Theoretical question, I'm just interested in how could this be done. I remember I had a virus on Windows7/8 (can't quite remember which one tho) which made Windows BSOD upon entry of a folder which had a file that the AV recognised as a virus. It made Windows BSOD when entering the folder using Windows Explorer and using cd in command line.
To my knowledge, in Windows XP you could change the extension of a file to ".folder" and Windows hides the extension and shows it as a folder, but I read that the "feature" got removed by Microsoft, since it was considered as a bug some exploits later. Tho I don't think this is the case, since I had this happen to me in Windows7/8.
My WinApi experience isn't vast, but I was thinking that maybe using some hacky API calls one could monitor where the user is navigating in cmd/explorer. Tho again, don't think this is the case (why would Microsoft give a developer such powers?).
So, any ideas?