Windows 2003 Enterprise (32 bit), Citrix XenApp 5, RES Workspace Manager 2011, McAfee VirusScan Enterprise 8.7.0i.

When a opening an Excel workbook from Sharepoint the whole session freezes.

I asked the user to open an Excel workbook from Sharepoint and I noticed the following popup:

Some files can harm your computer. If the file information looks suspicious or you do not fully trust the source, do not open the file | You are opening the following file: | File name: My Workbook.xls | From: Sharepoint

So my first thought was that the user somehow clicked this message to the background and IE was waiting for a response.

This message appears because the option “Confirm open after download” is active in the file type options:

Microsoft Word-document | Confirm open after download

I knew this setting was stored in the registry but couldn’t remember where, so I used Process Monitor to quickly determine it’s location. I set a filter on “Process is explorer.exe” and “Operation is RegSetValue”:

Process is explorer.exe | Operation is RegSetValue

First line is a direct hit, the registry key is “HKCR\Excel.Sheet.8\EditFlags”:


HKEY_CLASSES_ROOT is actually a merged view of HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes so you can set this value either per user or for all users.

In my case I set this value in RES Workspace Manager as an Application Specific Configuration:

RES Workspace Manager | Composition | Applications | Managed Applications | Microsoft Office 2003 | Excel | Configurations | Actions

After this change the warning wasn’t shown anymore but the workbook still didn’t open.

After a little wait Explorer didn’t respond any more, which in the user’s experience makes the whole session freeze. The RES Dialog was indicating it was still launching Excel:

Desktop | Bezig met starten van "Microsoft Excel 2003"

Process Monitor
So I opened Process Monitor to see what was going on and I noticed a recurring sequence of several NotifyChangeDirectory operations from Explorer. I filtered on this operation:

Operation is NotifyChangeDirectory

As you can see in the screenshot there is a massive number of entries, each taking up about a second. And after waiting several minutes Excel was launched.

I then tried to open Excel directly and this showed the same behavior.

So I doubleclicked one of the entries and inspected the Stack. As you can see the last 6 operations are related to virus scanning because fltMgr.sys is the File Filter Filter Manager (virus scanners usually use a filter driver):

Stack View

And mfehidk.sys is a driver from McAfee:

mfehidk.sys | McAfee Link Driver

Virus Scanner
To see whether the Virus Scanner was at fault, I deselected “When reading from disk” (for performance reasons it’s I would recommended to turn this off anyway) from the Scan Items in the On-Access Scan Properties:

McAfee On-Access Scan Properties | Default processes | Scan Items | When reading from disk 

After that change Excel launched almost immediately!

I am not really satisfied with this workaround so I will ask the customer to report this to McAfee. I will update this article if I get any feedback.