C:\Program Files\Windows Mail folder crashes Windows Explorer

[Guest]

I'm running Vista Home Premium x86. Everything is up to date, antivirus and
antispyware are clean. About a week ago, I started noticing that whenever I
went into Computer, opened C:\Program Files and scrolled to the bottom of the
list (in Tiles view), I would get an instant "Windows Explorer Has Stopped
Working" message and crash out to my desktop. Through trial and error, I
determined that the dynamic icon for C:\Program Files\Windows Mail was
somehow causing this, and sure enough, when I went to a static icon view like
Details, I could scroll all the way down with no problems. I've edited the
WM folder icon so that it no longer crashes Windows Explorer on sight, but
now whenever I try to open C:\Program Files\Windows Mail (just the folder,
not the program) it still crashes Windows Explorer -- even after restarts.
The modified date for the Windows Mail folder is 7/11/07 -- which was the day
I installed the latest batch of patches from Windows Update, so I think the
last Windows Mail patch is somehow to blame. At any rate, this never
happened before 7/11/07.

It seems like it must be a corrupted icon or thumbnail path, but the crash
happens so quickly that I can't do anything about it. I suppose I could
tinker with it in safe mode, but I don't know if I could identify the
offending file. The Windows Mail program seems to open normally (though I
use Outlook, so I can't tell if it's working). I guess I just want to report
this to MS so that it cah be dealt with in a future patch. It does, however,
make me wish I could just uninstall the problematic program...

 

[dean-dean]

To test the corrupted thumbnail cache theory, try this (you can turn it back
on after the test).
Go to Control Panel > Folder Options > View tab. Put a check next to
"Always show icons, never thumbnails" (Apply, OK).

Navigate to C:\Program Files\Windows Mail using the Tiles View. Does
opening the folder crash explorer? Even with its icon reset to the Default?

If it doesn't crash, or I guess even if it does, go to Start
Menu\Programs\Accessories\System Tools and open Disk Cleanup.
Put a checkmark next to Thumbnails. Click on OK This will rebuild your
Thumbnails database.

Then un-check "Always show icons, never thumbnails" (Apply, OK).

 

[Guest]

When I checked "always show icons, never thumbnails" I was able to explore
the Windows Mail folder without crashing. I deleted the thumbnail cache
using disc cleanup, as you said, but when I went back and unchecked "always
show icons," I was back to square one. Now Windows Explorer crashes again
when I scroll down to the bottom of Program Files, and the Windows Mail file
folder is inaccessable.

It must be a thumbnail path... right?

 

[Guest]

Okay, now after deleting my thumbnails, I can't get C:\Program Files to stop
crashing when I scroll down to the Windows Mail folder icon with dynamic
icons/thumbnails enabled. I can't change the Windows Mail folder icon to
anything else that stays. And I keep getting the same error:

Problem Event Name: APPCRASH
Application Name: explorer.exe
Application Version: 6.0.6000.16386
Application Timestamp: 4549b091
Fault Module Name: ArcSpl.ax
Fault Module Version: 2.4.1.12
Fault Module Timestamp: 41a4a24c
Exception Code: c0000094
Exception Offset: 00002305
OS Version: 6.0.6000.2.0.0.768.3
Locale ID: 1033
Additional Information 1: d6aa
Additional Information 2: 550813108d42c370043e28bb37aac5af
Additional Information 3: d6aa
Additional Information 4: 550813108d42c370043e28bb37aac5af


I want to stress this: I can't even have the C:\Program Files\Windows Mail
FOLDER on my screen (in any kind of thumbnail/dynamic icon view) without
crashing Windoes Explorer. This is absolutely ridiculous, Microsoft. Patch
this nonsense or let us uninstall Windows Mail.

 

[dean-dean]

In Start Menu\Programs\Accessories, click on Run. Copy and Paste this in
the Run box:

C:\Program Files\Windows Mail

Click OK. Does the folder open? In that folder, is there a (hidden,
system) file called desktop.ini? Normally there shouldn't be one in this
particular folder (a desktop.ini may be needed in other folders, however, so
don't make assumptions here). Delete the desktop.ini in that folder if
there is.

Do you have a program on your computer from the ArcSoft company , such as
those listed here
http://www.arcsoft.com/support/downloads/download_patches.asp , or a program
seen elsewhere on their site? If you do, does the program add a context
menu item when you right-click a folder, especially, or right-click a file?

As far as "thumbnail path", the path would be the same for all folders; the
Windows Mail folder is not anything special in that respect, and should have
no special icon. If you sort your folders by Date Modified, does the
Windows Mail folder crash Explorer, or does another folder take its place?

My suspicion is that you have a 3rd party shell extension problem.

 

[Guest]

Responses appended:

In Start Menu\Programs\Accessories, click on Run. Copy and Paste this in
the Run box: C:\Program Files\Windows Mail
Click OK. Does the folder open?

Yes, but it immediately crashes WE unless I have "Always show icons..."
checked. I cannot navigate directly to the Windows Mail folder in any way
while thumbnails are enabled without crashing WE. If I open the Windows Mail
folder and then enable thumbnails, it crashes WE instantly. (This doesn't
happen with the en-US subfolder, however.)

In that folder, is there a (hidden, system) file called desktop.ini?

No, there isn't.

Do you have a program on your computer from the ArcSoft company...?

No. And I didn't install any new programs between July 5 (before this
started happening) and July 20 (after). The only thing to have changed on my
system during that time was the July 11 Windows Mail spam filter patch from
MS (and all the other MS patches, I guess).

If you do, does the program add a context
menu item when you right-click a folder, especially, or right-click a file?

The only non-Office right-click programs that come up in the context of my
Program Files are 7-Zip and Avast! They both predate this problem by some
months.

If you sort your folders by Date Modified, does the
Windows Mail folder crash Explorer, or does another folder take its place?

Oh yeah -- the Windows Mail folder is the only offending folder. I can see
it trying to create a "full folder" thumbnail, then WE crashes.

Also, even if I have "always show icons" checked, the Windows Mail folder
will still crash out WE if I left-click on the folder while the Details Pane
is enabled. I can turn on the Details Pane *in* the folder itself and click
on every icon with no problems (again, as long as thumbnails are disabled).

My suspicion is that you have a 3rd party shell extension problem.

Maybe, but C:\Program Files\Windows Mail is the only folder on my computer
that causes this. And it ony started around 2 weeks ago.

 

[Guest]

Okay, through a clever use of the Extra Large Icons setting, I've managed to
figure out that the cause of my problem is the OESpamFilter.dat file. If
that file is onscreen as a thumbnail or attempts to register in a folder
thumbnail, it crashes Windows Explorer. The problem is not general to .dat
files -- I can have any other .dat file onscreen and nothing happens. It's
only OESpamFilter.dat.

Windows won't let me delete or even hide this file (access is denied). If I
copy that file to some other location, it still crashes WE the same way
(though at least I can delete those copies).

What can I do about this? I've tried to change the default program for .dat
files (it had been Notepad), but to no avail.

 

[dean-dean]

Well, this is interesting. Somewhere on your computer there's a file named
ArcSpl.ax, which is somehow involved in your crashes. If you could
right-click on that file, and open its properties, on the Details tab, can
you tell what company made it or what program it might be involved with?
It's not a Vista OS file. Try looking under C:\Program Files\Common
Files\arcsoft\mpeg engine.

Anyway, having your .dat file extension associated with a program may be
key, too. Explorer is trying to create a picture of a .dat file, possibly,
and normally that file has no program association. (It might be better
putting a shortcut to Notepad in Sendto, and looking at an un-associated
..dat file that way, if you're so inclined). Why it's picking on
OESpamFilter.dat, I dunno.

If you want try un-associating the .dat file extension, in the registry
Editor, go to

HKEY_CLASSES_ROOT\.dat

and, in the right-hand pane, right-click and delete the value "(default)",
under Name, (which will have the value "dat_auto_file", under Data).
Otherwise, you could make a .reg file in Notepad with this:

--------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dat]
"NoOpen"="

 

[Guest]

dean-dean, you called it. I finally found the ArcSpl.ax file on my computer
-- it was installed along with Palm Desktop back in February as part of their
photo suite, and it's located under C:\Program Files\palmOne.

But when I go into regedit: HKEY_CLASSES_ROOT\.dat, there's an extra
subfolder "ShellEx" with another subfolder
"{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}". The (Default) key is present in
all 3, but I can't delete any of them. I get "unable to delete all specified
values." I've also not been able to successfully dis-associate my DAT files.

I wasn't expecting to see that "ShellEx" subfolder -- do you think I can
safely delete it? Or just substitute the key you suggested? I don't really
care if I lose the Arcsoft functionality, but I don't want to create
additional problems.

Well, this is interesting. Somewhere on your computer there's a file named
ArcSpl.ax, which is somehow involved in your crashes. If you could
right-click on that file, and open its properties, on the Details tab, can
you tell what company made it or what program it might be involved with?
It's not a Vista OS file. Try looking under C:\Program Files\Common
Files\arcsoft\mpeg engine.

Anyway, having your .dat file extension associated with a program may be
key, too. Explorer is trying to create a picture of a .dat file, possibly,
and normally that file has no program association. (It might be better
putting a shortcut to Notepad in Sendto, and looking at an un-associated
.dat file that way, if you're so inclined). Why it's picking on
OESpamFilter.dat, I dunno.

If you want try un-associating the .dat file extension, in the registry
Editor, go to

HKEY_CLASSES_ROOT\.dat

and, in the right-hand pane, right-click and delete the value "(default)",
under Name, (which will have the value "dat_auto_file", under Data).
Otherwise, you could make a .reg file in Notepad with this:

--------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dat]
"NoOpen"="

--------------------------------------------------------

Copy the above into Notepad (not including the dashes) and save it as
dat.reg (no .txt extension). Close Notepad, then open dat.reg, and allow
the Merge.

Okay, through a clever use of the Extra Large Icons setting, I've managed
to
figure out that the cause of my problem is the OESpamFilter.dat file. If
that file is onscreen as a thumbnail or attempts to register in a folder
thumbnail, it crashes Windows Explorer. The problem is not general to
.dat
files -- I can have any other .dat file onscreen and nothing happens.
It's
only OESpamFilter.dat.

Windows won't let me delete or even hide this file (access is denied). If
I
copy that file to some other location, it still crashes WE the same way
(though at least I can delete those copies).

What can I do about this? I've tried to change the default program for
.dat
files (it had been Notepad), but to no avail.

 

[dean-dean]

Restoring your .dat extension to the Vista default won't hurt anything, and
is advisable. Yes, your PalmOne made a shell extension for .dat files,
particularly in regards to Mail, but it's not compatible with, nor does it
work, in Vista. Vista handles these thumbnails differently.
"{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}" is an old thumbnail preview value
for creating thumbnails for .eml,.nws, .htm and .html. I'm not sure how
your .dat files got involved. As a matter of fact, I think Microsoft
discontinued using it because of a the security risk (Web View Script
Injection Vulnerability) it caused with Webvw.dll; Vista no longer uses
"Web View", but rather "Previews and Filters".

At any rate, removing the shell extension should not harm your PalmOne. In
PalmOne's Options/Preferences, or in its "Photo Suite", can you turn the
shell extension off (looking for something along the line of "Show
Preview...")? Can you uninstall the Photo Suite apart from PalmOne? Are
your picture files (.jpg's, etc.) associated with Photo Suite?

To restore your .dat file extension, open C:\Windows\System32\regedt32.exe,
by right-clicking on it and choosing Run as Administrator. Go to

HKEY_CLASSES_ROOT\.dat

and, in the LEFT-hand pane, select the .dat key, and delete it. Leave
Registry Editor open.

Open Notepad.

--------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dat]
"NoOpen"="

--------------------------------------------------------

Copy the above and Paste it into Notepad (not including the dashes) and save
it as dat.reg (no .txt extension).

Back in Registry Editor, on the menu, choose File, and then Import.
Navigate to wherever dat.reg is, and select it. Click Open in the dialog.
Close Registry Editor. Log Off, and then back On. Your .dat files should be
back to normal, and Explorer, hopefully, won't crash.

Now sometimes, when you open a photo program, it may re-write the registry
keys it thinks it needs. You might want to keep an eye on the .dat key in
the Registry, to check for that behavior.

dean-dean, you called it. I finally found the ArcSpl.ax file on my
computer
-- it was installed along with Palm Desktop back in February as part of
their
photo suite, and it's located under C:\Program Files\palmOne.

But when I go into regedit: HKEY_CLASSES_ROOT\.dat, there's an extra
subfolder "ShellEx" with another subfolder
"{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}". The (Default) key is present in
all 3, but I can't delete any of them. I get "unable to delete all
specified
values." I've also not been able to successfully dis-associate my DAT
files.

I wasn't expecting to see that "ShellEx" subfolder -- do you think I can
safely delete it? Or just substitute the key you suggested? I don't
really
care if I lose the Arcsoft functionality, but I don't want to create
additional problems.

Well, this is interesting. Somewhere on your computer there's a file
named
ArcSpl.ax, which is somehow involved in your crashes. If you could
right-click on that file, and open its properties, on the Details tab,
can
you tell what company made it or what program it might be involved with?
It's not a Vista OS file. Try looking under C:\Program Files\Common
Files\arcsoft\mpeg engine.

Anyway, having your .dat file extension associated with a program may be
key, too. Explorer is trying to create a picture of a .dat file,
possibly,
and normally that file has no program association. (It might be better
putting a shortcut to Notepad in Sendto, and looking at an un-associated
.dat file that way, if you're so inclined). Why it's picking on
OESpamFilter.dat, I dunno.

If you want try un-associating the .dat file extension, in the registry
Editor, go to

HKEY_CLASSES_ROOT\.dat

and, in the right-hand pane, right-click and delete the value
"(default)",
under Name, (which will have the value "dat_auto_file", under Data).
Otherwise, you could make a .reg file in Notepad with this:

--------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dat]
"NoOpen"="

--------------------------------------------------------

Copy the above into Notepad (not including the dashes) and save it as
dat.reg (no .txt extension). Close Notepad, then open dat.reg, and allow
the Merge.

Okay, through a clever use of the Extra Large Icons setting, I've
managed
to
figure out that the cause of my problem is the OESpamFilter.dat file.
If
that file is onscreen as a thumbnail or attempts to register in a
folder
thumbnail, it crashes Windows Explorer. The problem is not general to
.dat
files -- I can have any other .dat file onscreen and nothing happens.
It's
only OESpamFilter.dat.

Windows won't let me delete or even hide this file (access is denied).
If
I
copy that file to some other location, it still crashes WE the same way
(though at least I can delete those copies).

What can I do about this? I've tried to change the default program for
.dat
files (it had been Notepad), but to no avail.

 

[Guest]

Ironically enough, Palm just released a Vista-compatible Palm Desktop version
yesterday, so I was able to uninstall the offending program, restore the
registry, and install the new version. Most importantly, my .dat files
aren't crashing my system anymore.

Thanks a lot for your help, dean-dean. I owe you a virtual beer.

Restoring your .dat extension to the Vista default won't hurt anything, and
is advisable. Yes, your PalmOne made a shell extension for .dat files,
particularly in regards to Mail, but it's not compatible with, nor does it
work, in Vista. Vista handles these thumbnails differently.
"{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}" is an old thumbnail preview value
for creating thumbnails for .eml,.nws, .htm and .html. I'm not sure how
your .dat files got involved. As a matter of fact, I think Microsoft
discontinued using it because of a the security risk (Web View Script
Injection Vulnerability) it caused with Webvw.dll; Vista no longer uses
"Web View", but rather "Previews and Filters".

At any rate, removing the shell extension should not harm your PalmOne. In
PalmOne's Options/Preferences, or in its "Photo Suite", can you turn the
shell extension off (looking for something along the line of "Show
Preview...")? Can you uninstall the Photo Suite apart from PalmOne? Are
your picture files (.jpg's, etc.) associated with Photo Suite?

To restore your .dat file extension, open C:\Windows\System32\regedt32.exe,
by right-clicking on it and choosing Run as Administrator. Go to

HKEY_CLASSES_ROOT\.dat

and, in the LEFT-hand pane, select the .dat key, and delete it. Leave
Registry Editor open.

Open Notepad.

--------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dat]
"NoOpen"="

--------------------------------------------------------

Copy the above and Paste it into Notepad (not including the dashes) and save
it as dat.reg (no .txt extension).

Back in Registry Editor, on the menu, choose File, and then Import.
Navigate to wherever dat.reg is, and select it. Click Open in the dialog.
Close Registry Editor. Log Off, and then back On. Your .dat files should be
back to normal, and Explorer, hopefully, won't crash.

Now sometimes, when you open a photo program, it may re-write the registry
keys it thinks it needs. You might want to keep an eye on the .dat key in
the Registry, to check for that behavior.

dean-dean, you called it. I finally found the ArcSpl.ax file on my
computer
-- it was installed along with Palm Desktop back in February as part of
their
photo suite, and it's located under C:\Program Files\palmOne.

But when I go into regedit: HKEY_CLASSES_ROOT\.dat, there's an extra
subfolder "ShellEx" with another subfolder
"{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}". The (Default) key is present in
all 3, but I can't delete any of them. I get "unable to delete all
specified
values." I've also not been able to successfully dis-associate my DAT
files.

I wasn't expecting to see that "ShellEx" subfolder -- do you think I can
safely delete it? Or just substitute the key you suggested? I don't
really
care if I lose the Arcsoft functionality, but I don't want to create
additional problems.

Well, this is interesting. Somewhere on your computer there's a file
named
ArcSpl.ax, which is somehow involved in your crashes. If you could
right-click on that file, and open its properties, on the Details tab,
can
you tell what company made it or what program it might be involved with?
It's not a Vista OS file. Try looking under C:\Program Files\Common
Files\arcsoft\mpeg engine.

Anyway, having your .dat file extension associated with a program may be
key, too. Explorer is trying to create a picture of a .dat file,
possibly,
and normally that file has no program association. (It might be better
putting a shortcut to Notepad in Sendto, and looking at an un-associated
.dat file that way, if you're so inclined). Why it's picking on
OESpamFilter.dat, I dunno.

If you want try un-associating the .dat file extension, in the registry
Editor, go to

HKEY_CLASSES_ROOT\.dat

and, in the right-hand pane, right-click and delete the value
"(default)",
under Name, (which will have the value "dat_auto_file", under Data).
Otherwise, you could make a .reg file in Notepad with this:

--------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dat]
"NoOpen"="

--------------------------------------------------------

Copy the above into Notepad (not including the dashes) and save it as
dat.reg (no .txt extension). Close Notepad, then open dat.reg, and allow
the Merge.


Okay, through a clever use of the Extra Large Icons setting, I've
managed
to
figure out that the cause of my problem is the OESpamFilter.dat file.
If
that file is onscreen as a thumbnail or attempts to register in a
folder
thumbnail, it crashes Windows Explorer. The problem is not general to
.dat
files -- I can have any other .dat file onscreen and nothing happens.
It's
only OESpamFilter.dat.

Windows won't let me delete or even hide this file (access is denied).
If
I
copy that file to some other location, it still crashes WE the same way
(though at least I can delete those copies).

What can I do about this? I've tried to change the default program for
.dat
files (it had been Notepad), but to no avail.

 

[dean-dean]

Well, you're like a dog with a bone. This is good. I've never seen a .dat
file with a shell extension key. Now your .dat key (folder) in the Registry
should have no sub-keys, and only have two values in the left pane, under
the Name column: Default, with "(Value not set)" under the Data column, and
NoOpen, with nothing written, as in blank, under the Data column. Thanks
for the beer!

Ironically enough, Palm just released a Vista-compatible Palm Desktop
version
yesterday, so I was able to uninstall the offending program, restore the
registry, and install the new version. Most importantly, my .dat files
aren't crashing my system anymore.

Thanks a lot for your help, dean-dean. I owe you a virtual beer.

Restoring your .dat extension to the Vista default won't hurt anything,
and
is advisable. Yes, your PalmOne made a shell extension for .dat files,
particularly in regards to Mail, but it's not compatible with, nor does
it
work, in Vista. Vista handles these thumbnails differently.
"{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}" is an old thumbnail preview
value
for creating thumbnails for .eml,.nws, .htm and .html. I'm not sure how
your .dat files got involved. As a matter of fact, I think Microsoft
discontinued using it because of a the security risk (Web View Script
Injection Vulnerability) it caused with Webvw.dll; Vista no longer uses
"Web View", but rather "Previews and Filters".

At any rate, removing the shell extension should not harm your PalmOne.
In
PalmOne's Options/Preferences, or in its "Photo Suite", can you turn the
shell extension off (looking for something along the line of "Show
Preview...")? Can you uninstall the Photo Suite apart from PalmOne? Are
your picture files (.jpg's, etc.) associated with Photo Suite?

To restore your .dat file extension, open
C:\Windows\System32\regedt32.exe,
by right-clicking on it and choosing Run as Administrator. Go to

HKEY_CLASSES_ROOT\.dat

and, in the LEFT-hand pane, select the .dat key, and delete it. Leave
Registry Editor open.

Open Notepad.

--------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dat]
"NoOpen"="

--------------------------------------------------------

Copy the above and Paste it into Notepad (not including the dashes) and
save
it as dat.reg (no .txt extension).

Back in Registry Editor, on the menu, choose File, and then Import.
Navigate to wherever dat.reg is, and select it. Click Open in the
dialog.
Close Registry Editor. Log Off, and then back On. Your .dat files should
be
back to normal, and Explorer, hopefully, won't crash.

Now sometimes, when you open a photo program, it may re-write the
registry
keys it thinks it needs. You might want to keep an eye on the .dat key
in
the Registry, to check for that behavior.

dean-dean, you called it. I finally found the ArcSpl.ax file on my
computer
-- it was installed along with Palm Desktop back in February as part of
their
photo suite, and it's located under C:\Program Files\palmOne.

But when I go into regedit: HKEY_CLASSES_ROOT\.dat, there's an extra
subfolder "ShellEx" with another subfolder
"{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}". The (Default) key is present
in
all 3, but I can't delete any of them. I get "unable to delete all
specified
values." I've also not been able to successfully dis-associate my DAT
files.

I wasn't expecting to see that "ShellEx" subfolder -- do you think I
can
safely delete it? Or just substitute the key you suggested? I don't
really
care if I lose the Arcsoft functionality, but I don't want to create
additional problems.





:

Well, this is interesting. Somewhere on your computer there's a file
named
ArcSpl.ax, which is somehow involved in your crashes. If you could
right-click on that file, and open its properties, on the Details tab,
can
you tell what company made it or what program it might be involved
with?
It's not a Vista OS file. Try looking under C:\Program Files\Common
Files\arcsoft\mpeg engine.

Anyway, having your .dat file extension associated with a program may
be
key, too. Explorer is trying to create a picture of a .dat file,
possibly,
and normally that file has no program association. (It might be
better
putting a shortcut to Notepad in Sendto, and looking at an
un-associated
.dat file that way, if you're so inclined). Why it's picking on
OESpamFilter.dat, I dunno.

If you want try un-associating the .dat file extension, in the
registry
Editor, go to

HKEY_CLASSES_ROOT\.dat

and, in the right-hand pane, right-click and delete the value
"(default)",
under Name, (which will have the value "dat_auto_file", under Data).
Otherwise, you could make a .reg file in Notepad with this:

--------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dat]
"NoOpen"="

--------------------------------------------------------

Copy the above into Notepad (not including the dashes) and save it as
dat.reg (no .txt extension). Close Notepad, then open dat.reg, and
allow
the Merge.


Okay, through a clever use of the Extra Large Icons setting, I've
managed
to
figure out that the cause of my problem is the OESpamFilter.dat
file.
If
that file is onscreen as a thumbnail or attempts to register in a
folder
thumbnail, it crashes Windows Explorer. The problem is not general
to
.dat
files -- I can have any other .dat file onscreen and nothing
happens.
It's
only OESpamFilter.dat.

Windows won't let me delete or even hide this file (access is
denied).
If
I
copy that file to some other location, it still crashes WE the same
way
(though at least I can delete those copies).

What can I do about this? I've tried to change the default program
for
.dat
files (it had been Notepad), but to no avail.

 

[cquirke (MVP Windows shell/user)]

On Tue, 24 Jul 2007 10:34:01 -0700, JasonH

I'm running Vista Home Premium x86. Everything is up to date, antivirus and
antispyware are clean. About a week ago, I started noticing that whenever I
went into Computer, opened C:\Program Files and scrolled to the bottom of the
list (in Tiles view), I would get an instant "Windows Explorer Has Stopped
Working" message and crash out to my desktop. Through trial and error, I
determined that the dynamic icon for C:\Program Files\Windows Mail was
somehow causing this, and sure enough, when I went to a static icon view like
Details, I could scroll all the way down with no problems.

Interesting, and nasty.

IMO, allowing content to define its own icons is a fundamental safety
risk, if the icon extraction code is an exploitable surface.

I've edited the WM folder icon so that it no longer crashes Windows
Explorer on sight, but now whenever I try to open
C:\Program Files\Windows Mail (just the folder, not the program) it
still crashes Windows Explorer -- even after restarts.

Explorer navigates the namespace, not the file system, and "special"
folders often patch in their own code handlers that are invoked when
you navigate into the namespace.

That, too, is a "safety gap", i.e. the low risk you think you are
taking (navigating into a passive container to safely view a list of
items in it) is the high risk of running code that defines the folder.

The modified date for the Windows Mail folder is 7/11/07 -- which was the day
I installed the latest batch of patches from Windows Update, so I think the
last Windows Mail patch is somehow to blame. At any rate, this never
happened before 7/11/07.
O...K...

It seems like it must be a corrupted icon or thumbnail path, but the crash
happens so quickly that I can't do anything about it. I suppose I could
tinker with it in safe mode, but I don't know if I could identify the
offending file.

Do so, if only to see whether Safe Mode would be safe, if this
accidental crash was found to be an exploitable condition, and used as
such by mass malware (as could happen at any time).

The Windows Mail program seems to open normally (though I
use Outlook, so I can't tell if it's working).

I avoid apps that hold your data hostage to app version, then bind
that version to a larger "container" product, so that knocks out any
of MS's email apps. I also dislike an email storage model that hides
incoming malware from av scanners and manual management, as most email
apps do. Eudora is free of bother of these issues.

It does make me wish I could just uninstall the problematic program.

Yup. Being able to "turn off" bundleware does not level the
competitive playing field, because you are forced to swallow the bloat
of the avoided MSware, as well as being compelled to patch it. So
competing apps that are better in terms of efficiency or patch
requirements, can't relieve you of the burden of the MSware.

 

[cquirke (MVP Windows shell/user)]

On Tue, 24 Jul 2007 21:06:04 -0700, JasonH

When I checked "always show icons, never thumbnails" I was able to explore
the Windows Mail folder without crashing. I deleted the thumbnail cache
using disc cleanup, as you said, but when I went back and unchecked "always
show icons," I was back to square one. Now Windows Explorer crashes again
when I scroll down to the bottom of Program Files, and the Windows Mail file
folder is inaccessable.

You may have a "bad" file that corrupts whatever is trying to create a
thumbnail out of it - which could turn out to be an exploitable bug,
if the crashing effect can be harnessed to run code within the damaged
file. I've seen this one coming a mile off as a theoretical risk.

I'd need to know more about the thumbnailling process to predict other
possible points of failure, e.g. broken indexing or internal structure
of a location that holds thumbnail material, etc. if applicable.

Well done for tracking it down! If possible, bug this with MS and (if
compatible with your privacy needs) retain the material that causes
the crashes so they can test this further.

--------------- ----- ---- --- -- - - -

Who is General Failure and
why is he reading my disk?