WLM 2012 Started Crashing when Sending Emails

Side note: Using filters to cut down on junk mail

Service providers can only do so much about junk mail - I set up rules to delete the msg from the server once I know the sender is mailing junk. You can also setup international filters if you now the junk originates from a foreign domain (.it - Italy ...) - this implies that you don't normally receive msgs from that int'l domain.

You have to be careful though as many junk mailers spoof a valid domain (yahoo. com is a favorite).

I delete msgs FROM domains XYZ.com and mail.DEF.com. I included the at-sign which limits the scope of the rule to exactly that domain - if junk comes from a sub domain it will not be flagged by the rule (subdomain.XYZ.com).

I also delete msgs TO a specific user user@mail.server.com

Build up the rule slowly, adding full user and domain addresses at first. If more junk comes though and only the user name has changed, add the junk domain to the filter (or modify the user/domain already in the list). I was too aggressive when I first built these rules and some good mail got deleted. You could build a test rule to move the msgs to a Storage folder. Once you're sure the rule works correctly (it doesn't delete good msgs), you can change it to Delete from Server.

I agree, the Service providers don't seem to do too much with anything we send them. They're probably aware of the leaks, but many use third party packages to process junk. It takes a while for the third party vendor to update their package and even longer for the service provider to implement the change. That plus the fact that junk mailers can quickly change their methods makes it a tough nut to crack.

The only junk mail I see now are things that the server flagged as junk, but are valid msgs (mostly list mail).

Bill
.

Slartybart said:

Side note: Using filters to cut down on junk mail

Service providers can only do so much about junk mail - I set up rules to delete the msg from the server once I know the sender is mailing junk. You can also setup international filters if you now the junk originates from a foreign domain (.it - Italy ...) - this implies that you don't normally receive msgs from that int'l domain.

You have to be careful though as many junk mailers spoof a valid domain (yahoo. com is a favorite).

I delete msgs FROM domains XYZ.com and mail.DEF.com. I included the at-sign which limits the scope of the rule to exactly that domain - if junk comes from a sub domain it will not be flagged by the rule (subdomain.XYZ.com).

I also delete msgs TO a specific user user@mail.server.com

Build up the rule slowly, adding full user and domain addresses at first. If more junk comes though and only the user name has changed, add the junk domain to the filter (or modify the user/domain already in the list). I was too aggressive when I first built these rules and some good mail got deleted. You could build a test rule to move the msgs to a Storage folder. Once you're sure the rule works correctly (it doesn't delete good msgs), you can change it to Delete from Server.

I agree, the Service providers don't seem to do too much with anything we send them. They're probably aware of the leaks, but many use third party packages to process junk. It takes a while for the third party vendor to update their package and even longer for the service provider to implement the change. That plus the fact that junk mailers can quickly change their methods makes it a tough nut to crack.

The only junk mail I see now are things that the server flagged as junk, but are valid msgs (mostly list mail).

Bill
.

Your screen shot reminded me - I have a side question about how filters (rules) work in WLM. This is something I have never really understood. The window in your screen shot contains the phrase: "Apply this rule after the message arrives." The way I read that, the word after implies that the message will be downloaded to the PC, checked to see if it meets the filter criteria and if it does, then delete it from the server. This would leave the message on the PC. What good is that?

If I am misunderstanding it's meaning, then can you explain how it really works.

Same scenario as before - trying to forward a spam email to Verizon. As soon as I click the Send button, WLM crashes. Norton email scanning is still turned off. This was 1 of 6 messages that WLM had placed in the Junk folder.

Code:

Log Name:      Application
Source:        Application Error
Date:          10/19/2014 6:38:43 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Faulting application name: wlmail.exe, version: 16.4.3528.331, time stamp: 0x533a3fce
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-19T10:38:43.000000000Z" />
    <EventRecordID>15304</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>wlmail.exe</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a3fce</Data>
    <Data>unknown</Data>
    <Data>0.0.0.0</Data>
    <Data>00000000</Data>
    <Data>c0000005</Data>
    <Data>00000000</Data>
  </EventData>
</Event>

Code:

Log Name:      Application
Source:        Windows Error Reporting
Date:          10/19/2014 6:38:56 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: wlmail.exe
P2: 16.4.3528.331
P3: 533a3fce
P4: unknown
P5: 0.0.0.0
P6: 00000000
P7: c0000005
P8: 00000000
P9: 
P10: 
Attached files:
These files may be available here:
C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_wlmail.exe_27e68f2ea86fbae277e55967a56533826153b7e0_081f756d
Analysis symbol: 
Rechecking for solution: 0
Report Id: 18758534-577c-11e4-8278-4439c437d02a
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-19T10:38:56.000000000Z" />
    <EventRecordID>15305</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>wlmail.exe</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a3fce</Data>
    <Data>unknown</Data>
    <Data>0.0.0.0</Data>
    <Data>00000000</Data>
    <Data>c0000005</Data>
    <Data>00000000</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>C:\Users\Gary &amp; Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_wlmail.exe_27e68f2ea86fbae277e55967a56533826153b7e0_081f756d</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>18758534-577c-11e4-8278-4439c437d02a</Data>
    <Data>0</Data>
  </EventData>
</Event>

I don't think the problem is message-content specific and this is why. When WLM crashes, I have to click on the Close option in the popup message box. WLM then closes and restarts. When it restarted I immediately went back into the Junk folder and dragged a copy of the message to the Desktop (Sample.eml). I then opened the same message again, clicked Forward and entered the same Verizon email address in the To: line and clicked Send. It sent normally with no crash. If the problem were message-content specific, I would expect WLM to crash every time.
I then went through the remaining 5 Junk messages and forwarded them with no problem.

Here is the message that caused the crash:
(attachment removed)

nikki605 said:

Your screen shot reminded me - I have a side question about how filters (rules) work in WLM. This is something I have never really understood. The window in your screen shot contains the phrase: "Apply this rule after the message arrives." The way I read that, the word after implies that the message will be downloaded to the PC, checked to see if it meets the filter criteria and if it does, then delete it from the server. This would leave the message on the PC. What good is that?

If I am misunderstanding it's meaning, then can you explain how it really works.

Messages have headers and body - if the header meets the rule, the body is never downloaded.

Ok, thanks - I'll look at the zip file next.

I missed this before

Faulting application name: wlmail.exe, version: 16.4.3528.331, time stamp: 0x533a3fce
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000

The last object in the fault chain is wlmail.exe - the unknown object causes WLM to crash.

I know that doesn't help other than to change what I'm focusing on (was spell check or another component of WLM).

It is interesting that the 2nd fwd of the same msg had no issue.

When you get a chance, Check C:\ using Option One:
Disk Check

The image in step 4 shows the options you should use
Step 7 describes the options selected in step 4
Step 9 is the ok button
Step 11 describes the disk in use (C:\)
Click schedule disk check and restart your machine

That's steps 1 through 4, step 9 & step 11

The results are in the event viewer. See option one in Check Disk (chkdsk) - Read Event Viewer Log

This will eliminate file system disk errors as a possible cause. If there were bad spots on the disks, you would probably be aware of that. I didn't want you to check for bad spots on the first run of check disk - the option in step 4 is the least intensive repair option.

Bill
.

I sent you a private msg.

Looking at both msgs you've posted, they have two things in common
- long lines (greater than 76)
- 7bit encoding

This isn't normally an issue with eMail ... unless the text characters are non ASCII (the 7 bit part)
Real mail clients shouldn't create a msg like that, but a programmed mass mailer spam program might.

Neither msg contained non-ASCII characters, but you said the most recent msg was fwd'd without issue - maybe WLM stripped out any bad chars. All I know is that the files you provided don't have anything in them that I can determine to be the cause. That doesn't mean that they didn't originally have something in them.

---

I'm still considering Norton as part of the issue. If you can locate the license key, then you could uninstall Norton as a test. I'm sure you paid for Norton, so make sure you have the license key BEFORE uninstalling. I know you turned off mail filtering, but sometimes a remnant exists that gums up the works. You will need some protection while you wait for another occurance (or no occurance-that would be nice and proof positive), so you can download MSE as interim protection (Avast and AVG are also free). I suggest MSE simply because it doesn't carry any extras that might get installed or configured.

---

The other thing you can do is whittle down the WLM options. Check the images below to see how your WLM is configured. There are many more options to set, but I didn't want to strip down the client for just a few msgs. Those settings might eliminate the issue, but then all you would see is plain text.

The settings above prevent receipts being sent - a very rare occurrence anyway, but hard to notice that it's happening. Spammers might request a receipt - I don't know if this is the case or not.

---

The settings above are an example of something you could change (don't include original msg, and don't reply in the original format) that would limit the function of the mail client. Something I said might be done, but am not recommending now.

The Plain Text setting IS a change you should make. Since the issue presents itself outbound, encoding it as quoted printable might stop the failing process from choking on the msg.

This only affects text msgs, not anything with HTML. Both bad msgs were text/7bit.

---

Do either Norton or the option changes and wait for the issue to reoccur. If you do both you won't know which one solved it (hopefully).

You might call Vze and complain about the spam. It's possible they could tighten the screws a bit - but they'll need your permission. Again, try to stage the changes so you have an idea of why it was fixed (perpetual optimist here)

I'm here for the duration.

Bill
.