Please note that the identities mentioned in this story have been changed to protect the innocent. Any names that coincide with real life people is purely coincidental.
So there I was, calmly working away when I get the phone call that started it all. I pick up the phone, “Hello?” I ask.
“Yo, it’s me Jason, ” he replies while chuckling. I know what this means, he needs computer help. “Dude, I need a favor. My tablet’s busted!” I think to myself that he’s either dropped it or he doesn’t know how to use it since it’s brand spankin’ new. So after a deep breath I ask, “What’s the problem?”
“Man, I know this computer is supposed to be faster than my old one but it isn’t. Everything’s stuck but if I wait then it comes back and it’s cool for a bit then sucks again.”
With my years of computer experience I can decrypt the previous statement from useless blabber into computer speak: “The computer repeatedly hangs temporarily.” After a few moments of careful assessment I replied with the fact that it was some minor glitch, network outage or something, and that he was just being impatient. “The tablet is not going to be as fast as a workstation, the hard drive has a much slower rotational speed and therefore it will inherently be slower.
“But dude, couldn’t you just look at it for me?”
“Sure, why not, you’ll have to bring it to me.” Within hours I the tablet was sitting on my desk. There it was, a sleek Toshiba Portege M205 with less than 1000 miles on it. I didn’t allow my envy to cross my face while I beheld it’s beauty. After I was done with my careful visual inspection I inquired about the problem, “so, show me what the problem is.”
“Do anything, it sucks really bad man! I have half a mind to take it back.”
I grinned, “I’ll take it!” I tried to begin my investigation by right clicking on the Start button and selecting Explore. Nothing happens. I get the wait cursor and the entire shell becomes useless. I bring up Task Manager using CTRL+SHIFT+ESC, thankfully it appears. CPU usage is floating between 0% and 2%, memory usage 224MB out of 512MB physical and 2560MB virtual. This seems fine to me. I check the network tab and see virtually no activity. Hard drive light? Same result.
Well, now what I think to myself. “How long has this been happening I ask?”
“For about a month” Jason confesses.
“A MONTH,” I retort! “No wonder you want to take it back! I wouldn’t want to work with this for more than 30 minutes.” Jason has to leave for a meeting but is willing to leave the tablet with me for the duration of the meeting. I told him I’d do my best, “No promises though.” With yet another grin I continue, “but if I fix it you’ll buy me dinner?” I get the answer I was looking for: “Wherever you want to go man, it’s on me.” I ushered him out of my office and babbled something about needing some quite time or something, and got to work.
After some more playing around I determined that it appeared that only the shell was affected by the slow down. Once an application was up and running it responded fine and didn’t exhibit the behavior that the shell was suffering from. Then something curious happened, I unplugged the network cable tried my 1st test (launching explorer), and boom, there it was virtually as fast as I clicked the “Explore” menu item. I whispered to myself, “very interesting.” Just for the heck of it I tried it again a few times and got the same results.
Instead of pondering this for to long I called the big guns. “Harris old buddy, I’ve got a quick question for you…” I relay the entire story and after some deliberation we determine that something must be in use by the shell that is relying on network connectivity. I quickly thank Harris and jump off the phone and back to the problem at hand. Thoughts of dinner are fueling my troubleshooting efforts, I can already taste the food. I think to myself that Jason shouldn’t have offered dinner since it’s gonna cost him. As frustrated as he was I could get a really nice meal out of this whole deal.
I pick one of my trusty troubleshooting tools: Regmon. I run regmon, plug the network cable back into the tablet and then reproduce the problem. The resulting log contained about eight thousand rows of registry accesses that I had to parse through. After about ten minutes of dredge work I think I find what I’m looking for, an access to a registry key whose value contains a UNC path. The further I look the more I see intermittent calls to the same key, over and over again. To top it off each access consumes about 3 to 5 seconds, “this is it!”
With my dinner clearly in my sights I recognize that this is a COM object (dll) that has been registered from a network location. I jot down the GUID (by copying it to the clipboard) and launch regedit.exe. I locate the registry entries, note the Inprocserver (the dll name) and see if I can what application this belongs to. A quick search on MSN reveals that this is some 3rd party application that looks useless, no harm in removing it! I subsequently purge all of the related keys from the registry and reboot.
I had had the foresight to create an account for myself on the box so I could login since Jason wasn’t around to provide his password. So, freshly booted I try to launch explorer while connected to the network and wouldn’t you know it, “Voila! Works like a charm!” By now I’m getting hungry and can smell my dinner but it’s not even early afternoon but nonetheless, “Mission Accomplished!”
Since Jason wasn’t around yet I setup the wireless network for my work and took the tablet for a test drive. It sure is a nice ride, later I’d confess to walking around the building with it.
Jason was pleased to have a working tablet and quickly relayed a story about how the 3rd party app was installed (manually from a network location). I was able to determine that the problem manifested itself after the network location and dll were no longer available. Had the registered path existed there would not have been any problems with the shell. Since the network location wasn’t there it took some time for the shell to do a few retries before it gave up hence the entire delay/hang.
<many months later>
Part Deux - The Case of the Mysteriously Behaving Visual Studio .NET 2003, Class Wizard Accessing the Network?
I get an e-mail from Tim asking why the VS.NET class wizard would make network access when adding a variable. Using the repro steps I tried to reproduce the same behavior but nothing. I immediately recall the experience with Jason and the tablet. I replied within a few minutes with a message stating some possible causes including:
"3. some component in use by the shell or VS.NET resides on a network location (the last time I saw this was a COM object registered from a UNC path)"
In my mail I requested a netmon trace so we could identify what the network traffic was for. A few days later I got my netcap and saw some network requests for a particular share and file. Turns out it was an OCX which had been registered from a network share.
That’s what we call a “slam dunk” problem sloved. Too bad this time I didn’t get any meals out of it! On top of everything else everyone thinks I was pretty smart for knowing the answer off the top of my head on the 1st go. Experience pays so much, too bad the secret's out now!
