My browser is acting funny…

As browser users go, I’m pretty savvy. I’ve been on the IE team for nearly half a decade, and I’ve been writing browser extensions for twice as long. I read networking source code for entertainment, I spend my free time writing a web debugger, and I maintain an IE troubleshooting guide for folks who encounter common problems.

Earlier this week, IE8 started hanging on a regular basis (on every 3rd or so startup) on one of my computers. There was no obvious rhyme or reason to the hangs; they'd happen when I opened a new tab or a new window, whether I clicked on a link from Outlook or ran iexplore.exe directly.

Now, as some of you know, when folks complain about IE crashes, the first thing I do is tell them to try running in No Add-ons mode. However, forgetting my own advice (because I didn’t recall installing anything lately), I didn’t think to try that.  Instead, I saved some WinDBG .dmp files to debug later, and just let my frustration build.

Luckily, however, I soon encountered a previously unseen dialog box:

This is a new dialog box, introduced in IE8 to help prevent “Search Hijacking”—when a piece of software stomps over an unwilling user’s preferences and sets itself as the search provider. (You can learn more about Search Provider Protection in Frank Olivier’s blog post on the IEBlog.)

In this case, the dialog indicates that my default Search Provider had been changed by overwriting registry keys rather than using the API to request a change to the search provider. In turn, this was a clue that some program I’d installed was making unwanted changes to my browser. I chose to “Keep” my existing search provider using this screen, but decided to investigate how my search default was being changed.

Unfortunately, while there’s no good way for this dialog to pin blame on the hijacker, I knew that it was being triggered by new software on my computer, because I hadn’t seen this prompt over the last 18 months. This prompted me to remember that I’d recently updated my copy of WebShots Desktop, a program which periodically cycles my desktop wallpaper among various high-quality landscape scenes. (While Windows 7 natively includes a wallpaper-rotation feature, I use WebShots on the Windows XP machine I use for downlevel testing). 

I was almost positive that I’d opted-out of all of the browser integration features offered by the installer, but concluded that perhaps I missed one. I took a quick look inside IE’s Tools > Manage Add-ons dialog, and sure enough, I saw an unexpected add-on:

The new DLL in the list, AGCore.dll, was installed by the new version of the wallpaper-changing program. (Confusingly, the DLL has the same name as the core DLL in Microsoft Silverlight, although it has nothing to do with Silverlight). I used Manage Add-ons' Disable button to turn off the agcore.AGUtils add-on, and restarted IE. Sure enough, the crashes and hangs went away.

Curious about why this add-on was causing such problems, I took a quick look at it. It turns out that agcore.dll is a .NET Assembly which is exposed as a COM object, registered as a Browser Helper Object in IE.

I strongly discourage use of .NET to build IE extensions (for anything other than prototyping purposes), because .NET is not suitable for this use, as briefly outlined over on Raymond Chen’s blog. Beyond the framework-versioning problems, .NET incurs a significant performance cost at startup, and users demand that IE and its tabs start instantly. Extensions written in .NET cannot meet the performance expectations of most users.

The whole experience was a painful reminder that even non-malicious code can ruin your day. If you encounter crashes, hangs, or other unexpected behavior in IE, your first stop should be the Manage Add-ons screen.

-Eric

Comments

• Anonymous
  August 21, 2009
  "With CLR 4, consuming applications will be able to host both a CLR 2 and CLR 4 in the same process."

• Anonymous
  August 22, 2009
  Indeed, the side-by-side issue is one which the VS2010 CLR (v4) aims to address. However, the performance penalty for loading the CLR into every tab should not be taken lightly.

• Anonymous
  August 22, 2009
  Is there anyway to disable this feature yes it may help some people but winpatrol already has this feature So how would i disable this program changing the search provider feature in ie8

• Anonymous
  August 23, 2009
  The WebShots Desktop software also installs a system service in Windows. Who knows what they're doing with that?!?

• Anonymous
  August 23, 2009
  @sfc2000: There is no option to turn off Search Provider Protection. I'm not sure if that's what you're asking?

• Anonymous
  August 23, 2009
  Hmm is there not even a tweak to do this i mean you can off everything that you don't need Opps yeah i should have been myself abit more clear yes i did mean the search provider protection see i already had a program that does this and now i get told about it twice in a row which can get annoying  

• Anonymous
  August 23, 2009
  @sfc2000: There is no option to turn off Search Provider Protection, although you can check the "Prevent programs..." checkbox and it will automatically block other programs from making changes to your Search Provider.

• Anonymous
  August 23, 2009
  So the message won't popup in ie8 if i check that checkbox i guess at least the message will only popup once instead of twice Thanks

• Anonymous
  August 23, 2009
  Same to me here. My IE8 also sometimes act funny. It was ok when I use IE6. But after I upgrade to IE8, I think I lose some of the good features.

• Anonymous
  August 23, 2009
  @Tropical: You too are likely to have a buggy browser add-on. I don't know what "I lose some of the good features" means.

• Anonymous
  August 24, 2009
  Was the update to WebShots Desktop a security or a program update, Eric ? No ISV should be PREchecking non-security content when they roll out security updates. Their behavior is akin to the underhanded deceptions of malware purveyors.

• Anonymous
  August 24, 2009
  It would be great to have a way to create good .NET add-on for IE. I have at least one .NET add-on installed on my IE. It may explains why my IE is not as smart as I want to, but since this add-on is self-made and I don't have enought C++ knowledge to make it in C++, there's no way to change that. Beside that, .NET is the Microsoft-promoted learning language. It would be great to have IE better supporting it. Office support .NET add-ons and I don't remeber any complains about that beeing slow. Maybe the way the add-on structure is on IE make it slow for .NET add-ons, though. The last thing is that it's not normal that an add-on can be installed in IE whithout the knowledge of the user. I think FireFox warns you when you've installed/updated a new extension. IE should do the same, you then couldn't have such problem :-)

• Anonymous
  August 24, 2009
  @FremyCompany: Office applications are each a single monolithic process, which means that the burden of loading the CLR is (effectively) much lower. Users of Office have different performance expectations than end-users who are merely opening new browser tabs. The Office team made a major investment in .NET programmability, and IE has not prioritized such an investment to date (as we have other, higher priorities). Your statement that "it's not normal" was perhaps better stated that "It's unfortunate that add-ons can be registered to run in IE unexpectedly." I agree. The addon story in IE is quite a bit more complicated than that of Firefox, and this is something that gives them an advantage for understandability. They still have some problems (e.g. don't explain to users how to uninstall HKLM addons) but overall they have a nice experience. I'm curious: What does your .NET addon do?

• Anonymous
  August 24, 2009
  @EricLaw : Yes, you're true. Office only need one proccess. I don't had thought about that. I fully understand you've higher priorities than to ameliorate .NET integration in IE (because, in fact, it already works, it's perfectible, but it works). If I were IE Architect, I would not spend any time to that problem, either. It's why I've said It would be great... Yes, I know, you may say I'm a dreamer... (But I'm not the only one !) (BTW, sorry if "It's not normal" can't be said in English. In French "It's not normal" has the meaning of "It should really not have been so", showing a strong disagree on something that happens or has happened. We for example say "It's not normal that children are alone in the street at night !") To respond to your question, my add-on is something that complete the AddBlock of IEPro. IEPro perfoms URL Blocking and HTML filtering. But with IEPro, you can't perform CSS Filtering. So, I use a simple IE's UserStyleSheet, and my program add some CSS classes to the HTML element based on the URL of the document. It also help me to 'restyle' websites. Here's a sample of my CSS UserSytleSheet : [...] /* <url HTMLAttribute="BingSearch">http://www.bing.*</url> */ HTML.BingSearch .ansC, HTML.BingSearch .sr_dcard {    border: gray 1px solid !important;    padding: 4px !important;    background: #fafafa !important; } [...] It could probably be easily done in C++, but I don't feel me smart enougth in that language to try that. I know I should learn, but I'm currently happy with .NET and I'll learn C++ at universtity.

• Anonymous
  August 24, 2009
  @FremyCompany: Ah, I didn't realize that you weren't a native English speaker. Your English is way better than my French. :-) Your extension sounds interesting.

• Anonymous
  August 24, 2009
  The comment has been removed

• Anonymous
  August 24, 2009
  BTW, I'm asking myself a question. Is it possible for IE to measure anormal IE performances and propose to the user to try to run IE in "No Add-on" mode to see if there's an Add-On performance issue ? Many users (let's say 99%) are not aware of the No Add-On Mode, and/or don't have the reflex to think that an add-on could make IE slower. If the No Add-On mode don't solve the problem, maybe you could ask to send an error repport to IE (even if there's no error, just a slow browser; sometimes it's due to obscure hardware incompatibilities that could be fixed by updating a driver).

• Anonymous
  September 03, 2009
  Does the addon manager not list hte performance cost of a .net plugin in the load time column ?

• Anonymous
  September 03, 2009
  @hAl: I'm not entirely positive. The issue is that the "Load Time" column is a wrapper around a very specific part of the load path (including SetSite, where most addons do their work). I'm not sure when exactly the framework ends up getting loaded in the case where the addon is written in .NET and exposed as a COM object. The other problem is that the .NET Framework load time is highly variable, depending on whether something else is already using it. So you'll have a big skew between the "average" and "max" load time.

• Anonymous
  September 03, 2009
  The comment has been removed

• Anonymous
  September 03, 2009
  The comment has been removed

• Anonymous
  November 10, 2009
  i do not write any of my own programs, etc...On my computer, under add/remove programs....i currently have installed [a lot of versions of the .NET framework.  Is that okay?]

• Anonymous
  November 10, 2009
  @Sandra: The .NET Framework is needed to run programs written by other developers. Even if you don't write programs yourself, you'll need it if you want to run any program which requires .NET.

• Anonymous
  January 27, 2012
  I wrote a program to try to change the default search provider in IE9. The problem is when dialog pop up to let user choose if they want to change the default search provider, instead of showing that it's my program/vendor suggest the new default search provider, it shows that OLEAUT32.dll suggest the new default search provider. Could you shed some light of how to fix this and how does IE handle this dialog internally? Thanks

• Anonymous
  January 27, 2012
  @Jenny: The proper approach is to call the IOpenServiceManager APIs described in this blog post: blogs.msdn.com/.../staying-in-control-of-your-default-search-provider.aspx