Vista - C:\Program Files\Windows Mail folder crashes Windows Explorer

Ironically enough, Palm just released a Vista-compatible Palm Desktop version
yesterday, so I was able to uninstall the offending program, restore the
registry, and install the new version. Most importantly, my .dat files
aren't crashing my system anymore.

Thanks a lot for your help, dean-dean. I owe you a virtual beer.



"dean-dean" wrote:

> Restoring your .dat extension to the Vista default won't hurt anything, and
> is advisable. Yes, your PalmOne made a shell extension for .dat files,
> particularly in regards to Mail, but it's not compatible with, nor does it
> work, in Vista. Vista handles these thumbnails differently.
> "{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}" is an old thumbnail preview value
> for creating thumbnails for .eml,.nws, .htm and .html. I'm not sure how
> your .dat files got involved. As a matter of fact, I think Microsoft
> discontinued using it because of a the security risk (Web View Script
> Injection Vulnerability) it caused with Webvw.dll; Vista no longer uses
> "Web View", but rather "Previews and Filters".
>
> At any rate, removing the shell extension should not harm your PalmOne. In
> PalmOne's Options/Preferences, or in its "Photo Suite", can you turn the
> shell extension off (looking for something along the line of "Show
> Preview...")? Can you uninstall the Photo Suite apart from PalmOne? Are
> your picture files (.jpg's, etc.) associated with Photo Suite?
>
> To restore your .dat file extension, open C:\Windows\System32\regedt32.exe,
> by right-clicking on it and choosing Run as Administrator. Go to
>
> HKEY_CLASSES_ROOT\.dat
>
> and, in the LEFT-hand pane, select the .dat key, and delete it. Leave
> Registry Editor open.
>
> Open Notepad.
>
> --------------------------------------------------------
>
> Windows Registry Editor Version 5.00
>
> [HKEY_CLASSES_ROOT\.dat]
> "NoOpen"="
>
> --------------------------------------------------------
>
> Copy the above and Paste it into Notepad (not including the dashes) and save
> it as dat.reg (no .txt extension).
>
> Back in Registry Editor, on the menu, choose File, and then Import.
> Navigate to wherever dat.reg is, and select it. Click Open in the dialog.
> Close Registry Editor. Log Off, and then back On. Your .dat files should be
> back to normal, and Explorer, hopefully, won't crash.
>
> Now sometimes, when you open a photo program, it may re-write the registry
> keys it thinks it needs. You might want to keep an eye on the .dat key in
> the Registry, to check for that behavior.
>
>
>
> "JasonH" <JasonH@discussions.microsoft.com> wrote in message
> news:1B926F0E-E80A-4CF4-886E-4E26194F339F@microsoft.com...
> > dean-dean, you called it. I finally found the ArcSpl.ax file on my
> > computer
> > -- it was installed along with Palm Desktop back in February as part of
> > their
> > photo suite, and it's located under C:\Program Files\palmOne.
> >
> > But when I go into regedit: HKEY_CLASSES_ROOT\.dat, there's an extra
> > subfolder "ShellEx" with another subfolder
> > "{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}". The (Default) key is present in
> > all 3, but I can't delete any of them. I get "unable to delete all
> > specified
> > values." I've also not been able to successfully dis-associate my DAT
> > files.
> >
> > I wasn't expecting to see that "ShellEx" subfolder -- do you think I can
> > safely delete it? Or just substitute the key you suggested? I don't
> > really
> > care if I lose the Arcsoft functionality, but I don't want to create
> > additional problems.
> >
> >
> >
> >
> >
> > "dean-dean" wrote:
> >
> >> Well, this is interesting. Somewhere on your computer there's a file
> >> named
> >> ArcSpl.ax, which is somehow involved in your crashes. If you could
> >> right-click on that file, and open its properties, on the Details tab,
> >> can
> >> you tell what company made it or what program it might be involved with?
> >> It's not a Vista OS file. Try looking under C:\Program Files\Common
> >> Files\arcsoft\mpeg engine.
> >>
> >> Anyway, having your .dat file extension associated with a program may be
> >> key, too. Explorer is trying to create a picture of a .dat file,
> >> possibly,
> >> and normally that file has no program association. (It might be better
> >> putting a shortcut to Notepad in Sendto, and looking at an un-associated
> >> .dat file that way, if you're so inclined). Why it's picking on
> >> OESpamFilter.dat, I dunno.
> >>
> >> If you want try un-associating the .dat file extension, in the registry
> >> Editor, go to
> >>
> >> HKEY_CLASSES_ROOT\.dat
> >>
> >> and, in the right-hand pane, right-click and delete the value
> >> "(default)",
> >> under Name, (which will have the value "dat_auto_file", under Data).
> >> Otherwise, you could make a .reg file in Notepad with this:
> >>
> >> --------------------------------------------------------
> >>
> >> Windows Registry Editor Version 5.00
> >>
> >> [HKEY_CLASSES_ROOT\.dat]
> >> "NoOpen"="
> >>
> >> --------------------------------------------------------
> >>
> >> Copy the above into Notepad (not including the dashes) and save it as
> >> dat.reg (no .txt extension). Close Notepad, then open dat.reg, and allow
> >> the Merge.
> >>
> >>
> >> "JasonH" <JasonH@discussions.microsoft.com> wrote in message
> >> news:BBC11B52-F0B3-4237-BCAD-26D2FBDD55E0@microsoft.com...
> >> > Okay, through a clever use of the Extra Large Icons setting, I've
> >> > managed
> >> > to
> >> > figure out that the cause of my problem is the OESpamFilter.dat file.
> >> > If
> >> > that file is onscreen as a thumbnail or attempts to register in a
> >> > folder
> >> > thumbnail, it crashes Windows Explorer. The problem is not general to
> >> > .dat
> >> > files -- I can have any other .dat file onscreen and nothing happens.
> >> > It's
> >> > only OESpamFilter.dat.
> >> >
> >> > Windows won't let me delete or even hide this file (access is denied).
> >> > If
> >> > I
> >> > copy that file to some other location, it still crashes WE the same way
> >> > (though at least I can delete those copies).
> >> >
> >> > What can I do about this? I've tried to change the default program for
> >> > .dat
> >> > files (it had been Notepad), but to no avail.
> >>
>
>

Well, you're like a dog with a bone. This is good. I've never seen a .dat
file with a shell extension key. Now your .dat key (folder) in the Registry
should have no sub-keys, and only have two values in the left pane, under
the Name column: Default, with "(Value not set)" under the Data column, and
NoOpen, with nothing written, as in blank, under the Data column. Thanks
for the beer!

"JasonH" <JasonH@discussions.microsoft.com> wrote in message
news:1954FD4E-08C7-4D8A-B00E-52A7A6580E82@microsoft.com...
> Ironically enough, Palm just released a Vista-compatible Palm Desktop
> version
> yesterday, so I was able to uninstall the offending program, restore the
> registry, and install the new version. Most importantly, my .dat files
> aren't crashing my system anymore.
>
> Thanks a lot for your help, dean-dean. I owe you a virtual beer.
>
>
>
> "dean-dean" wrote:
>
>> Restoring your .dat extension to the Vista default won't hurt anything,
>> and
>> is advisable. Yes, your PalmOne made a shell extension for .dat files,
>> particularly in regards to Mail, but it's not compatible with, nor does
>> it
>> work, in Vista. Vista handles these thumbnails differently.
>> "{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}" is an old thumbnail preview
>> value
>> for creating thumbnails for .eml,.nws, .htm and .html. I'm not sure how
>> your .dat files got involved. As a matter of fact, I think Microsoft
>> discontinued using it because of a the security risk (Web View Script
>> Injection Vulnerability) it caused with Webvw.dll; Vista no longer uses
>> "Web View", but rather "Previews and Filters".
>>
>> At any rate, removing the shell extension should not harm your PalmOne.
>> In
>> PalmOne's Options/Preferences, or in its "Photo Suite", can you turn the
>> shell extension off (looking for something along the line of "Show
>> Preview...")? Can you uninstall the Photo Suite apart from PalmOne? Are
>> your picture files (.jpg's, etc.) associated with Photo Suite?
>>
>> To restore your .dat file extension, open
>> C:\Windows\System32\regedt32.exe,
>> by right-clicking on it and choosing Run as Administrator. Go to
>>
>> HKEY_CLASSES_ROOT\.dat
>>
>> and, in the LEFT-hand pane, select the .dat key, and delete it. Leave
>> Registry Editor open.
>>
>> Open Notepad.
>>
>> --------------------------------------------------------
>>
>> Windows Registry Editor Version 5.00
>>
>> [HKEY_CLASSES_ROOT\.dat]
>> "NoOpen"="
>>
>> --------------------------------------------------------
>>
>> Copy the above and Paste it into Notepad (not including the dashes) and
>> save
>> it as dat.reg (no .txt extension).
>>
>> Back in Registry Editor, on the menu, choose File, and then Import.
>> Navigate to wherever dat.reg is, and select it. Click Open in the
>> dialog.
>> Close Registry Editor. Log Off, and then back On. Your .dat files should
>> be
>> back to normal, and Explorer, hopefully, won't crash.
>>
>> Now sometimes, when you open a photo program, it may re-write the
>> registry
>> keys it thinks it needs. You might want to keep an eye on the .dat key
>> in
>> the Registry, to check for that behavior.
>>
>>
>>
>> "JasonH" <JasonH@discussions.microsoft.com> wrote in message
>> news:1B926F0E-E80A-4CF4-886E-4E26194F339F@microsoft.com...
>> > dean-dean, you called it. I finally found the ArcSpl.ax file on my
>> > computer
>> > -- it was installed along with Palm Desktop back in February as part of
>> > their
>> > photo suite, and it's located under C:\Program Files\palmOne.
>> >
>> > But when I go into regedit: HKEY_CLASSES_ROOT\.dat, there's an extra
>> > subfolder "ShellEx" with another subfolder
>> > "{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}". The (Default) key is present
>> > in
>> > all 3, but I can't delete any of them. I get "unable to delete all
>> > specified
>> > values." I've also not been able to successfully dis-associate my DAT
>> > files.
>> >
>> > I wasn't expecting to see that "ShellEx" subfolder -- do you think I
>> > can
>> > safely delete it? Or just substitute the key you suggested? I don't
>> > really
>> > care if I lose the Arcsoft functionality, but I don't want to create
>> > additional problems.
>> >
>> >
>> >
>> >
>> >
>> > "dean-dean" wrote:
>> >
>> >> Well, this is interesting. Somewhere on your computer there's a file
>> >> named
>> >> ArcSpl.ax, which is somehow involved in your crashes. If you could
>> >> right-click on that file, and open its properties, on the Details tab,
>> >> can
>> >> you tell what company made it or what program it might be involved
>> >> with?
>> >> It's not a Vista OS file. Try looking under C:\Program Files\Common
>> >> Files\arcsoft\mpeg engine.
>> >>
>> >> Anyway, having your .dat file extension associated with a program may
>> >> be
>> >> key, too. Explorer is trying to create a picture of a .dat file,
>> >> possibly,
>> >> and normally that file has no program association. (It might be
>> >> better
>> >> putting a shortcut to Notepad in Sendto, and looking at an
>> >> un-associated
>> >> .dat file that way, if you're so inclined). Why it's picking on
>> >> OESpamFilter.dat, I dunno.
>> >>
>> >> If you want try un-associating the .dat file extension, in the
>> >> registry
>> >> Editor, go to
>> >>
>> >> HKEY_CLASSES_ROOT\.dat
>> >>
>> >> and, in the right-hand pane, right-click and delete the value
>> >> "(default)",
>> >> under Name, (which will have the value "dat_auto_file", under Data).
>> >> Otherwise, you could make a .reg file in Notepad with this:
>> >>
>> >> --------------------------------------------------------
>> >>
>> >> Windows Registry Editor Version 5.00
>> >>
>> >> [HKEY_CLASSES_ROOT\.dat]
>> >> "NoOpen"="
>> >>
>> >> --------------------------------------------------------
>> >>
>> >> Copy the above into Notepad (not including the dashes) and save it as
>> >> dat.reg (no .txt extension). Close Notepad, then open dat.reg, and
>> >> allow
>> >> the Merge.
>> >>
>> >>
>> >> "JasonH" <JasonH@discussions.microsoft.com> wrote in message
>> >> news:BBC11B52-F0B3-4237-BCAD-26D2FBDD55E0@microsoft.com...
>> >> > Okay, through a clever use of the Extra Large Icons setting, I've
>> >> > managed
>> >> > to
>> >> > figure out that the cause of my problem is the OESpamFilter.dat
>> >> > file.
>> >> > If
>> >> > that file is onscreen as a thumbnail or attempts to register in a
>> >> > folder
>> >> > thumbnail, it crashes Windows Explorer. The problem is not general
>> >> > to
>> >> > .dat
>> >> > files -- I can have any other .dat file onscreen and nothing
>> >> > happens.
>> >> > It's
>> >> > only OESpamFilter.dat.
>> >> >
>> >> > Windows won't let me delete or even hide this file (access is
>> >> > denied).
>> >> > If
>> >> > I
>> >> > copy that file to some other location, it still crashes WE the same
>> >> > way
>> >> > (though at least I can delete those copies).
>> >> >
>> >> > What can I do about this? I've tried to change the default program
>> >> > for
>> >> > .dat
>> >> > files (it had been Notepad), but to no avail.
>> >>
>>
>>

On Tue, 24 Jul 2007 10:34:01 -0700, JasonH

>I'm running Vista Home Premium x86. Everything is up to date, antivirus and
>antispyware are clean. About a week ago, I started noticing that whenever I
>went into Computer, opened C:\Program Files and scrolled to the bottom of the
>list (in Tiles view), I would get an instant "Windows Explorer Has Stopped
>Working" message and crash out to my desktop. Through trial and error, I
>determined that the dynamic icon for C:\Program Files\Windows Mail was
>somehow causing this, and sure enough, when I went to a static icon view like
>Details, I could scroll all the way down with no problems.

Interesting, and nasty.

IMO, allowing content to define its own icons is a fundamental safety
risk, if the icon extraction code is an exploitable surface.

>I've edited the WM folder icon so that it no longer crashes Windows
>Explorer on sight, but now whenever I try to open
>C:\Program Files\Windows Mail (just the folder, not the program) it
>still crashes Windows Explorer -- even after restarts.

Explorer navigates the namespace, not the file system, and "special"
folders often patch in their own code handlers that are invoked when
you navigate into the namespace.

That, too, is a "safety gap", i.e. the low risk you think you are
taking (navigating into a passive container to safely view a list of
items in it) is the high risk of running code that defines the folder.

>The modified date for the Windows Mail folder is 7/11/07 -- which was the day
>I installed the latest batch of patches from Windows Update, so I think the
>last Windows Mail patch is somehow to blame. At any rate, this never
>happened before 7/11/07.

O...K...

>It seems like it must be a corrupted icon or thumbnail path, but the crash
>happens so quickly that I can't do anything about it. I suppose I could
>tinker with it in safe mode, but I don't know if I could identify the
>offending file.

Do so, if only to see whether Safe Mode would be safe, if this
accidental crash was found to be an exploitable condition, and used as
such by mass malware (as could happen at any time).

>The Windows Mail program seems to open normally (though I
>use Outlook, so I can't tell if it's working).

I avoid apps that hold your data hostage to app version, then bind
that version to a larger "container" product, so that knocks out any
of MS's email apps. I also dislike an email storage model that hides
incoming malware from av scanners and manual management, as most email
apps do. Eudora is free of bother of these issues.

>It does make me wish I could just uninstall the problematic program.

Yup. Being able to "turn off" bundleware does not level the
competitive playing field, because you are forced to swallow the bloat
of the avoided MSware, as well as being compelled to patch it. So
competing apps that are better in terms of efficiency or patch
requirements, can't relieve you of the burden of the MSware.



>------------------------- ---- --- -- - - - -
Let's make a humming sound
>------------------------- ---- --- -- - - - -

On Tue, 24 Jul 2007 21:06:04 -0700, JasonH

>When I checked "always show icons, never thumbnails" I was able to explore
>the Windows Mail folder without crashing. I deleted the thumbnail cache
>using disc cleanup, as you said, but when I went back and unchecked "always
>show icons," I was back to square one. Now Windows Explorer crashes again
>when I scroll down to the bottom of Program Files, and the Windows Mail file
>folder is inaccessable.

You may have a "bad" file that corrupts whatever is trying to create a
thumbnail out of it - which could turn out to be an exploitable bug,
if the crashing effect can be harnessed to run code within the damaged
file. I've seen this one coming a mile off as a theoretical risk.

I'd need to know more about the thumbnailling process to predict other
possible points of failure, e.g. broken indexing or internal structure
of a location that holds thumbnail material, etc. if applicable.

Well done for tracking it down! If possible, bug this with MS and (if
compatible with your privacy needs) retain the material that causes
the crashes so they can test this further.



>--------------- ----- ---- --- -- - - -
Who is General Failure and
why is he reading my disk?
>--------------- ----- ---- --- -- - - -