Word Freezes Trying to Open Documents & Says "Running virus

bhaf · Guest

All of a sudden, my company is having a very strange problem with Microsoft
Word that prevents us from accessing most of our Word documents. As we have
many important documents in Word, this is a critical issue for us. The
problem is that when users try to open certain files, Word freezes with the
message "Running virus scan..." in the status bar. The user must use Task
Manager or click the "X" to close the window and choose "End Now" to
eventually exit Word.

The problem began with one user on 12/11/07, but since then several other
users have noticed the problem. (We have about 15 users total, and I don't
know about the other ones yet.) The problem doesn't happen on all files, but
it happens on a large majority of them. Some files are old (from 2006 and
earlier) and others were created in the last few days. We've had the problem
with files on the file server and with e-mail attachments. Although most
local files open without issue, if we move a problem file to a local drive,
we still can't open it.

It seems to be related to particular files so the problem occurs on
different workstations when trying to open a particular file. However, I am
able to open the "problem" files on one of my own two workstations without
trouble.

We are on a domain with a Windows Small Business Server 2003 domain
controller and a separate Windows Server 2003 file server. All workstations
are Windows XP SP2, and all are using Office 2003 SP3. All machines have most
of the latest updates, etc.

Some other facts:

- We do not use and have never used Norton Antivirus.

- We do not use EndNote.

- We've tried restarting our servers and workstations.

- We use NOD32 Antivirus. I completely disabled this on one of the
computers, but it still has the problem, and in fact, still says "Running
virus scan...".

- I've tried running a repair on Office on one of the comptuers, but this
did not resolve the issue.

- I've examined the various Windows and Office updates applied to my machine
that works versus the ones that are having problems. I haven't found anything
to this point that is unique to one or the other.

- The problem persists even when starting Word with "/safe" or "/a" switches.

- I've tried using Word "/unregserver" and "/regserver" switches to
re-register. This has had no effect.

- There is nothing in either of these directories:
C:\Program Files\Microsoft Office\Office11\STARTUP
C:\Documents and Settings\User_Name\Application Data\Microsoft\Word\STARTUP

- We've recreated Normal.dot for a couple of users, but the problem persists.

- We can open the documents using WordPad without any problems. If the
document is then saved from WordPad (in RTF format), we can then open the
document from Word.

The strangest part is how it just suddenly began to happen. We hadn't done
any kind of upgrades or made changes, and some of the workstations
(notebooks) had not been connected to the network in a while and did not get
the latest Windows updates from our server. Virus scans find nothing wrong
with any files, and no malware has been detected on the machines.

Does anybody out there have any ideas?

--
bhaf

Google · Sponsor

Terry Farrell · Guest

Word (Office) does NOT have any virus scanning ability. If you are suffering
that error message, then you MUST have a virus scanner that is causing the
problem. There just isn't any other explanation.

Have you ever had Norton AV installed?
--
Terry Farrell - MS Word MVP

"bhaf" <bhaf@discussions.microsoft.com> wrote in message
news:E272DFC6-4F9E-4612-B88C-853D5F973342@microsoft.com...

bhaf · Guest

No we have never had any Norton product installed on our systems. We did have
Symantec Antivirus Corporate Edition installed at one point, but this was
uninstalled back in June. Since then, we've been running NOD32 from ESET.
Other than daily threat definitions, this hasn't changed recently.

I disabled NOD32 as best I could from within the UI, removed it from
HKLM...Run registry key, and prevented the related service from starting all
of which made it appear to not be running. However, I'm going to try
completely uninstalling it from one of our spare machines when I have a
chance.

Thanks,

bhaf

"Terry Farrell" wrote:

Suzanne S. Barnhill · Guest

If Norton AV was installed at one time then the DLL for the Office
Plug-in could still be registered.

Search for : officeav.dll

If you find it then go to Start/Run and run the following command:

regsvr32 /u "<path>\officeav.dll"

Here is a KB article that provides a few additional details. It does
not include information on Norton CE but it will contain additional
details on the unregister command if you need them:
http://support.microsoft.com/?kbid=329820

--
Suzanne S. Barnhill
Microsoft MVP (Word)
Words into Type
Fairhope, Alabama USA

"bhaf" <bhaf@discussions.microsoft.com> wrote in message
news:AEAEE516-86B9-4D5C-957A-E9F202B67D81@microsoft.com...

bhaf · Guest

As I mentioned, we have never had any Norton product on any of our machines.
I did search for officeav.dll in case it was also used in the Symantec AV
product (which is much different than Norton AV), but this file was not found
anywhere on the computers.

I've got a call into our current AV vendor (ESET's NOD32) to see if they
know anything about this. I'm also trying to determine which computers have
problems and which don't to see if I can find differences between them.

bhaf

"Suzanne S. Barnhill" wrote:

Terry Farrell · Guest

Norton = Symantec. When Symantec purchased Norton and started screwing up
all their products, they decided to keep the Norton name on home products
because the home users had not heard of Symantec as it had always been a
corporate name. Basically, NAV and Symantec AV are the same product but
designed for a corporate networked environment with central management from
the server. The problem is that the .dll Suzanne mentioned is neither
uninstalled nor deregistered when Norton/Symantec is removed. It then comes
back to bite you at a later date by trying to run a virus scan in Office
even though it isn't installed.

Terry

"bhaf" <bhaf@discussions.microsoft.com> wrote in message
news:370C86D7-63C8-4D08-BD20-953F35EC911F@microsoft.com...

Beth Melton · Guest

If you've never had a version of Norton that uses the Office Plug-in then
another culprit is older add-ins placed in a Startup folder. These use a
..wll extension and the reason you are seeing "Running virus scan" is Word is
using the same engine as the third-party virus scanners to check for macros.
The only way to remove the behavior is to remove the add-ins.

If after checking both Startup folder, the one in the Office Bin and the one
for your Startup location for Word, then you should perform a search for the
DLL Suzanne cited. It's one of those things you should rule out just in
case. :-)

Please post all follow-up questions to the newsgroup. Requests for
assistance by email cannot be acknowledged.

~~~~~~~~~~~~~~~
Beth Melton
Microsoft Office MVP

Coauthor of Word 2007 Inside Out:
http://www.microsoft.com/MSPress/books/9801.aspx#AboutTheBook

Word FAQ: http://mvps.org/word
TechTrax eZine: http://mousetrax.com/techtrax/
MVP FAQ site: http://mvps.org/

"bhaf" <bhaf@discussions.microsoft.com> wrote in message
news:AEAEE516-86B9-4D5C-957A-E9F202B67D81@microsoft.com...

bhaf · Guest

I don't think it has anything to do with antivirus now, and here's why:

1) One of the first machines to have the problem is fairly new. In looking
back, I realized that this was purchased and set up several months after we
stopped using Symantec AV. Thus it had NOD32 from the very beginning.

2) I can find no trace of a file named officeav.dll either on the hard
drive or in the registry.

3) I just completely uninstalled our current AV software, NOD32, from one
of the machines, so this machine no longer has any active AV. Word still
freezes when trying to open a document on it, but it no longer displays
"Running virus scan..." in the status bar - the status bar just has the usual
"page", "sec", etc. I'm thinking that the virus scan message was just the
last thing it displayed before freezing but that it wasn't actually freezing
during the AV scan.

The other thing I've realized is that all of the problem machines are on the
LAN. I work at a remote location, and though I log on to the domain, I do so
via a VPN connection between routers. The other machine that I know so far
that works is another remote machine that is not connected to the domain at
all. So I'm looking into non-AV causes now.

Thanks,

bhaf

"Terry Farrell" wrote:

Suzanne S. Barnhill · Guest

Just so you understand: Word has no built-in ability to scan for viruses. If
you are getting this message, it is coming from a plug-in from some
anti-virus application.

--
Suzanne S. Barnhill
Microsoft MVP (Word)
Words into Type
Fairhope, Alabama USA

"bhaf" <bhaf@discussions.microsoft.com> wrote in message
news:D02B7553-CDB3-4FBC-BC7E-FE76048680AE@microsoft.com...

Terry Farrell · Guest

The three main problems stopping Word opening are a corrupt or incompatible
printer driver (Word MUST be able to see a printer driver to work), a
corrupt normal.dot or a bad or incompatible third party add-in.

You can check that Word itself is OK but starting Word in Safe Mode. From
Start Run (Winkey+R) type in

winword /a

and press enter. If Word starts OK, then it eliminates Word as a problem
pointing at the other possible problems that need investigating. See
http://word.mvps.org/FAQs/AppErrors/ProbsOpeningWord.htm for more
information.

Terry

"bhaf" <bhaf@discussions.microsoft.com> wrote in message
news:D02B7553-CDB3-4FBC-BC7E-FE76048680AE@microsoft.com...

bhaf · Guest

I'm posting again to update those who have been trying to help and point out
some info that I think was missed.

First of all, I no longer think it is related to antivirus software at all.
I uninstalled our current AV software, NOD32, from one of the machines, and
it no longer says "Running virus scan" when trying to open files. However, it
still freezes when trying to open the problem files.

At least one of the problem machines has never had any Norton or Symantec AV
product, and scanning the entire hard drive of a couple of the machines found
no files named officeav.dll or any files with the extension .wll. None of the
Word startup directories has anything in it at all. I've tried changing Macro
security settings, although we don't use any macros, and this hasn't had any
effect.

So I don't believe the AV software has anything to do with it. I think it
just happened to freeze when that message was displayed.

We don't have a problem opening Word itself. And we can open some files
without problems. But when the problem computers try to open one of the
problem files, the file never opens, the hourglass is shown in Word, and
nothing else happens. This happens whether or not Word was started using
/safe or /a switches, and it happens when holding the shift key down when
opening. It happens when opening from within Word (File>Open) or when
double-clicking a file in Explorer or an e-mail attachment.

On the one machine I've used for most testing and deleted the AV software
from, I've also uninstalled Office 2003 and then reinstalled it without
recent service packs and updates. It still has the problem.

I've also tried deleting the Normal.dot file, but that didn't have any
effect. I guess Word 2003 no longer automatically creates a new one, but I
went through the steps to create a new one (with different default font), and
I've tried copying the Normal.dot from one of the "good" computers, but the
problem persists.

I've shifted my focus to the Word documents to see if I can figure out what
is different about the files that have problems. I took one of the problem
files and deleted all text, headers, author, etc. and saved it so it appears
blank. But the file still had the problem. I've created some new files on
both good and bad computers, but these files all open without problems.

I must say this is about the most puzzling issue I can remember in my years
in IT. I appreciate the suggestions, but so far haven't found a resolution.

Thanks,

bhaf

Suzanne S. Barnhill · Guest

It sounds as if the problem files are almost certainly damaged. Have you
tried using Open and Repair on one of them? See also
http://word.mvps.org/FAQs/AppErrors/CorruptDoc.htm

--
Suzanne S. Barnhill
Microsoft MVP (Word)
Words into Type
Fairhope, Alabama USA

"bhaf" <bhaf@discussions.microsoft.com> wrote in message
news:139F0259-BBF1-4CFB-9AB8-9CD1140C6AF6@microsoft.com...

HairBeGone · Guest

"bhaf" wrote:

bhaf · Guest

Well, you're on to something, Suzanne. I opened one of the problem files on
one of the good computers, saved as HTML, then reopened and saved as regular
Word file per your link. I was then able to open the repaired file on a bad
computer.

I also tried restoring one of the bad files from a tape from a few weeks
ago, before any problems began. I thought maybe something corrupted the files
recently. But the restored file also had the problem.

As about 90% of files tested so far have the problem and we have about
10,000 Word docs on our network share, I still need to find some way around
this. I can't believe all of these files are actually corrupted, but there is
obviously something different about them since repairing solves the problem.
The only pattern I've seen in the computers that work vs. don't work is that
all of the ones on the LAN don't work but all remote or VPN computers do work.

My VPN connected computer uses the internal DNS server on the LAN, so I
don't think that's it. And both servers have been restarted this week.

Maybe the answer will come to me over the weekend. Anyway, thanks for your
suggestions. If you have any other ideas, I'll be anxious to hear them.

bhaf

"Suzanne S. Barnhill" wrote:

Suzanne S. Barnhill · Guest

You have my sympathies, but I have no further ideas. Sorry.

--
Suzanne S. Barnhill
Microsoft MVP (Word)
Words into Type
Fairhope, Alabama USA

"bhaf" <bhaf@discussions.microsoft.com> wrote in message
news:056ED972-67A4-49EB-90C7-D38B2AB644DC@microsoft.com...