Reported v4.23: Sometimes IrfanView hungs up if deleting one picture in thumbnail view!

[irport]

My environment: IrfanView 4.23, Plugins 4.22, Vista Ultimate 32b, logged in as standard user, Core2Duo E6600.

Problem: When I use the DEL key to delete exactly(!) one selected picture (mostly JPG) in Thumbnail View, then it is pretty likely (ca. 35%) that IR hangs up itself. It depends on which specific picture file it is.

Context: If then I shut down IrfanView and use the Windows-Explorer to delete the same file, it is also pretty (but less) likely that the Windows-Explorer hangs up itself, too. If then I use cmd.exe to delete the file, it is always possible. - Running IrfanView with CPU core association 0 or 1 does not change anything. - Deleting more than 1 picture at the same time is always possible, even if it includes a problematic picture. - The same bug occurs if I use either of IrfanView 3.85, 4.10, or 4.20. - The problematic picture files have the same file attributes as all my other picture files.

Installing a Windows Update for explorer.exe has led to a change: The likelihood of a crash is reduced from 35% to ca. 1.5%.

Background: A couple of months ago a Windows Update had replaced explorer.exe; afterwards the 35% likelihood occurred. Now another update of explorer.exe of December reduces the likelihood again. I cannot remember whether the current frequency of 1.5% is the same as the original frequency because at that time IrfanView had had a lot of other bugs in thumbnail view.

IrfanView is my only program for that the bug occurs at all. If I use explorer.exe and do not use IrfanView, then the bug does also NOT occur. Therefore, although explorer.exe had a bug, it is rather likely that also IrfanView still has a bug related to deleting exactly one picture in thumbnail view by the DEL key, IMO.

[irport]

Now I have investigated the issue in more detail by careful testing.

IR does not, as I assumed, crash or hang up. Instead there is a significant delay caused by a combination of IR's communication with svchost.exe and my personal firewall's detection of that fact. The delay is for the confirmation popup window "Are you sure that you want to delete this file?" of explorer.exe.

My firewall reports inter-program communication from IR to svchost.exe. So far I have observed these types of communications: a) write to svchost's memory, b) inter-process call to svchost, c) parent process chain.

In all cases, the addressed svchost.exe instance consists of these Windows services: 1) DNS-Cache, 2) CryptSVC, 3) NlaSvc, 4) TapiSrv.

Of course, I do not know why IR sometimes contacts svchost. I prohibit it in my firewall, and this does not stop IR from otherwise working correctly.

So what I have detected does not need to be a bug of IR. It might also be questionable intended or unintended communication to svchost. Therefore it would be nice to learn why IR does - want to - communicate with svchost at all. I would rather prefer to see no such attempts in the first place because svchost (and in particular the mentioned instance) is a process able to communicate with the internet.

[irport]

Some further investigation using Sysinternals's ProcessMonitor reveals the following related to file actions of i_view32.exe:


Identical steps:

1. QueryInformationVolume <path>\MyPictures\<X.jpg> BUFFER OVERFLOW

2. QueryAllInformationFile <path>\MyPictures\<X.jpg> BUFFER OVERFLOW

3. QueryInformationVolume <path>\MyPictures\<X.jpg> BUFFER OVERFLOW

4. QueryAllInformationFile <path>\MyPictures\<X.jpg> BUFFER OVERFLOW


Additional step for file deleted without problem:

5. QuerySecurityFile <path>\MyPictures\<X.jpg> BUFFER OVERFLOW Information: DACL


Additional step for file deleted with problem:

5. QueryDirectory <path>\MyPictures\windowscodecsext.dll NO SUCH FILE


The DLL windowscodecsext.dll is situated in C:\Windows\System32. So it is not surprising that the file is not found in <path>\MyPictures\, especially since I created that folder. However, why is that DLL called at all, why is it searched in <path>\MyPictures\, is it called on IrfanView's own request, and why is only every ca. one or two hundredth picture file affected?

[Mij]

Svchost.exe instances act as containers for Windows system processes. IrfanView has to access those instances of svchost that contain the dll 's that it needs to use, to read and write to the hard disk for example. It is not obvious why IrfanView would need those processes you list though. How do you know which instance of svchost was being addressed?

[irport]

Mij, each process has a PID, i.e., an identifying number. In particular, the following programs tell me the PID: a) ProcessExplorer from Sysinternals (aka Microsoft). b) My personal firewall / HIPS software.

[irport]

Now I have more information: With IR 4.27 under Windows 7 Prof 64b German, I have not had the problem even once so far if the option "Ask me before deleting files" is DISabled!

I cannot know which of the following might have avoided the problem for me:
- disabling instead of enabling said option
- switching from Vista to Windows 7
- bug correction from some earlier versions to IR 4.27

At least this additional information should give Irfan a good hint of where to locate the bug if it is still there!

I would like to enable the option again but don't dare to - my earlier experiences were too bad... So I am still hoping the bug can be located.