Res-Q'd by Spy++

Today while searching for a file on a windows XP machine, I launched desktop search (win+F), and as usually I don’t use this, I preferred original search to be used. After finishing the search, as I was about to close desktop search, I see following error and unable to close this window. Also mysteriously this window had lost its title, just showing folder icon.

This window is busy. Closing this window may cause some problems. Do you want to close it anyway. OK/Cancel ?

Thinking not such a big deal, I threw up task manger to get process to be killed, much to my surprise the related processes viz searchindexer.exe, cidaemon.exe, SearchProtocolHost.exe does not had impact on the hung window after killing them. Lost in thinking what would be process name for desktop search ???

Neither Google provided any related names that I could think of. Launching more and more desktop search windows just stood hung there without being able to be closed. I thought to launch Sysinternals process explorer to see under which process this might be disguising. I find NOTHING L

I kept closing all unnecessary application keeping just those windows there. In the midst of trying to check which process is launched or highlighted in process explorer, I had already gathered 10 windows of hung desktop search. What the heck, it was already 1 hour!

Played another half hour researching my toolbox items to see if there would be any tool which can display which process is hiding desktop exe. Find handle search did not give any results. The find process window of procexp too showed up process this time Explorer.exe. Something was now at least clear. But the properties window showed many Non-existent processes. Hmm!

Finally sometime later I came up with Spy++ to track down messages. You may know that this is a great tool to look messages sent by windows and also shows related threads. Using its find window option quickly showed me that Explorer was using desktop search. Scanning all threads was not a difficult job as each thread had the messages and button names similar to desktop search.

 

Now it was easy to grab the thread ID like the one shown below (hex), use calc.exe to convert hex to decimal.

And later used process explorer, track down explorer .exe, double click to show open the properties. Check the thread Id converted above, and use Kill option to kill the thread

Wow, the hung window killed! Alas 2 hours of fruitful research don’t know how that thread hung? And what were other possible consequences of killing the thread, anyhow I did not face anything unusual, as desktop search worked as before J

kirann