claudetools/clients/rednour/session-logs/2026-06/2026-06-29-howard-legalasst-zip-hang-wp5-win11.md

Rednour Law — LEGALASST explorer hang on .zip + WordPerfect 5 save error + Win11 plan

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Diagnosed an explorer.exe stability problem on LEGALASST, the legal assistant's workstation at Rednour Law (Carla Skinner's box; active local account emma, profile C:\Users\Ale, OneDrive carla@rednourlaw.com). Reported via Carrie Rednour: explorer repeatedly hung/crashed when "opening files or messing with files." Work was driven over GuruRMM (agent 18825ea7-df58-47bb-b492-822cb16fb5ec); the office subnet was initially unreachable from HOWARD-HOME because Tailscale was stuck in NoState, which cleared on its own shortly after.

Established via the Application event log that explorer was hanging (AppHang Event 1002), not crashing — there were no Event 1000 / faulting-module records. Hangs were firing several times per hour on 2026-06-29 and continued after a 10:52 reboot. The .NET Runtime Event 1022 "profiling API attach" errors (201 of them) were ruled out as benign noise — no COR_PROFILER env var is set, so nothing is being injected into explorer via that path.

Narrowed the cause by elimination. Blocked the Adobe shell extensions (Acrobat context-menu

• CoreSync overlays) via the Microsoft "Blocked" CLSID list and restarted explorer — no change, so Adobe was ruled out and reverted. Mapped drives X/Y/Z (→ \\rednourcarrievirt, the cloned Carrie host) were healthy (Status OK, no SMBClient errors). The only non-Microsoft DLLs actually loaded in explorer were the AMD Vega driver (amdihk64/atidxx64/aticfx64/atiuxp64), but there were zero display-driver TDR events, so the GPU driver was not crash-recovering. OneDrive sync was healthy and its overlay was not even loaded. Howard then supplied the decisive clue: the hang happens only when opening .zip files, Word/PDF open fine, and the failing zip is on the local desktop (not OneDrive, not a network share). That isolated the fault to the built-in Windows Compressed Folders handler (explorer's zip-as-folder namespace). zipfldr.dll is intact and validly signed, so the hang is environmental, not a corrupt handler DLL.

Howard installed 7-Zip 26.02 as a workaround — it opens the same zips fine because it is a standalone app that never invokes explorer's zip namespace. He will set 7-Zip as the default for .zip (and .7z/.rar, currently unassociated) via the 7-Zip GUI. A second, separate issue on the same machine was reported: saving from WordPerfect 5 returns "not enough free space" regardless of save location, despite Howard verifying ample free space. The plan is to upgrade LEGALASST to Windows 11, which is expected to resolve the zip-handler hang by rebuilding the shell/system files (and applies the pending SFC repair); the team will test a local zip with the built-in handler after the upgrade. All diagnostic changes were reverted and the box was left clean.

Key Decisions

• Diagnosed live over GuruRMM rather than waiting for on-site access; used user_session context for HKCU/OneDrive/shell-folder reads and SYSTEM context for HKLM/event-log reads.
• Used the Microsoft Shell Extensions\Blocked CLSID list (reversible) to test-disable Adobe/7-Zip shell extensions instead of deleting registrations — clean revert path.
• Treated the .NET 1022 errors as noise after confirming no COR_PROFILER was set, instead of chasing the profiler-injection theory.
• Did not hand-write a per-user UserChoice association hash for .zip (hash-protected; a wrong hash leaves a broken "how do you want to open this?" prompt). Howard opted to set the default in the 7-Zip GUI; no DefaultAssociations policy was pushed.
• Concluded the Win11 in-place upgrade is the right fix for the zip-handler hang (rebuilds shell/system files) rather than further low-level surgery on a Win10 22H2 EOL box.

Problems Encountered

• Office subnet unreachable from HOWARD-HOME — Tailscale daemon RUNNING but backend stuck in NoState; a service restart did not clear it, but it came up on its own shortly after.
• Orphaned RMM diagnostic process — the first diagnostic command timed out server-side at 120s (a HKLM\...\Classes\*\shellex wildcard scan), but the agent's child powershell.exe (PID 1048) kept running on the endpoint for 10+ minutes, churning CPU. This was the "PowerShell that's been running" Howard noticed. Killed it (SYSTEM context). Logged as friction.
• $pid reserved-variable collision — used $pid as a variable in a remote script; $PID is the automatic current-process-id variable, so the .zip ProgID read returned garbage (16044). Re-ran with a non-reserved name. Logged as friction.
• Mis-assumption corrected — initially assumed LEGALASST was the cloned machine; Carrie's machine was the one cloned (to host rednourcarrievirt), LEGALASST is the legal assistant's (unchanged) box. Logged as a correction.

Configuration Changes

Net change to the endpoint: none (all diagnostic changes reverted; box left clean). During the session, on LEGALASST:

• Added then removed Adobe (4 CLSIDs) and 7-Zip shell-extension CLSIDs in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked (Blocked list now empty).
• Restarted explorer.exe several times (user_session).
• Killed orphaned diagnostic process PID 1048.
• Howard installed 7-Zip 26.02 (standalone; he will set .zip/.7z/.rar defaults).
• Howard ran sfc /scannow — found and repaired corruption (0 unrepairable); repair pending a reboot to load.

Repo: this session log; Rednour wiki record update pending (/wiki-compile client:rednour).

Credentials & Secrets

None discovered, created, or rotated this session.

Infrastructure & Servers

• LEGALASST — legal assistant workstation, Rednour Law "Main Office" site. Win 10 Pro 22H2 (build 19045, EOL), AMD Ryzen 3 3200G (Vega 8 iGPU), 5.9 GB RAM, LAN 192.168.10.213. GuruRMM agent 18825ea7-df58-47bb-b492-822cb16fb5ec. Active local account emma, profile C:\Users\Ale. OneDrive account carla@rednourlaw.com; Documents redirected to C:\Users\Ale\OneDrive - Rednour Law\Documents. Leftover SyncroLive.Agent.Runner still running.
• AMD GPU driver: 31.0.12027.9001 (2023-03-29). 7zFM.exe 26.02 at C:\Program Files\7-Zip\.
• zipfldr.dll = 10.0.19041.1, signature Valid (handler is intact).
• Mapped drives (user emma): X: \\rednourcarrievirt\Time Matters Shared Files, Y: \\rednourcarrievirt\Timeslips, Z: \\rednourcarrievirt\Documents — all Status OK.
• GuruRMM server http://172.16.3.30:3001; coord http://172.16.3.30:8001.

Commands & Outputs

• Diagnostic dispatch pattern: POST /api/agents/<id>/command (powershell, context system or user_session), poll GET /api/commands/<id>.
• Key reads: Get-WinEvent Application 1000/1002 + ProviderName 'Application Hang'/'.NET Runtime'; explorer loaded modules filtered to non-Microsoft CompanyName; Get-SmbMapping; Get-MpComputerStatus/Get-MpPreference; CBS.log [SR] parse.
• AppHang count = 10 in last 3h on 2026-06-29; latest 11:31:02 (post 10:52 reboot).
• .zip association: HKCR\.zip (default) = CompressedFolder, no UserChoice. 7-Zip registered only a 7-Zip.iso ProgId (no 7-Zip.zip). .7z/.rar currently unassociated.
• SFC (CBS.log): "Verify and Repair Transaction completed... successfully repaired"; 0 "cannot repair" entries.
• Defender: RTP on, no active scan, signatures fresh, DisableArchiveScanning=False, MAPSReporting=2, SubmitSamplesConsent=1 (archive + cloud scanning on).

Pending / Incomplete Tasks

1. Howard: set 7-Zip as default app for .zip (and .7z/.rar) via 7-Zip GUI (Tools → Options → System).
2. Upgrade LEGALASST to Windows 11 (expected to resolve the zip-handler hang; applies the pending SFC repair). Pre-reqs: enable fTPM + Secure Boot in BIOS (Ryzen 3 3200G is Win11-supported), bump RAM from 5.9 GB, remove the leftover Syncro agent. Test a local .zip with the built-in handler post-upgrade.
3. WordPerfect 5 "not enough free space" on save — investigate. Leading hypothesis: legacy/DOS-era WordPerfect free-space miscalculation on large-capacity volumes (free-space value overflows → false "disk full"). This is app-level and will not be fixed by the OS upgrade; mitigate via DOSBox or directing saves to a SUBST'd small-capacity location. Confirm exact WP version/edition (DOS 5.1 vs Windows).
4. If the zip hang persists after the Win11 upgrade: next lead is Defender archive-scan + cloud (MAPS) lookup stalling the shell when the built-in handler streams zip entries.
5. Standing P1s (pre-existing): reboot to apply SFC repair; remove prior MSP agents.

Reference Information

• GuruRMM agent id: 18825ea7-df58-47bb-b492-822cb16fb5ec (LEGALASST).
• Rednour tenant: rednourlaw.com (4a4ca18a-f516-478b-99da-2e0722c5dc18); Syncro customer 1224246.
• Wiki: wiki/clients/rednour.md. Refresh: /wiki-compile client:rednour --full.
• Reversible shell-ext disable mechanism: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked (add CLSID value to block; delete to restore).