I fixed this in 4.2 but I don't run NT anymore. There is a TCL function (db_source_sql_file) that runs the plsql code with an @ sign. Use a redirect instead.
set fp [open "|[file join $env(ORACLE_HOME) bin sqlplus] $user_pass @$file" "r"]
set fp [open "|[file join $env(ORACLE_HOME) bin sqlplus] $user_pass <$file" "r"]
I may have used the cygwin sh to get this to work. I cannot remember