A very "touchy" file

[Tom Del Rosso]

In John Herbster typed:

Perhaps the problem is not with the file but rather
with what you have the "file association" set to do
when it sees a fine with the file's extension. Is
"BIN" the real extension? What do you have the
BIN association set to do? Do you have other
files with the same extension? Do they cause the
same problem? Regards, JohnH

Yes, BIN is the real extension.

But I didn't execute it. I only single-clicked, and the same thing also
happens if I:

-draw a rubber-band box around it
-use the arrow keys to highlight successive files
-read its contents with a DOS program like LIST.COM

The first two trigger the reboot as soon as the file becomes
highlighted. At that moment Windows would read the contents of the file
to look for its properties. The DOS program reading the file produces
the same reaction.

Just now, I took your suggestion, and there is no association for *.bin
files, and nothing happens when I select or read from them, even if I
first copy them to the root.

I just got another idea. What if I create another file with that name?
Is it the name alone that does it? It would seem so, because after I
rename that file in safe mode I can read from it, and its contents don't
cause a problem, so it must be the name.

I'll have to try that later. In the meantime, if anybody has a Win2k
system that was an upgrade install, and had a downloaded copy of NAV in
the past (under Win98) but now has a later version of NAV, you might try
creating a file called os581474.bin and see what happens.

 

[Enkidu]

But I didn't execute it. I only single-clicked, and the same thing also
happens if I:

-draw a rubber-band box around it
-use the arrow keys to highlight successive files
-read its contents with a DOS program like LIST.COM

What happens if you draw a rubber band around a normal shortcut?

(BTW did you realise that you have an os...bin laden system?)

Cheers,

Cliff

 

[Warren C. E. Austin]

On a Win2k machine (upgrade install) this file is in the root folder:

os581474.bin

The few Google references suggest that it has to do with trial-ware, but
I can't think of any trial-ware that was installed on this machine.

What makes it so "touchy" is that all I have to do is single click on it
and there is an immeidiate reboot. It goes straight to the POST with no
BSOD or brief flash or anything. It happens the same way if I use the
keyboard arrows to highlight successive files, or if I use the mouse to
box a group of files. As soon as that one is highlighted, it reboots.
It behaves the same if I'm logged in as administrator or restricted
user. It reboots too fast to use filemon to see what happened.

My only guess is that Windows is reading file properties to put in the
little pop-up description, and something doesn't like that.

But what?

Do you, by any chance, have AOL's AIM 5.5 (the final "first" release of the code dated sometime late November or early December 2003, not the more recent beta, with the "Wild Tangent Technologies" and "WeatherCast" disable options during set-up) installed on your system?

I discovered upon first install of that particular AIM 5.5 version (this being the version subject of considerable controversy until the release a week ago of the beta code AIM with the disable options) that the file you mention, or one very similar, was being created at the time of the install. Not the least of the problems that manifested themselves on my machine were behaviour such as you have been describing; including but not limited to phantom virus patterns, svchost malfunctions, and arbitrary re-boots. The most serious issues arose when I kept getting "System boot device errors and was locked out of my system, requiring a complete reformat and re-install of the OS and software. Unfortunately, an un-install of that particular version of AIM using the Windows, or AIM Un-installer does not remover the some 175, or more Registry entries related to Wild Tangent Technologies that get left behind, and it has now been discovered, it's damn near impossible to remove them,
as they replicate themselves faster than you can delete them, including the folders (and files) it creates in your Windows folder.

It took me three weeks to rid my system of the pesky little critters, and then only after using Ontrack's FixIt Registry Editor, which seemed to be the only one capable of removing them without their being replicated upon reboot.

Once you rid your system of the Wild Tangent Technologies files and folders and all the Registry Keys and entries, should you have elected not to un-install the initial AIM 5.5 release, the application does, and will continue to function pretty well as you might expect, including all their newest Video toys and features; for some unknown reason that version is playing hell with W2K and XP installs, and necessitated the beta with the disable option. Better to not install it at all if it can be avoided choosing instead to remain with an earlier build, especially should the Video features not be required.

Warren C. E. Austin
Toronto, Canada

 

[Tom Del Rosso]

In Warren C. E. Austin typed:

Do you, by any chance, have AOL's AIM 5.5 (the final "first" release
of the code dated sometime late November or early December 2003, not
the more recent beta, with the "Wild Tangent Technologies" and
"WeatherCast" disable options during set-up) installed on your
system?

No, but thanks for the warning. I take care of some PCs that have AIM.

I discovered upon first install of that particular AIM 5.5 version
(this being the version subject of considerable controversy until the
release a week ago of the beta code AIM with the disable options)
that the file you mention, or one very similar, was being created at
the time of the install.

So this was a beta, and that would explain the use of a timer like those
used for trial-ware. Apparently it's called VBOX.

 

[Tom Del Rosso]

In Enkidu typed:

What happens if you draw a rubber band around a normal shortcut?

Nothing. I haven't found any other files that would do that. BTW this
file wasn't a shortcut.

(BTW did you realise that you have an os...bin laden system?)

That explains everything!!!

 

[Tom Del Rosso]

In Tom Del Rosso typed:

I just got another idea. What if I create another file with that
name? Is it the name alone that does it? It would seem so, because
after I rename that file in safe mode I can read from it, and its
contents don't cause a problem, so it must be the name.

I tried what I wrote above, and it didn't do anything unusual. So to
cause a reboot the file must have both the name and the content.

 

[John Herbster]

But I didn't execute it. I only single-clicked, and the
same thing also happens if I
-draw a rubber-band box around it
-use the arrow keys to highlight successive files
-read its contents with a DOS program like LIST.COM
The first two trigger the reboot as soon as the file becomes
highlighted. At that moment Windows would read the contents
of the file to look for its properties.
...
What if I create another file with that name? Is it the name
alone that does it? It would seem so, because after I
rename that file in safe mode I can read from it, and its
contents don't cause a problem, so it must be the name.

Can the select of that particular name cause something in
your OS to be triggered to do something that causes the
reboot?

Have you searched your disk for other occurrences within
a file of that name?

I am waiting for Win2K experts to add their comments
to this thread.

Regards, JohnH

 

[Tom Del Rosso]

In John Herbster typed:

Can the select of that particular name cause something in
your OS to be triggered to do something that causes the
reboot?

Not the name alone. I just posted a follow-up reply to the same message
you just replied to. I tried the experiment and it did nothing.

Have you searched your disk for other occurrences within
a file of that name?

Of course. Nothing except the IMAGE.DAT file, where Norton Utilities
puts the name of every file in the root. And nothing in the registry
except the MRU search list, because I had searched for it.

I am waiting for Win2K experts to add their comments
to this thread.

I think they already have. They said delete it, so I did.