {siiiigh}

The interesting part would be to monitor what WinMail does when the
users fires the command to open an attachment.
The most interesting part would be the processes of opening JPG and TXT
files.

Rainald

I am still working on it but I found one thing that might be relevant. When
the attachment open works, there is a query of the registry for the value:
HKU\S-1-5-21-457017820-2078464182-4146131765-1001\Software\Microsoft\Windows\Shell\AttachmentExecute\{DEEAA3EC-685F-46AE-8110-8D39A0556B78}

The value is not found, but when the attachment open fails, there is not
query for that anywhere in the procmon log as it is in the log when the
attachment does open. I don't know how that is relevant but it might be.
When I search TechNet for AttachmentExecute I get a couple of KB articles
and a forum thread that sound as if AttachmentExecute might be relevant but
it is too technical for me.

 

[Sam Hobbs]

I still have not got it.
I'm totally illiterate as far as ProcMon is concerned.
I do not even know where to start {siiiigh}

The interesting part would be to monitor what WinMail does when the
users fires the command to open an attachment.
The most interesting part would be the processes of opening JPG and TXT
files.

Rainald

I ran the monitor again today with the attachment open working but there is
no occurrence of AttachmentExecute, so that seems to not be relevant.

I noticed something else that seems more relevant. There are a few registry
functions for:
HKCR\.jpg
When it works, the registry is queried before the file is created (I think)
but when the open does not work, the registry is queried after the file is
created.

Is there a way to get someone to look at that? It might be another waste of
time, but it does seem to be a possible meaningful symptom.

 

[Rainald Taesler]

Thanks for your continous reports, Sam!
Really interesting observations.
It seems that I have a few differences in the behaviour of the bug and
at present I can not stop the problem with JPG and TXT at all on my test
system. And my main system is blocked in the moment.

Pls give me two days or so.
I'm in the state of backing up my main system and this is really
time-taking. (as my new external backup HDD showed problems under
Acronis and I had to repeat everything).
Unfortunately I don't know anybody whom we might ask to look at the
results.

Rainald