My browser is acting funny…

As browser users go, I’m pretty savvy. I’ve been on the IE team for nearly half a decade, and I’ve been writing browser extensions for twice as long. I read networking source code for entertainment, I spend my free time writing a web debugger, and I maintain an IE troubleshooting guide for folks who encounter common problems.

Earlier this week, IE8 started hanging on a regular basis (on every 3rd or so startup) on one of my computers. There was no obvious rhyme or reason to the hangs; they'd happen when I opened a new tab or a new window, whether I clicked on a link from Outlook or ran iexplore.exe directly.

Now, as some of you know, when folks complain about IE crashes, the first thing I do is tell them to try running in No Add-ons mode. However, forgetting my own advice (because I didn’t recall installing anything lately), I didn’t think to try that.  Instead, I saved some WinDBG .dmp files to debug later, and just let my frustration build.

Luckily, however, I soon encountered a previously unseen dialog box:

Search Protection dialog

This is a new dialog box, introduced in IE8 to help prevent “Search Hijacking”—when a piece of software stomps over an unwilling user’s preferences and sets itself as the search provider. (You can learn more about Search Provider Protection in Frank Olivier’s blog post on the IEBlog.)

In this case, the dialog indicates that my default Search Provider had been changed by overwriting registry keys rather than using the API to request a change to the search provider. In turn, this was a clue that some program I’d installed was making unwanted changes to my browser. I chose to “Keep” my existing search provider using this screen, but decided to investigate how my search default was being changed.

Unfortunately, while there’s no good way for this dialog to pin blame on the hijacker, I knew that it was being triggered by new software on my computer, because I hadn’t seen this prompt over the last 18 months. This prompted me to remember that I’d recently updated my copy of WebShots Desktop, a program which periodically cycles my desktop wallpaper among various high-quality landscape scenes. (While Windows 7 natively includes a wallpaper-rotation feature, I use WebShots on the Windows XP machine I use for downlevel testing). 

I was almost positive that I’d opted-out of all of the browser integration features offered by the installer, but concluded that perhaps I missed one. I took a quick look inside IE’s Tools > Manage Add-ons dialog, and sure enough, I saw an unexpected add-on:

agcore.dll in Manage Add-ons

The new DLL in the list, AGCore.dll, was installed by the new version of the wallpaper-changing program. (Confusingly, the DLL has the same name as the core DLL in Microsoft Silverlight, although it has nothing to do with Silverlight). I used Manage Add-ons' Disable button to turn off the agcore.AGUtils add-on, and restarted IE. Sure enough, the crashes and hangs went away.

Curious about why this add-on was causing such problems, I took a quick look at it. It turns out that agcore.dll is a .NET Assembly which is exposed as a COM object, registered as a Browser Helper Object in IE.

I strongly discourage use of .NET to build IE extensions (for anything other than prototyping purposes), because .NET is not suitable for this use, as briefly outlined over on Raymond Chen’s blog. Beyond the framework-versioning problems, .NET incurs a significant performance cost at startup, and users demand that IE and its tabs start instantly. Extensions written in .NET cannot meet the performance expectations of most users.

The whole experience was a painful reminder that even non-malicious code can ruin your day. If you encounter crashes, hangs, or other unexpected behavior in IE, your first stop should be the Manage Add-ons screen.


Comments (25)
  1. RichB says:

    "With CLR 4, consuming applications will be able to host both a CLR 2 and CLR 4 in the same process."

  2. Indeed, the side-by-side issue is one which the VS2010 CLR (v4) aims to address. However, the performance penalty for loading the CLR into every tab should not be taken lightly.

  3. sfc2000 says:

    Is there anyway to disable this feature yes it may help some people but winpatrol already has this feature

    So how would i disable this program changing the search provider feature in ie8

  4. Matt says:

    The WebShots Desktop software also installs a *system service* in Windows. Who knows what they’re doing with that?!?

  5. @sfc2000: There is no option to turn off Search Provider Protection.

    I’m not sure if that’s what you’re asking?

  6. sfc2000 says:

    Hmm is there not even a tweak to do this i mean you can off everything that you don’t need

    Opps yeah i should have been myself abit more clear yes i did mean the search provider protection see i already had a program that does this and now i get told about it twice in a row which can get annoying  

  7. ieblog says:

    @sfc2000: There is no option to turn off Search Provider Protection, although you can check the "Prevent programs…" checkbox and it will automatically block other programs from making changes to your Search Provider.

  8. sfc2000 says:

    So the message won’t popup in ie8 if i check that checkbox i guess at least the message will only popup once instead of twice


  9. Tropical says:

    Same to me here. My IE8 also sometimes

    act funny. It was ok when I use

    IE6. But after I upgrade to IE8,

    I think I lose some of the good features.

  10. ieblog says:

    @Tropical: You too are likely to have a buggy browser add-on.

    I don’t know what "I lose some of the good features" means.

  11. MowGreen says:

    Was the update to WebShots Desktop a security or a program update, Eric ? No ISV should be PREchecking non-security content when they roll out security updates. Their behavior is akin to the underhanded deceptions of malware purveyors.

  12. FremyCompany says:

    It would be great to have a way to create good .NET add-on for IE. I have at least one .NET add-on installed on my IE. It *may* explains why my IE is not as smart as I want to, but since this add-on is self-made and I don’t have enought C++ knowledge to make it in C++, there’s no way to change that.

    Beside that, .NET is the Microsoft-promoted learning language. It would be great to have IE better supporting it. Office support .NET add-ons and I don’t remeber any complains about that beeing slow. Maybe the way the add-on structure is on IE make it slow for .NET add-ons, though.

    The last thing is that it’s not normal that an add-on can be installed in IE whithout the knowledge of the user. I think FireFox warns you when you’ve installed/updated a new extension. IE should do the same, you then couldn’t have such problem 🙂

  13. @FremyCompany: Office applications are each a single monolithic process, which means that the burden of loading the CLR is (effectively) much lower. Users of Office have different performance expectations than end-users who are merely opening new browser tabs.

    The Office team made a major investment in .NET programmability, and IE has not prioritized such an investment to date (as we have other, higher priorities).

    Your statement that "it’s not normal" was perhaps better stated that "It’s unfortunate that add-ons can be registered to run in IE unexpectedly." I agree. The addon story in IE is quite a bit more complicated than that of Firefox, and this is something that gives them an advantage for understandability. They still have some problems (e.g. don’t explain to users how to uninstall HKLM addons) but overall they have a nice experience.

    I’m curious: What does your .NET addon do?

  14. FremyCompany says:

    @EricLaw : Yes, you’re true. Office only need one proccess. I don’t had thought about that.

    I fully understand you’ve higher priorities than to *ameliorate* .NET integration in IE (because, in fact, it already works, it’s perfectible, but it works). If I were IE Architect, I would not spend any time to that problem, either. It’s why I’ve said *It would be great*… Yes, I know, you may say I’m a dreamer… (But I’m not the only one !)

    (BTW, sorry if "It’s not normal" can’t be said in English. In French "It’s not normal" has the meaning of "It should really not have been so", showing a strong disagree on something that happens or has happened. We for example say "It’s not normal that children are alone in the street at night !")

    To respond to your question, my add-on is something that complete the AddBlock of IEPro. IEPro perfoms URL Blocking and HTML filtering. But with IEPro, you can’t perform CSS Filtering. So, I use a simple IE’s UserStyleSheet, and my program add some CSS classes to the HTML element based on the URL of the document.

    It also help me to ‘restyle’ websites.

    Here’s a sample of my CSS UserSytleSheet :


    /* <url HTMLAttribute="BingSearch">*</url> */

    HTML.BingSearch .ansC, HTML.BingSearch .sr_dcard {

       border: gray 1px solid !important;

       padding: 4px !important;

       background: #fafafa !important;



    It could probably be easily done in C++, but I don’t feel me smart enougth in that language to try that. I know I should learn, but I’m currently happy with .NET and I’ll learn C++ at universtity.

  15. EricLaw [MSFT] says:

    @FremyCompany: Ah, I didn’t realize that you weren’t a native English speaker. Your English is way better than my French. 🙂

    Your extension sounds interesting.

  16. FremyCompany says:

    @EricLaw : My English may sound correct when you’re reading me, but anyone who tries to listen to me in English can only have one reaction : the giggle. I have diffculties to wonder how I should say a word in spoken English. It’s way different from what is wrotten. A single letter could have many different ways to be pronounced. Generally, my words end up in something that’s neither understandable, neither understood. But it’s always funny ! 😉

    For what’s wrotten English, it’s far easier to learn. When you’re programmer, you find many more resources in English than in French. And it’s the same for dev communities. So learning English seems natural.

    BTW, I think I can remeber somethig to write .NET addons for IE. It’s called SpicIE. I performs some components encapsulation and do the needed registry edits. For the rest, you simply need to add a reference to mshtml.tlb to use IE’s interfaces. I’ve looked in the add-on handler of IE, it takes 0.3s to load my add-on. I must admit it’s quite a lot regarding to the tab creating proccess.

  17. FremyCompany says:

    BTW, I’m asking myself a question. Is it possible for IE to measure anormal IE performances and propose to the user to try to run IE in "No Add-on" mode to see if there’s an Add-On performance issue ?

    Many users (let’s say 99%) are not aware of the No Add-On Mode, and/or don’t have the reflex to think that an add-on could make IE slower. If the No Add-On mode don’t solve the problem, maybe you could ask to send an error repport to IE (even if there’s no error, just a slow browser; sometimes it’s due to obscure hardware incompatibilities that could be fixed by updating a driver).

  18. hAl says:

    Does the addon manager not list hte performance cost of a .net plugin in the load time column ?

  19. EricLaw [MSFT] says:

    @hAl: I’m not entirely positive. The issue is that the "Load Time" column is a wrapper around a very specific part of the load path (including SetSite, where most addons do their work). I’m not sure when exactly the framework ends up getting loaded in the case where the addon is written in .NET and exposed as a COM object.

    The other problem is that the .NET Framework load time is highly variable, depending on whether something else is already using it. So you’ll have a big skew between the "average" and "max" load time.

  20. hAl says:

    New tab creation is still a hot item in IE8 critisisms and there seems little possibility to measure what things cause it.

    p.s. The IEblog seems down

  21. EricLaw [MSFT] says:

    @hAl: With hundreds of millions of users, IE has all sorts of criticisms and hot items. 🙂

    As elaborated in my post on "Unshackling performance" there are a number of ways to measure performance of new tab creation and root cause problems with it, but yes, it’s a pretty manual process. For the majority of users, trying IE with addons off is the simplest way to get started in the right direction.

    I’m sure the IEBlog site will be back up shortly.

  22. sandra says:

    i do not write any of my own programs, etc…On my computer, under add/remove programs….i currently have installed [a lot of versions of the .NET framework.  Is that okay?]

  23. @Sandra: The .NET Framework is needed to run programs written by other developers. Even if you don’t write programs yourself, you’ll need it if you want to run any program which requires .NET.

  24. jenny says:

    I wrote a program to try to change the default search provider in IE9. The problem is when dialog pop up to let user choose if they want to change the default search provider, instead of showing that it's my program/vendor suggest the new default search provider, it shows that OLEAUT32.dll suggest the new default search provider. Could you shed some light of how to fix this and how does IE handle this dialog internally? Thanks

  25. @Jenny: The proper approach is to call the IOpenServiceManager APIs described in this blog post:…/staying-in-control-of-your-default-search-provider.aspx

Comments are closed.

Skip to main content