Windows Explored

This is another example of where you can use Process Explorer for application hang analysis. In the case here, when replying to a specific email or forwarding it, Outlook 2003 would become unresponsive. To get an idea of what was happening we ran Process Explorer on the user’s workstation and opened the Outlook.exe process properties. From here, we went to the Threads tab, selected the main OUTLOOK .EXE thread and then took a look at the stack:

What is mup.sys? In short, it is the Multiple UNC Provider driver, which tells us the PC was trying to contact another system, which is unreachable. I had the message attached to a new email and sent it to myself to reproduce and examine with another SysInternals utility. I turned to TCPView to see who it was trying to contact by replying to the message after moving it to my Inbox. saw many attempted connection request to invalid IP addresses:

To explain why it doing this, I we started looking through the message and saw these links near the end:

Hovering over the links reveals where the invalid IP’s are being picked up from in the message. Right-clicking in the message body to view the html source, we can see actual links are formatted as href tags.

Outlook’s 2003 outbind protocol is adding 0.0.0 to each href address. When attempting to reply or forward, the hang is a result of each link attempting to resolve to that IP. We have not seen (or I haven’t seen) this before but the issue may be the result of one of recipient’s reply being encoded or decoded in some manner not compatible with Outlook/Exchange. The user in this case actually uses the Entourage email client instead of Outlook so that could also have played a role.

Testing the same reply/forward functionality with this message in Outlook 2010 does not produce the same behavior, which means the outbind:// Outlook protocol is handled differently, is no longer used, or something is different in the way in which Outlook 2007/2010 rely on Microsoft Office html rather than IE’s mshtml. I am leaning toward the absence of the outbind protocol as I do not see the links being converted to 0.0.0.X: