Solved WLM 2012 Started Crashing when Sending Emails

[Slartybart]

Ok, you read my intent ... stop if not the only thing missing.

I agree that the Adblock error is an artifact of the missing associations. I still would like to remove it from the equation. I'm not sure how Adblock and the hosts files are related, but looking at your hosts file - the octect addresses (0.0.0.0) are not standard. Normally, the loopback address (127.0.0.0) is used. I don't know where the address 0.0.0.0 goes or how it might affect normal operations. So the two (adblock & hosts) are suspect in normal operations parlance.

The .VCF file association can be easily added by finding a .VCF file, right clicking, and selecting open with. If the always open box is present on the dialog box, click it, then select WLM as the application (you might have to look for it if WLM isn't in the offered list of applications). If no .VCF files are found - try exporting a contact to a .VCF file, then use that to associate WLM with that file type.

I'll have to get back on Win7 if you need more details on how to do that.

This statement is a bit disconcerting:
There are no WLM Protocol associations on the desktop at all, and only one on the laptop - MAILTO.

Switching gears to your laptop (which doesn't have the problem).
Are the protocols listed at all, perhaps associated with IE or another application?
Have you ever clicked on the Feeds or Newsgroups icons in WLM? The protocol might not get set until an application first uses it.

Bill
.

 

[nikki605]

The .VCF file association can be easily added by finding a .VCF file, right clicking, and selecting open with. If the always open box is present on the dialog box, click it, then select WLM as the application (you might have to look for it if WLM isn't in the offered list of applications). If no .VCF files are found - try exporting a contact to a .VCF file, then use that to associate WLM with that file type.

I have to break down the requests in your last post. Like you, I thought adding the .vcf file association would be easy, so I started with that.

There were no .vcf files on the PC so I exported a contact to the Desktop. I went through the steps to assign WLM as the default program, but the .vcf file entry was never added to the list. Yet, the .vcf file does open with WLM. It's just that the entry is not there. Here are screen shots:


Setting WLM as the default:

Double clicking the .vcf file, opens the contact with WLM, but the .vcf file type has not been added to the list:

If I right-click on the .vcf file and select Open With-->Windows Contacts it looks like this:

Any idea why the .vcf file type is not being added to the association list? I even rebooted the desktop, but the .vcf file type still did not show up in the association list.

 

[nikki605]

I agree that the Adblock error is an artifact of the missing associations. I still would like to remove it from the equation. I'm not sure how Adblock and the hosts files are related, but looking at your hosts file - the octect addresses (0.0.0.0) are not standard. Normally, the loopback address (127.0.0.0) is used. I don't know where the address 0.0.0.0 goes or how it might affect normal operations. So the two (adblock & hosts) are suspect in normal operations parlance.

I've uninstalled Adblock Plus.

+EDIT

I've run the MS Fixit to restore the original HOSTS file.

-EDIT

Switching gears to your laptop (which doesn't have the problem).
Are the protocols listed at all, perhaps associated with IE or another application?
Have you ever clicked on the Feeds or Newsgroups icons in WLM? The protocol might not get set until an application first uses it.

On the laptop, the protocols are not listed at all. I will get screen shots tomorrow. No, I have never clicked on the Feeds or Newsgroups icons in WLM on the laptop or desktop. I don't even see those icons in the WLM window. Where are they?

Meanwhile, back to my original WLM crashing problem, I have had no crashes all week. But, in fairness, my wife hasn't sent/forwarded/replied to very many messages.

 

[Slartybart]

Thanks,

Just to bring you up-to-date on forum rules.

13) No ad blocking discussions. This site depends on ads to pay for the costs of running and maintaining it.​

I don't want your posts to be misconstrued - we're trying to trouble shoot an issue and how what you have on your system might affect the issue.

We need to follow the rules in this house. Just wanted to make you aware that really detailed discussions on the subject will not be tolerated on any of the DM forums. Now that the two suspects are out of the equation, it's somewhat of a moot point.
You might want to edit out the website, even though it is masked, and descriptive quote.

---

Please run the MS Fixit to restore the default hosts file. If you look at the "Let me fix it myself" section, you'll see that there are no entries in the hosts file at all. This passes control to the router. Older hosts files contained explicit entries for the loopback (both IPv4 and later IPv6). Those entries are still in the file, but they are commented out. This default change won't have any bearing on the original issue - it's juts me being anal and keeping all things as MS thinks best. After trouble shooting is done - all bets are off and people can do as they please.

---

WLM icons for mail, feeds, contacts, news are in the lower left hand corner of the WLM window.

​

---

The .VCF file type association: should have worked ...
As an exercise, click on all of the icons in WLM in the above image. I know some things have to be done in WLM or they don't stick (moving msgs in Explorer really screws around with WLM - you have to move msgs inside WLM to keep everything straight (DB tracking no doubt))

If the associations are created by clicking the icons, then a lot of the discussion was a red herring. WLM never fully implemented because some icon wasn't clicked - sheesh!

If there not created, I'll go back to building a reg file for you to use to import the settings.

I don't see any reason that you couldn't start with Brink's reg file for MAILTO. He's really good - I'd have to look at the file again to see if more than just MAILTO is included for WLM. When I first looked at it, I did see that all WLM MAILTO references were contained - I just didn't look to see if Brink went beyond MAILTO.

---

Yeah, that's the fun part about this issue ... it picks the time when it wants to rear it's ugly head.

I'm putting the msg content on the back burner until you get the file associations and hosts changes implemented.

Eventually, you'll run wlarp (the program that Control Panel repair WLM actually calls) again - but I don't see any sense in that until the file associations are resolved.

Bill
.

 

[Slartybart]

I setup a new installation of WLM to test a few things.

1. WLM associations:I was wrong, the file and protocols are not setup until a program is installed. I previously said MAILTO was integral in Windows - my apologies ... it's been a while since I looked at a raw installation.
   
   
2. Default Programs
   • Set Default Programs
     • 
       For both of the programs below, click on the text link
       Choose defaults for this program
       Tick the Select All checkbox just above the Name | Description | Current Default box
       then save the changes, even if they were already selected.
       
       
     • Windows Live Mail
       ​
       
       
     • Windows Live Mail (News)
       If you don't see this entry, don't sweat it - the issue is with Mail, not news
       
       
       ​
       
       
     • Then for both WLM programs click on the text link
       Set this program as default
       Note: When I did this on the new system/new WLM install, it took a while. This means that somewhere in the install or initial launch WLM didn't prompt for Make this the default pgm. I might have 'rushed' the process and WLM might have prompted me later on, but I recall it used to be one of the first things it asked about at installation time.
     
     
   • Set program access and computer defaults
     Make the change even if it appears that WLM is already the default.
     ​
3. Export registry: I'm holding off on this because I'd prefer to straighten out the associations using Windows tools if possible. I'm not opposed to creating the reg file, it is how ever a lot of work because there are many pieces to Windows Essentials, not just mail. Brink's reg file saves me a lot of work if you cannot force WLM associations using the instructions above.

Bill
.

 

[nikki605]

On the desktop system this morning, I ran the Fixit and restored the default MS HOSTS file and rebooted as requested. My wife has been on it ever since so I have not been able to do any other follow-up.

From my laptop - I read your latest post (no apology necessary) and followed your instructions on the laptop just to see what would happen. Here is a synopsis of the results:

File associations before changes to defaults:

File associations after changes to defaults (no changes):

Protocol associations before changes to defaults:

Protocol associations after changes to defaults (3 associations added):

NOTE: Just to let you know, this laptop is a 4 year old ThinkPad T410 running Win7 Pro x64. I posted earlier that I put the new desktop PC into service in July. I wanted to make sure the desktop was stable, so I let it run for a couple weeks. The desktop is our "primary" PC and this laptop is a "secondary" PC. It is configured to run in an emergency should the desktop have a catastrophic failure.

Once I felt comfortable with the desktop, I reloaded the laptop to factory from the recovery partition. I wanted to get rid of a lot of the junk cluttering it up. My point to all this is that the OS install is only about 3 months old on this laptop.

Let me know if my results on the laptop above are what you expected. If they are, I'll let you know when I can get back on the desktop and check for the same results.

Have a great weekend,
Gary

 

[Slartybart]

Thanks Gary, I really appreciate the quality feedback you're providing.

The laptop now has what I expect with regards to WLM file and protocol associations. The additional protocols aren't actually necessary unless you're subscribed to RSS feeds or News groups. For the sake of completeness, it's good to have them defined so other members helping (or other forums) don't get sidetracked by the 'missing' protocols.

Let me know how it works out on the desktop - then we can get back to the original issue. With the number of changes you're already made and the fact that it is an intermittent issue ... we'll have to wait for another occurrence ... if none of the changes 'resolved' the issue.

If the issue is gone, then the unfortunate thing is we might never know what 'fixed' it, but there are clues. If the issue 'disappears' and you add some of the things back on the machine and the issue returns ... then you know.

You're down to the wire now ... only a complete removal of Norton or a re-install of WLM remains on my list. Both are long shots - Norton, even though eMail filtering has been turned off, might leave a remnant setting. WLM re-install ... not certain if the issue lies in WLM.

We'll continue taking this step by step.

thanks again and have a great weekend (what remains of it),

Bill

 

[nikki605]

Bill,

Now for the desktop system. It appears your steps also fixed the association problems on this PC as well.
What leaves me scratching my head is why weren't these associations made when WLM was installed?

Here are the desktop results:


File associations before changes to defaults:

File associations after changes to defaults (1 association added):

Protocol associations before changes to defaults:

Protocol associations after changes to defaults (4 associations added):

I went back to the webpage in my video, clicked on the same MAILTO link and volia - a WLM New Message window opened up with the email address populated on the To: line, just like it is supposed to work.

Looks like we have solved the association problem and can get back to the original issue of WLM crashing.

I'm trying to remember the changes we made to see if the WLM crashes stopped. I've got to start keeping better notes.


Changes that I remember:

Norton Internet Security - Email scanning turned off (but I'm pretty sure I had a WLM crash after I turned that off.
WLM Options-->Send-->Mail Sending Format-->Plain Text Settings set to Quoted Printable
​

Other changes made to investigate file & protocol association problem:

Uninstalled Ad Block
Restored default MS HOSTS file
​

As far as the feedback I'm providing - I wouldn't post anything less. If you're taking the time to think about my problem, post detailed questions, troubleshooting steps and screen shots, then I owe you the same in return or I'm wasting your time and my problem has little chance of being resolved.

Thanks for sticking with me through this, by the way!
Gary

 

[Slartybart]

All of our notes are in the thread, I've been meaning to do a full recap, but the MAILTO issue distracted me (that's ok, I was procrastinating anyway).

I'm glad the default pgms options worked - saved a lot of registry editing and filtering for me.

Good thinking to test a Mailto link - thanks.

I think the changes you listed are the significant ones - others might have been made chasing herrings

Check your eMail configuration - looking at the ports, servers, and SSL states.
Avast eMail filtering used to tell users to let it do Secure Socket Layering and have them turn it off in the eMail application. I'm not sure how Norton filters eMail, but please take a look.

Be careful if you post any information from the WLM configuration, there are a few places that expose an eMail address (title bar and the expected fields). If the ports or servers are different, juts let me know what they are - I won't need the entire configuration.

This is only housekeeping - I don't think there's anything in the WLM configuration (POP3/SMTP) that would cause the issue. I'm looking for things that might be left hanging after the Norton eMail filtering change, a fishing expedition if you will.

You'll need the following email settings:

Incoming mail server
(POP3): pop.verizon.net
Port: 995
SSL

Outgoing mail server
SMTP: smtp.verizon.net
Port: 465
SSL

The only other area you might want to check is

Outgoing Mail Server

My Server requires authentication.

Vze didn't mention it, but most servers want that box ticked.​

You're in the wait and see stage again.

Bill
.

 

[nikki605]

I checked the 4 Verizon & 3 Gmail accounts I have set up in WLM. Here are the options for 1, but the other 6 are all set the same. Obviously, the Gmail accounts are set up with pop.gmail.com and smtp.gmail.com but the ports, SSL and other options are the same.

I don't think the WLM crashes are related to the spam messages I am receiving. The first couple of crashes were replies or original emails my wife was sending either to an attorney or a title company. Unfortunately, I didn't suspect a real problem until after those first 2 crashes. Since then, the only crashes happened to be when I was forwarding spam to Verizon. Two of the Verizon accounts receive 99.9% of the spam.

I really wish the Verizon spam filter worked better. Today, there were so many, I just deleted them. Sure wish I could find a way to stop them from ever reaching the PC in the first place. They use phony, spoofed domain names and ever changing subject & from fields.

 

[nikki605]

I'm not sure how Norton filters eMail, but please take a look.

I'm not sure what you are asking. Can you elaborate a little more.

Norton does scan the ports. However, I just looked at the settings for that option and they are the old ports:

It's not an option I ever looked at so I would have to add the ports 465 and 995.

Here is more info: https://support.norton.com/sp/en/us/norton-internet-security/21.6.0.32/solutions/v54476828_NIS_OEM_2014_en_us?abproduct=Norton+Internet+Security&abversion=21.6.0.32&actstat=activated&buildname=Retail&cipherid=0&conntype=100000000&coreservice=Startup+Type%3Aauto+State%3ARunning&cpu=Intel64+Family+6+Model+60+Stepping+3&curdefs=20141027.001&datetime=10-28-2014+0%3A16%3A27+AM+GMT&defbrowser=Internet+Explorer&dsfree=618.21&dstotal=697.64&endpointid=%7B886C664D-CF21-4103-A93A-95340BD4A4D0%7D&entsrc=help&env=prod&hbguid=886C664D-CF21-4103-A93A-95340BD4A4D0&hcmode=false&heartbeatID=886C664D-CF21-4103-A93A-95340BD4A4D0&helpid=Protected_Ports_Settings_CIT&ieversion=9.11.9600.17358&layout=Retail&layouttype=ESD&lic_attr=21124114&lic_type=16&memload=32&memtotal=6791&os=windows&oslang=iso%3AENG&oslocale=iso%3AUSA&osvers=6.1&osversion=6.1+7601.18409.amd64fre.win7sp1_gdr.140303-2144&partner=LENOVO+THK-PR+30&partnerid=33390&partnername=Retail&plang=sym%3AEN&plgid=2&plid=2&psn=C9YXMTMX4GB6&remdays=296&skuf=21228659&skum=21292844&skup=21258607&spversion=1.0&sublength=315&subremaining=296&substatus=current&symskucurrent=21258607&symskumedia=21292844&utm_medium=product&utm_source=symc&vendorid=33390

The next 2 options are the ones that were turned off when you asked me to stop scanning emails - Email Antivirus Scan and AntiSpam.

Before turning them off, I had never looked at their configuration so they were using whatever the defaults are.

Here is more info - Email Antivirus Scan: https://support.norton.com/sp/en/us...medium=product&utm_source=symc&vendorid=33390

Here is more info - AntiSpam: https://support.norton.com/sp/en/us...medium=product&utm_source=symc&vendorid=33390

 

[nikki605]

I had another WLM crash this morning, followed 2 hours later by an IE11 crash. Being that far apart I
don't know if they are related or not. I'll put the WLM info in this post and the IE info in a 2nd post.

I remembered that you had me check a couple WLM Maintenance options so you'll have to tell me what
additional information that provides and what else I may need to send you.

It appears this crash involved the spell checker. There are 3 Event Viewer entries this time, whereas
before there were only 2. Those entries point to several log type files. I have attached a zip file which
contains the email message that caused the crash when I clicked on the Send button trying to forward it to
Verizon. It appears the forwarded message did get sent dispite the crash, as it appeared in the Sent
Folder after WLM restarted from the crash.

After the crash, WLM restarted and I immediately tried to forward the same message again. This time it was sent with no WLM crash.

The attached zip file also contains the various log files mentioned in the Event Viewer entries below.

Log Name:      Application
Source:        Application Error
Date:          10/28/2014 7:34:50 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Faulting application name: wlmail.exe, version: 16.4.3528.331, time stamp: 0x533a3fce
Faulting module name: MSMAIL.DLL, version: 16.4.3528.331, time stamp: 0x533a408a
Exception code: 0xc0000005
Fault offset: 0x0002f015
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-28T11:34:50.000000000Z" />
    <EventRecordID>16284</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>wlmail.exe</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a3fce</Data>
    <Data>MSMAIL.DLL</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a408a</Data>
    <Data>c0000005</Data>
    <Data>0002f015</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        Windows Error Reporting
Date:          10/28/2014 7:35:04 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: wlmail.exe
P2: 16.4.3528.331
P3: 533a3fce
P4: MSMAIL.DLL
P5: 16.4.3528.331
P6: 533a408a
P7: c0000005
P8: 0002f015
P9: 
P10: 
Attached files:
These files may be available here:
C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive
\AppCrash_wlmail.exe_49695c9619d2fff0adc2339577cef8bcbc58cd3c_0d49166d
Analysis symbol: 
Rechecking for solution: 0
Report Id: 6d3328a5-5e96-11e4-bda4-4439c437d02a
Report Status: 0
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-28T11:35:04.000000000Z" />
    <EventRecordID>16285</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>wlmail.exe</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a3fce</Data>
    <Data>MSMAIL.DLL</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a408a</Data>
    <Data>c0000005</Data>
    <Data>0002f015</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive
\AppCrash_wlmail.exe_49695c9619d2fff0adc2339577cef8bcbc58cd3c_0d49166d</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>6d3328a5-5e96-11e4-bda4-4439c437d02a</Data>
    <Data>0</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        Windows Error Reporting
Date:          10/28/2014 7:35:35 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Fault bucket 306956482, type 21
Event Name: WindowsLiveWriter
Response: Not available
Cab Id: 0
Problem signature:
P1: CloseSubjectSpellcheckWordRange
P2: 182
P3: System.NullReferenceException
P4: 16.4.3528.331
P5: 2.0.50727.5485
P6: Windows Live Mail
P7: 
P8: 
P9: 
P10: 
Attached files:
C:\Users\Gary & Linda\AppData\Local\Temp\wlmail-433777574\B2611F65969D\dwlog.txt
C:\Users\Gary & Linda\AppData\Local\Temp\wlmail-433777574\495BE0E203E6\dwstacktrace.txt
C:\Users\Gary & Linda\AppData\Local\Temp\wlmail-433777574\B5EDAC473EDB\dwminidump.mdmp
These files may be available here:
C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive
\Critical_CloseSubjectSpel_b0ead5886f1fd23cfa76e55369f069e4e6f14a9_17898ef6
Analysis symbol: 
Rechecking for solution: 0
Report Id: 6d4633a7-5e96-11e4-bda4-4439c437d02a
Report Status: 0
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-28T11:35:35.000000000Z" />
    <EventRecordID>16286</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>306956482</Data>
    <Data>21</Data>
    <Data>WindowsLiveWriter</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>CloseSubjectSpellcheckWordRange</Data>
    <Data>182</Data>
    <Data>System.NullReferenceException</Data>
    <Data>16.4.3528.331</Data>
    <Data>2.0.50727.5485</Data>
    <Data>Windows Live Mail</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Users\Gary & Linda\AppData\Local\Temp\wlmail-433777574\B2611F65969D\dwlog.txt
C:\Users\Gary & Linda\AppData\Local\Temp\wlmail-433777574\495BE0E203E6\dwstacktrace.txt
C:\Users\Gary & Linda\AppData\Local\Temp\wlmail-433777574\B5EDAC473EDB\dwminidump.mdmp</Data>
    <Data>C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive
\Critical_CloseSubjectSpel_b0ead5886f1fd23cfa76e55369f069e4e6f14a9_17898ef6</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>6d4633a7-5e96-11e4-bda4-4439c437d02a</Data>
    <Data>0</Data>
  </EventData>
</Event>

 

[nikki605]

Here is the info on the IE11 crash that occurred 2 hours after the WLM crash. My wife was using the PC and I was not in the room when this happened. She tells me sh had 2 tabs open. One she had just logged off our Discover Card account webpage and on the other tab she was doing a Google search.

Log Name:      Application
Source:        Application Error
Date:          10/28/2014 9:34:50 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.17344, time stamp: 0x541b6f63
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x1564
Faulting application start time: 0x01cff29f11e86623
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 3074a9ae-5ea7-11e4-bda4-4439c437d02a
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-28T13:34:50.000000000Z" />
    <EventRecordID>16291</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>IEXPLORE.EXE</Data>
    <Data>11.0.9600.17344</Data>
    <Data>541b6f63</Data>
    <Data>ntdll.dll</Data>
    <Data>6.1.7601.18247</Data>
    <Data>521ea8e7</Data>
    <Data>c0000374</Data>
    <Data>000ce753</Data>
    <Data>1564</Data>
    <Data>01cff29f11e86623</Data>
    <Data>C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE</Data>
    <Data>C:\Windows\SysWOW64\ntdll.dll</Data>
    <Data>3074a9ae-5ea7-11e4-bda4-4439c437d02a</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        Windows Error Reporting
Date:          10/28/2014 10:22:45 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Fault bucket 569912240, type 17
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: IEXPLORE.EXE
P2: 11.0.9600.17344
P3: 541b6f63
P4: StackHash_2aa7
P5: 6.1.7601.18247
P6: 521ea8e7
P7: c0000374
P8: 000ce753
P9: 
P10: 
Attached files:
C:\Users\Gary & Linda\AppData\Local\Temp\WER5988.tmp.WERInternalMetadata.xml
These files may be available here:
C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_IEXPLORE.EXE_593dedd9e0e3ddc677435e47aa7de04515cf3d_18229a4f
Analysis symbol: 
Rechecking for solution: 0
Report Id: 3074a9ae-5ea7-11e4-bda4-4439c437d02a
Report Status: 0
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-28T14:22:45.000000000Z" />
    <EventRecordID>16292</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>569912240</Data>
    <Data>17</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>IEXPLORE.EXE</Data>
    <Data>11.0.9600.17344</Data>
    <Data>541b6f63</Data>
    <Data>StackHash_2aa7</Data>
    <Data>6.1.7601.18247</Data>
    <Data>521ea8e7</Data>
    <Data>c0000374</Data>
    <Data>000ce753</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Users\Gary & Linda\AppData\Local\Temp\WER5988.tmp.WERInternalMetadata.xml</Data>
    <Data>C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_IEXPLORE.EXE_593dedd9e0e3ddc677435e47aa7de04515cf3d_18229a4f</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>3074a9ae-5ea7-11e4-bda4-4439c437d02a</Data>
    <Data>0</Data>
  </EventData>
</Event>

I put the Report.wer file in a zip file and uploaded it here:

 

[Slartybart]

I'll take a look at the stuff you attached and see if I can determine anything from the data.

There's one thing just looking at the posted event for the IE crash: IE is referenced in Program Files (x86), which might not be an issue, as of IE 11, the default is the x64 version, so I'm guessing that you might have an old shortcut (Why? I don't know).

Please compare the properties of all IE shortcuts to the one below:

​

If the properties are different, post a screen shot. You should them correct the shortcut.

There was an issue with IE x64 before IE10 where you could not make the x64 version the default browser - this is not an issue with IE11.

Take a look at Defaults for IE (files and protocols) - then explicitly set it as the default browser (click the IE radio button even if it say use my default browser).

I did not forget that spellcheck was flagged in the previous event logs


The logs are located in the WLM store folder:
AppData\Local\Microsoft\Windows Live Mail

Find the most recent .LOG files and zip them (you might have to show hidden files in organize folder options)

Norton ... watched the std ports and it provided SSL to the Mail Server the same way Avast does - I think anyway. That's a lot of reading for me Thanks for posting the links - it saves me the trouble of looking them up.

This issue(s) are troubling because the system has been checked (SFC, AV, Disk check ...) and nothing really needed correction (disk check found a few things, AV found some things that were identified as user installed), but nothing that jumps out and said "Your system was really hosed ..."

The WLM is still present and you now have IE crashing. The two might be related, I'll know more after looking at the data.

Bill
.

 

[nikki605]

I have IE pinned to the Taskbar and always start it from there. I did that back in July when I was setting the system up. The property's Target looked correct, but the shortcut key was missing which told me it was pinned very early on, possibly when an older version of IE was installed. Just to be safe, I unpinned the current IE icon from the Taskbar and then went into Start-->All Programs and left-clicked Internet Explorer and pinned it to the Taskbar. This is now the Properties of the IE icon pinned to the Taskbar and it now shows the shortcut key entry:

Here are the IE files & protocols:

Then I explicitly set IE as the default browser.

I found 2 LOG files in the WLM folder and zipped them.

 

[nikki605]

Stay tuned. Early this morning the desktop had another IE11 crash. Just a few minutes ago WLM crashed when my wife clicked Send on a reply to a normal email from her sister. I was sitting right next to her when both crashes happened, using my laptop.

It will take me awhile to gather all the info for posting.

 

[nikki605]

IE11 crashed at 9:53am and this time the faulting module path points to NIS (Norton). As you questioned yesterday, the path for IEXPLORE.EXE points to Program Files (x86). So after IE restarted, I launched Task Manger and found 2 IE Processes, one of them 32 bit, so maybe this is normal.

I'm a member of the Norton support forum so I could post the problem there if you think it would be worth it.

Log Name:      Application
Source:        Application Error
Date:          10/29/2014 9:53:03 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.17344, time stamp: 0x541b6f63
Faulting module name: SYMHTML.DLL, version: 8.0.0.58, time stamp: 0x52018148
Exception code: 0xc0000005
Fault offset: 0x0003f36b
Faulting process id: 0xdc0
Faulting application start time: 0x01cff37fa8272748
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SYMHTML.DLL
Report Id: e6606d92-5f72-11e4-8f23-4439c437d02a
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-29T13:53:03.000000000Z" />
    <EventRecordID>16359</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>IEXPLORE.EXE</Data>
    <Data>11.0.9600.17344</Data>
    <Data>541b6f63</Data>
    <Data>SYMHTML.DLL</Data>
    <Data>8.0.0.58</Data>
    <Data>52018148</Data>
    <Data>c0000005</Data>
    <Data>0003f36b</Data>
    <Data>dc0</Data>
    <Data>01cff37fa8272748</Data>
    <Data>C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE</Data>
    <Data>C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SYMHTML.DLL</Data>
    <Data>e6606d92-5f72-11e4-8f23-4439c437d02a</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        Windows Error Reporting
Date:          10/29/2014 9:54:03 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Fault bucket 569556363, type 17
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: IEXPLORE.EXE
P2: 11.0.9600.17344
P3: 541b6f63
P4: SYMHTML.DLL
P5: 8.0.0.58
P6: 52018148
P7: c0000005
P8: 0003f36b
P9: 
P10: 
Attached files:
C:\Users\Gary & Linda\AppData\Local\Temp\WER5D6E.tmp.WERInternalMetadata.xml
These files may be available here:
C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_IEXPLORE.EXE_a3771e1114176bdb78325ed78217f4dc9db164_12446876
Analysis symbol: 
Rechecking for solution: 0
Report Id: e6606d92-5f72-11e4-8f23-4439c437d02a
Report Status: 0
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-29T13:54:03.000000000Z" />
    <EventRecordID>16360</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>569556363</Data>
    <Data>17</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>IEXPLORE.EXE</Data>
    <Data>11.0.9600.17344</Data>
    <Data>541b6f63</Data>
    <Data>SYMHTML.DLL</Data>
    <Data>8.0.0.58</Data>
    <Data>52018148</Data>
    <Data>c0000005</Data>
    <Data>0003f36b</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Users\Gary & Linda\AppData\Local\Temp\WER5D6E.tmp.WERInternalMetadata.xml</Data>
    <Data>C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_IEXPLORE.EXE_a3771e1114176bdb78325ed78217f4dc9db164_12446876</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>e6606d92-5f72-11e4-8f23-4439c437d02a</Data>
    <Data>0</Data>
  </EventData>
</Event>

 

[nikki605]

WLM crashed at 11:43am. My wife was replying to a message from her sister. She had finished typing her response, clicked on Send and BANG!

When WLM restarted, there were some obvious corruptions in the message database. In the screen shot below, my wife was replying to the 5th message down. After WLM restarted that message was displayed in bold (unread) which is not correct. She had double-clicked the message to open it, clicked on Reply and typed her response, so the message should not be bolded. The 3 highlighted messages were sitting unread in the Inbox prior to the crash, but when WLM restarted they were displayed with corrupted From fields. The very top message was received well after WLM restarted from the crash and appears normal - you can ignore that one.

Next is a screen shot of the Sent folder after WLM had restarted from the crash. Her message displays there but in bold with a corrupted From field. We think it actually was sent, but we are not sure.

By the way, this message is from our default Verizion email account and is NOT the ones that have been receiving the bulk of the spam messages.

Log Name:      Application
Source:        Application Error
Date:          10/29/2014 11:43:11 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Faulting application name: wlmail.exe, version: 16.4.3528.331, time stamp: 0x533a3fce
Faulting module name: MSMAIL.DLL, version: 16.4.3528.331, time stamp: 0x533a408a
Exception code: 0xc0000005
Fault offset: 0x0002f015
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-29T15:43:11.000000000Z" />
    <EventRecordID>16362</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>wlmail.exe</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a3fce</Data>
    <Data>MSMAIL.DLL</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a408a</Data>
    <Data>c0000005</Data>
    <Data>0002f015</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        Windows Error Reporting
Date:          10/29/2014 11:44:03 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      lenovoM83
Description:
Fault bucket 195284476, type 17
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: wlmail.exe
P2: 16.4.3528.331
P3: 533a3fce
P4: MSMAIL.DLL
P5: 16.4.3528.331
P6: 533a408a
P7: c0000005
P8: 0002f015
P9: 
P10: 
Attached files:
C:\Users\Gary & Linda\AppData\Local\Temp\WERD08D.tmp.WERInternalMetadata.xml
These files may be available here:
C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_wlmail.exe_49695c9619d2fff0adc2339577cef8bcbc58cd3c_0fb11e5e
Analysis symbol: 
Rechecking for solution: 0
Report Id: 4967241c-5f82-11e4-8f23-4439c437d02a
Report Status: 0
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-29T15:44:03.000000000Z" />
    <EventRecordID>16363</EventRecordID>
    <Channel>Application</Channel>
    <Computer>lenovoM83</Computer>
    <Security />
  </System>
  <EventData>
    <Data>195284476</Data>
    <Data>17</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>wlmail.exe</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a3fce</Data>
    <Data>MSMAIL.DLL</Data>
    <Data>16.4.3528.331</Data>
    <Data>533a408a</Data>
    <Data>c0000005</Data>
    <Data>0002f015</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Users\Gary & Linda\AppData\Local\Temp\WERD08D.tmp.WERInternalMetadata.xml</Data>
    <Data>C:\Users\Gary & Linda\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_wlmail.exe_49695c9619d2fff0adc2339577cef8bcbc58cd3c_0fb11e5e</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>4967241c-5f82-11e4-8f23-4439c437d02a</Data>
    <Data>0</Data>
  </EventData>
</Event>

Let me know what other information you want.

 

[Slartybart]

Just when I think I have an idea as to what's going on ... BAM ... more crashes, different crashes.

Tracking the previous crash led me to a known bug in c++ or .NET - why either one? The bug is old and after a patch, MS moved from MFC to .NET foundation class in the c libs.

The 'fix' is to uninstall all redistributable c++ runtime libraries (msvcrt or Visual c++ 2005, 2008, 2010, 2012), then reinstall them in order applying Windows Updates as you progress. Eacjh library comes in x86 and x64 flavors - you'll need to install both versions.

Uninstall all of the runtime libraries - the newer versions have stub references to the older libs, so all of them have to be removed before you start 'repairing' the c++ runtime libs. There might be more intelligence in the installs, but I like to do this 'repair' as clean as possible - that means installing them in a chronological fashion. Real world scenarios would not follow this pattern - an application needing msvcrt 2005 would install it if it wasn't present.

MSVCRT 2005 x86
MSVCRT 2005 x64

Run Windows update manually until there are no more msvcrt 2005 updates offered. Then install msvcrt 2008

MSVCRT 2008 x86
MSVCRT 2008 x64

Run Windows update manually until there are no more msvcrt 2008 updates offered. Then install msvcrt 2010

MSVCRT 2010 x86
MSVCRT 2010 x64

Run Windows update manually until there are no more msvcrt 2010 updates offered. Then install msvcrt 2012

MVCRT 2012 update 4
I couldn't locate a base install for 2012 - I hope it doesn't punt because there isn't a base or update 1-3.
I'll address that if it doesn't install. This core tech always drives me a little batty - they keep changing where the runtime libs are located (there was at one time a nice page that gave you all of the download links)

Run Windows update manually until there are no more msvcrt 2012 updates offered.

The issue revolves around null processing and that's why I'm focusing on the c++ libs (WU should repair any MFC issues for older libs). Any program might have carried a bad redist with them and corrupted the good one when it got installed. I want to hold off on 'repairing' .NET 2.0 because it's even more of a pain than msvcrt libs. It's less likely that .NET was affected by an install gone south, but the two are related.

It's interesting that MSHTML and SYMHTML are referenced in separate crashes - this is where I came in I believe. There was a bug in MSHTML about a year ago, but you checked the system and that wasn't the cause.

Let's see how the system behaves after the c runtime repair.

I'm going to offer a sure fire solution - a clean install. The decision is yours ... to continue chasing this issue or to cut your loses and go all in. There are two very good tutorials that make the process easy, but it takes about a day. This includes the prep time (creating the media), installing my favorite apps, and restoring my data, plus applying some tweaks (shortcut arrows, - shortcut text).

If you decide to re-install, please put MSE on the system instead of Norton to test that hypothesis. Also, hold off on any non-essential applications until you can determine that the system is behaving. Then slowly add one at a time - if the system holds, put another thing on. This way if the issue reappears, you have a better idea of what caused it.

Having said all of that, I'll know by your next post whether I need to gear up for more crashes.

Bill
.

 

[nikki605]

I read your post above, several times in fact, and wasn't sure if I wanted to cry or throw up. No doubt the things you are describing (C++ and .NET) are pretty much over my head other than I know Windows needs them. What I am having a hard time grasping is how a 4-month old system can be suffering from an "old" bug.

I looked at the Redistributables in Control Panel and they don't match what you listed. The 2005 entry does not have an x86 and x64 version. There is no 2012 version at all. The one's that are listed all have an install date of 04/03/2014. The pre-dates when I bought the system by 3 months so it was part of the factory pre-load.

As I understand .NET in Windows 7, it is an integral part of the OS now which is why it doesn't show up in Control Panel.

No disrespect intended, but I am shocked at the suggestion of a complete reload of Windows 7 on a 4-month old system. If there is something basically wrong with the installation, wouldn't I just be recreating the same problem by restoring from the recovery partition? Are you saying that the pre-load from Lenovo was bad?

I just don't see how I will be better off reloading from a 4-month old recovery partition. But like I said, I'm in over my head right now and just trying to understand.

Tell you what, take a look at the Redistributables above that are currently on the machine. If you still think reinstalling them could help, I'll do it.

Just for chuckles, here are the Redistributables installed on my Windows 7 laptop. Compared to your list, they look even more screwed up.

+EDIT

Shouldn't I be using the SP1 download links? (Like I said, I'm over my head here).

http://www.microsoft.com/download/en/details.aspx?id=5638

http://www.microsoft.com/download/en/details.aspx?id=18471

http://www.microsoft.com/download/en/details.aspx?id=5582

http://www.microsoft.com/download/en/details.aspx?id=2092

http://www.microsoft.com/download/en/details.aspx?id=8328

http://www.microsoft.com/download/en/details.aspx?id=13523

I looked at a couple of your links and the System Requirements don't list Windows 7.

There is also a 2013 version. What about that?

http://www.microsoft.com/en-us/download/details.aspx?id=40784

Thanks,
Gary