Serious flaw discovered in Windows Vista's Explorer


Recommended Posts

At a time where everyone is anxiously awaiting the upcoming service pack for Windows Vista (and while others flock back to Windows XP in droves), yet another flaw in the Windows Vista operating system has been discovered that can bring the Windows shell ("Windows Explorer") to its knees within 20 seconds. Even worse, this issue occurs under every day usage of the operating system if you use the Search function regularly with boolean search operators.

  1. Click on Start, and then click on Documents.
  2. In the Search entry box, type "NOT Shortcut" (without the quotes).
  3. Click on the "Save Search" button and save the search query as "Search Test".

This has been confirmed as a flaw in Windows Vista (all editions) and Windows Vista 64-bit (all editions), and even worse, the issue still occurs on the latest release candidate for Service Pack 1, and has been marked as "will not be fixed". The bigger question is, will Microsoft step up to the plate and fix this issue or will they let it pass on by while they work heavily on Windows "7", ignoring the fact that Windows Vista still has flaws and inconsistancies that are seeing larger companies hold back deployment until 2009 or even skip Vista?

Source of instructions to reproduce issue: ActiveWin.com

Holy cow, think of the countless people who will be put into shambles, i mean, people search for NOT Shortcut all the time, and i for one always save my queries as search test.

We can only curse at things like this because WinFS would have certainly avoided such problems.

*sigh*

:ike:

Acdtually, all three major components of WinFS IS in Vista, in the forms of Instant Search, VSC and som other stuff.

It doesn't crash my system :s

Windows Vista Home Premium with the RC of SP1.

It crashed my system without SP1, but didn't crash with SP1 so this is fixed with SP1 I guess. Either way, why is anyone searching for NOT shortcut in the first place? I mean most people search for specific files, not everything on their damn system. This is a non-issue IMO.

I love how people quickly defend Microsoft's Vista OS when people find issues with it. The right thing to do is expect this bug to be fixed. There is no excuse for not fixing a bug. You pay good money for it and in exchange you expect support for it, especially a the price tags of Vista's many flavours, why would you defend its flaws?

I'm not saying XP or anything else is perfect, but for christ sake people this is a PIECE OF SOFTWRE, not a cult or religion. Yes the person who posted about this bug probably hates Vista but it's a bug nevertheless regardless if the person is a Vista hater or supporter and a bug should eventually be fixed. It's as simple as that.

I love how people quickly defend Microsoft's Vista OS when people find issues with it. The right thing to do is expect this bug to be fixed. There is no excuse for not fixing a bug. You pay good money for it and in exchange you expect support for it, especially a the price tags of Vista's many flavours, why would you defend its flaws?

I'm not saying XP or anything else is perfect, but for christ sake people this is a PIECE OF SOFTWRE, not a cult or religion. Yes the person who posted about this bug probably hates Vista but it's a bug nevertheless regardless if the person is a Vista hater or supporter and a bug should eventually be fixed. It's as simple as that.

Yes, the bug should be fixed, but I don't care if they get around to fixing it in Vista SP1 or SP5 - I'll never encounter it, period. I'm more concerned about memory leaks and actual bugs that hamper my experience then some obscure bug I'll never accidentally encounter.

Please let us know when it proves to be a remotely exploitable buffer overflow that is usable as a program loader. Then we can upgrade its status to either serious or critical. At this point it's just a minor irritation, something that is in every version of every OS I've ever worked with. Pttht!

Interesting fallout from this...

Going back to 14 months ago...

I'm at the Microsoft Windows Vista October Beta Tour and am in one of three groups of ~40 of the Vists Beta Testers invited to spend 2 days at Microsoft, and Robert McLaws ( owner & admin of www.windows-now.com ) happens to be in my group - a very easy-to-talk-to guy who also knows what he talks about. I got to meet alot of very interesting people and renewed some very old (around 20-years-ago) friendships with former co-workers from various former employers.

...fast-forward to present time...

I see that the original post that generated this thread and the one on ActiveWin came from Robert's site - which causes me to raise my eyebrows slightly. I click on the link for the originating blog entry....and get ZIP from the website. I go back and see the list of Bloggers on the site, locate the author's blogs...and am greeted with this page. I go back and try to click on the actual blog entry - which now takes us back to the top of the Blogs section.

It's nice to see a site admin who has absolutely zero tolerance to buffoon-posts from buffoons. Give Robert a pat on the back, folks.

IMHO, this whole issue has got to be the biggest non-issue with Vista ever - and is near-perfectly timed to coincide with the end of 2007. Kinda nice to end the year with a whimper.

--ScottKin

Alright, so I published this over at Windows-Now.com (it does not display on the front page), I figured that I would post it here as well before my account here is deleted.

Alright, so after being harassed, flamed, and torn apart for the past ~24 hours via instant messenger and e-mail (which has resulted in me having to delete my personal e-mail account) about a post that I made on this website in regards to an issue that was found in the Windows Vista Explorer Search module, I've decided that I should come forth a little bit with you all.

Let's begin -- several years ago, during the Windows Code-name "Longhorn" era, I teamed up with Chris Holmes, someone who I consider to be a good friend, to work on several "guides" for tweaking the operating system, at the time I was only representing myself under the screen name "Nighthawk", although further into the Windows Vista beta I decided to use my actual name on the guides, as I felt it represented a step forward in professionalism in something that I enjoyed doing.

First and foremost, the reason that I posted the information regarding the flaw is because I was contacted by Microsoft stating that they would not be fixing the bug for Service Pack 1, which in my mind is a little bit boggling -- so I figured that a little bit of attention on this flaw would perhaps give someone over in Redmond a bit of a push to get this resolved, because it is a valid issue.

I've heard things such as "You're a [expletive] idiot for posting this", and "why the hell would you search for NOT Shortcut anyway?" This doesn't just apply to "NOT Shortcut", it applies to anything with "NOT".

You could search the folder for "NOT Music" or "NOT Peanuts" for all I care, it still crashes the process. I would have never thought that I would receive this kind of response to something like this, and I am truly disappointed. It seems as if some have reached a point where it doesn't matter if the operating system is full of bugs, as long as nobody speaks negatively about it, then all is well.

Unfortunately, I'm not the kind of person who will stand by and not take a stand for what I think is right. As an enthusiast and a human being, I cannot pretend and stand by to do what is "right" for the community, and no matter what the cost is, I cannot and will not continue with things in this state.

I was recognized for my contributions with the Microsoft MVP award in October for 2008, in the competency of Windows - Shell/User, which I felt was a real accomplishment and I was quite proud of myself. I've always had the passion to write -- and I focused primarily on Windows documentation, tweak guides, and tips & tricks. But unfortunately, after all of this, I've almost lost the inspiration and the passion to continue with my work as a Windows enthusiast. I've seen an extreme amount of distaste against what seems to be the truth lately, and that anything that doesn't go with the flow is automatically picked apart by fanboys and ego-maniacs.

At this point in time I would like to inform each and every one of you, and any of my readers out there, that I am pulling out from any current projects, tweak guides, and tips & trick guides, along with any involvement that I have with the community at this point in time. I'm going back to living my life, without being harassed over a blog post that I thought would be informative. With that being said, I do not know if I will be returning due to what seems to be a growing trend with "fanboyism" and the sheer amount of immaturity and disrespect that I have received in the past 24 hours.

To my fellow enthusiasts whom I have collaborated with over the years, including Chris, Mahmoud Al-Qudsi (author of EasyBCD), my friends at Microsoft Corporation, I wish you all the best and thank you for your assistance, guidance, and friendship. To Robert, the owner of Windows-Now.com, I would like to thank you for allowing me to host my information here on Windows-Now.com, and apologize if my previous blog post has caused you any grief.

I wish you all the best in the New Year and that you all take care of yourselves. Thank you for taking the time to read this entry.

Wow, I am completely astounded by this thread. All Kris did was post about an issue that was found in Windows explorer that Microsoft said they would not fix. He gave it a bit more of a public light in the hopes that it would kick someone over at Redmond in the ass and make them actually fix something for a change instead of senselessly closing the bug as "Not Reproducable".

The part that really gets me is that the same people who are flaming Kris about this, because it is not a "real issue", are the same people that bitch and moan all day long about vista being "****" and how it has so many issues. Umm hello? Anyone else seeing the irony here, or do you people just like to bitch for a living?

If there's one thing I've learned over the years, it's that you just have to stop caring about what other people have to say about you, because 99% of it is bull**** coming from immature little losers anyway. You guys may have succeeded in pushing out a great member of the community, I hope you're all happy now. I for one would not be pushed out like this because I don't pay any attention to senseless comments like this. I just stepped in now because this really needs to be addressed because it IS getting out of hand. Who CARES if you don't think it's an issue? In my book, ANYTHING that can crash a component of windows without adding a 3rd party plugin/application into the mix is a bug that MUST be fixed. Oh well, I don't even know why I'm wasting my breath on this, I'd probably make more progress talking to my walls.

Thanks for your kind words, Kris.

I know I speak for a lot of people here and in the rest of the online community when I say that no matter what transpired over the past couple of days everyone will certainly miss your contributions.

I'm shocked in disappointed in the reaction of many people as well, one would have expected a higher level of maturity when dealing with such issues, especially when they're being disclosed in good faith with the intention of getting them fixed, not flamebaited.

I wish you luck, wherever it is you choose to go from here.

Wow, I am completely astounded by this thread. All Kris did was post about an issue that was found in Windows explorer that Microsoft said they would not fix.

I think it's the sensationalist headline that most people have a problem with. It's not a serious flaw, by any means. A serious flaw (for example) would be an exploit that allows somebody to take over my computer remotely without me having to do anything. Not something that I type into the search field that crashes Explorer for a few seconds.

Steve.

Alright, so I published this over at Windows-Now.com (it does not display on the front page), I figured that I would post it here as well before my account here is deleted.

Instead of admitting that you blew it way out of proportion you choose to call everybody else fanboys? Comon, you could do better than that.

[Cross posted to Windows-Now]

We faced an issue with Vista. The issues? A few bugs being blown out of proportion, people thinking the beta of Vista was the final quality, people running Vista on CRAP hardware, and the most important; the blogosphere hating Vista.

So people started getting defensive of Vista against the stupid Mac heads and Linux heads. What happened here is that people got TOO defensive. We as a community are turning into the communities of zealotry, which we so despise, one of the principal reasons that we use Windows. We are becoming fanbois, and throwing our own under the bus.

What we all need to do is unite as a single community, drop these community wars, and start collaborating and trying to help Microsoft make a better operating system. Not say "IT IS PERFECT THE WAY IT IS!" I for one refuse to be part of a community where we must accept the OS as perfect, or be a "DUMB MAC FANBOI!" I am neither.

I have a genuine fear for where Windows and the community are going. Currently Microsoft seems to be trying to emulate Apple, and is doing so poorly. Microsoft is trying to follow a model that does not allow their community to make MAJOR change in their products. They are building up walls when they should be taking them down. As a community we are moving towards a model where we either must hate the OS to get Microsoft to change it or we need to defend it to the point where we spam one of the longest and smartest members of the Windows community, who deserves nothing less than our respect! It is absolutely disgusting to me that all these new comers to the beta scene think they have the right to harass one of the longest standing members of the community, and that they are smarter than someone who deserves nothing but respect. At this point today I am ashamed to call myself a part of what the Windows community has become, this Windows Community. Any of you who took part in the events of the last 24 hours, or any sort of extreme zealotry at all, should seriously rethink whether they should or deserve to call themselves Windows Enthusiasts.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • OpenAI's new GPT-5.5-Cyber tops Claude Mythos 5 in vulnerability benchmark by Pradeep Viswanathan OpenAI today announced a major expansion of Daybreak, a cybersecurity initiative designed to help defenders find, validate, and fix software vulnerabilities earlier in the development process. The availability of powerful AI models has definitely changed the cybersecurity landscape by making vulnerability discovery much faster. However, the bigger bottleneck for the industry is now patching those vulnerabilities. Impacted software teams need to validate the discovered issues, understand their impact, develop fixes, test them, and deploy patches. Back in March, OpenAI launched a preview of Codex Security, which uses agentic reasoning with automated validation to discover high-impact issues and actionable fixes specific to the codebase. Since then, it has scanned more than 30 million commits across over 30,000 codebases; more than 70,000 findings were marked as fixed by human reviewers, while over 500,000 findings were automatically determined to be fixed. Now, OpenAI is releasing an updated Codex Security plugin that can run deep scans, review recent code changes, generate security reports, trace attack paths, validate findings, and create codebase-specific patches for human review. It can also triage findings from existing scanners, advisories, bug bounty reports, and ticketing systems. OpenAI says the plugin can export results to vulnerability management systems and integrate with workflows using SARIF files, CodeQL queries, the Codex CLI, and the Codex app. Back in May, OpenAI announced the preview of GPT-5.5-Cyber, a new model built on top of the recently released GPT-5.5, designed for specialized cybersecurity work. Today, OpenAI launched the full version of GPT-5.5-Cyber through a limited release for verified defenders. On CyberGym, GPT-5.5-Cyber scored 85.6%, compared with 81.8% for GPT-5.5 and 83.8% for Claude Mythos 5. It also scored 39.5% on ExploitGym, compared with 25.95% for GPT-5.5, and 69.8% on SEC-bench Pro, compared with 63.1%. OpenAI also announced the new Daybreak Cyber Partner Program, which will allow security vendors and service providers to use GPT-5.5 with Trusted Access for Cyber in their products and services. Accenture, Akamai, Cisco, Cloudflare, CrowdStrike, IBM, Palo Alto Networks, Proofpoint, SentinelOne, Wiz, Zscaler, and others were listed as initial partners for this program. OpenAI is also launching Patch the Planet with Trail of Bits, HackerOne, Calif, researchers, and maintainers. More than 30 open-source projects have committed to participate, including cURL, Go, Python, Sigstore, and pyca/cryptography.
    • AMD confirms 26.6.2 FSR driver breaks on many Windows PCs by Sayan Sen Earlier today AMD released a major graphics driver update as it brings support for FSR 4.1 to Radeon RX 7000 series GPUs. The new update, version 26.6.2, also brings support for Assassin's Creed Black Flag Resynced and more. And while the driver technically supports Windows 10 version 21H2 and newer, the tech giant has confirmed that there is a major issue with the new driver on non-Windows 11 PCs as it fails to launch properly on such systems. The error message says, "The version of AMD Software that you have launched is not compatible with your currently installed AMD graphics driver." Therefore on the surface it looks like a compatibility problem. AMD has also confirmed that the device manager will display the yellow bang or yellow exclamation sign alongside your GPU under the Display adapters dropdown. Here is what the Radeon team's official advisory recommends to affected users: "Users Running Windows 10 and AMD Software: Adrenalin Edition 26.6.2 May Encounter Yellow Bang in Device Manager Affecting AMD Radeon RX Series Graphics ... Our Engineers are currently investigating this issue and will provide a fix once it is available. Affected users may revert to AMD Software: Adrenalin Edition 26.6.1 as a temporary workaround." As such you should revert back to the previous 26.6.1 driver which was released earlier this month. In case you were looking to play Assassin's Creed Black Flag Resynced and DOOM: The Dark Ages | Revelations you will probably have to wait a while if you want the driver to support those games officially. You can find the support article here on Microsoft's website.
    • https://uupdump.net/selectlang...7829-4524-978d-7b5fe79263e3
    • A McDonald's restaurant uses about 1.5 to 2 million gallons of water per year for operations like food preparation, cleaning, and restrooms. That is a lot less than the 2,083 gallons of water per megawatt hour mentioned above.
    • Turbo Pascal Original authorAnders Hejlsberg (at Borland) DeveloperBorland Release20 November 1983; 42 years ago[1][2] Operating systemCP/M, CP/M-86, MS-DOS, Windows 3.x, Classic Mac OS PlatformZ80, x86, 68000, PC-98 https://en.wikipedia.org/wiki/Turbo_Pascal It was the one language I actually learned to program in.   I wasn't very good at it and never used it at work.    If anyone has any personal Turbo Pascal stories or personal accomplishments using it, please take a moment to share.   Thanks. Peace
  • Recent Achievements

    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
    • First Post
      mike_rumble earned a badge
      First Post
    • Dedicated
      tuben earned a badge
      Dedicated
    • Week One Done
      mnsgroup earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      503
    2. 2
      +Edouard
      208
    3. 3
      PsYcHoKiLLa
      100
    4. 4
      Michael Scrip
      88
    5. 5
      neufuse
      71
  • Tell a friend

    Love Neowin? Tell a friend!