explorer hangs up after entering folder with wave-files

I just created the dump file (its 245MBs) and opening it in WinDbg produces this output:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [X:\explorer.DMP]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
Windows 7 Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Wed Oct 14 19:43:59.000 2009 (GMT-4)
System Uptime: 0 days 0:02:51.656
Process Uptime: 0 days 0:02:36.000
................................................................
................................................................
................................................
Loading unloaded module list
.......................
eax=00000000 ebx=00000000 ecx=744c465a edx=00000030 esi=021aef28 edi=00000000
eip=773f64f4 esp=0023f9c4 ebp=0023f9e0 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
ntdll!KiFastSystemCallRet:
773f64f4 c3 ret

subchild said:

I just created the dump file (its 245MBs) and opening it in WinDbg produces this output:

It's a bit more complex because there's no crash. Hence, the starting point in debugger analysis is not as obvious.

If you zip up the dump file real tight and upload it to say rapidshare or somewhere similar, I'll try to take a look.

Here you go. Thanks again.
RapidShare: 1-CLICK Web hosting - Easy Filehosting

subchild said:

Here you go. Thanks again.
RapidShare: 1-CLICK Web hosting - Easy Filehosting

Short version: I think your problem is caused by a kernel-mode driver. Unfortunately, the Explorer dump doesn't "see" into that space, so it's not possible to tell which driver from this info alone. I'd suggest testing what happens when you boot into safe mode. The most likely culprit is the anti-virus, but that is just a guess at this stage. Safe mode testing would be useful.

==================================================

Longer version: The work is being done by threads 2 and 22:

User Mode Time
Thread Time
2:6b0 0 days 0:00:36.441
22:b10 0 days 0:00:36.301
32:e20 0 days 0:00:01.326
37:dc0 0 days 0:00:00.686
0:668 0 days 0:00:00.483
5:6c0 0 days 0:00:00.202
10:7e0 0 days 0:00:00.140
...

At the point the dump was triggered, T2 has gone off into kernel-mode for its "ReadFile" command to be fulfilled:

ChildEBP RetAddr
01c6ecac 773f570c ntdll!KiFastSystemCallRet
01c6ecb0 7569abad ntdll!ZwReadFile+0xc
01c6ed14 75c3dafd KERNELBASE!ReadFile+0x118
01c6ed5c 75d1e08a kernel32!ReadFileImplementation+0xf0
01c6ed9c 69d1be11 shlwapi!CFileStream::Read+0xec
01c6edf4 69d1bf56 mf!CMFWAVPropertyHandler::FeedNextBufferToPlugin+0x8f
01c6ee74 69d1c06a mf!CMFWAVPropertyHandler::FeedBuffersToPlugin+0x63
01c6eea0 69b81458 mf!CMFWAVPropertyHandler::InternalInitialize+0x86
01c6eeb8 76763eb1 mf!CMFPropHandlerBase<CMFWAVPropertyHandler,&CLSID_MFWAVPropertyHandler>::Initialize+0x5e
01c6ef10 76763cc3 shell32!InitializeFileHandlerWithStream+0x117

T22 is doing similar work but it's in user-mode:

ChildEBP RetAddr
038fee2c 69ddf1d3 mf!CRIFFChunkEnumerator::GoToChunkUsingAbsolutePosition+0x24
038fee40 69ddf338 mf!CRIFFChunkEnumerator::GoToChunkUsingRelativePosition+0x29
038fee6c 69ddf391 mf!CRIFFChunkEnumerator::ParseRIFFHeader+0x110
038fee8c 69ddf40b mf!CRIFFChunkEnumerator::CRIFFChunkEnumerator+0x52
038feeac 69ddf47a mf!CLISTChunkEnumerator::CLISTChunkEnumerator+0x1f
038feed4 69d0e3c7 mf!CRIFFChunkEnumerator::EnumerateChunksInLISTChunk+0x40
038feef0 69d0e79e mf!CWAVFileParser::ParseNextChunkForMetadata+0x3d
038fef08 69d0dfab mf!CWAVFileParser::ParseHeader+0x11f
038fef1c 69d1be69 mf!CWAVMediaSourcePlugin::ParseHeader+0x37
038fef84 69d1bf56 mf!CMFWAVPropertyHandler::FeedNextBufferToPlugin+0xe7

Given they've each consumed over 36 seconds of processor time so far - a huge amount - it's relatively safe to assume that they've got problems. The likely obstacle is down in kernel-mode: a driver.

Personally, the first thing I'd do is to test what happens with the AV temporarily uninstalled ("disabling" it is not a valid test).

Many thanks. Will give that a try.

I just installed a clean version of Windows 7 and tried to access the same directory before installing Anti Virus or any other apps. Same exact result. I'll post that dump tomorrow but I expect we'll see the same info in it.

I'm trying to update the SATA drivers now. Will also try logging into Safe Mode and seeing if that makes a difference.

Safe mode made no difference.

subchild said:

Safe mode made no difference.

Bu##er. I can't see any obvious interference from 3rd-party code in your Explorer process, and the fresh/clean install would seem to rule out an errant 3rd-party driver. If you're quite sure the new install is entirely devoid of non-default codec packs or anything of the sort, then it may indeed be a *cough* bug in Win7.

Try actually deactivating your sound card in Device Manager and then testing Explorer behaviour again. If you're using a non-default soundcard driver perhaps it's misbehaving.

Also, does it make a difference whether you've got explorer set to treat that folder as "media" or whether it's just straight "files"? I don't think I'm explaining that well but I don't know the proper terminology. Right-click the folder, properties, "Customize" tab, "Optimize this folder for:" - does it make a difference whether that's set to "music" or "general items"?

I don't have the sound card driver installed yet, but I'll try changing the folder properties. I also don't think that sata drivers matter as I'm experiencing the same behavior on the internal sata drives AND on the external sata drive which uses a SIIG pci card.

I do like everything else about Windows 7, but this issue makes it impossible for me to use it. I'm going back to XP.

One other bit of info that might be helpful.

The hard drives that the problematic folder resides on are all Seagate Barracudas. The most recent one was purchased earlier this year, but I haven't updated the firmware on any of them. Are there any known issues with W7 and Seagate drives (I think the model is ST350320AS)?

I'm going to try one last thing tonight - I've moved that folder to a Western Digital SATA drive. I'll see if the problem persists.