Word Freezes Trying to Open Documents & Says "Running virus scan..

[bhaf]

All of a sudden, my company is having a very strange problem with Microsoft
Word that prevents us from accessing most of our Word documents. As we have
many important documents in Word, this is a critical issue for us. The
problem is that when users try to open certain files, Word freezes with the
message "Running virus scan..." in the status bar. The user must use Task
Manager or click the "X" to close the window and choose "End Now" to
eventually exit Word.

The problem began with one user on 12/11/07, but since then several other
users have noticed the problem. (We have about 15 users total, and I don't
know about the other ones yet.) The problem doesn't happen on all files, but
it happens on a large majority of them. Some files are old (from 2006 and
earlier) and others were created in the last few days. We've had the problem
with files on the file server and with e-mail attachments. Although most
local files open without issue, if we move a problem file to a local drive,
we still can't open it.

It seems to be related to particular files so the problem occurs on
different workstations when trying to open a particular file. However, I am
able to open the "problem" files on one of my own two workstations without
trouble.

We are on a domain with a Windows Small Business Server 2003 domain
controller and a separate Windows Server 2003 file server. All workstations
are Windows XP SP2, and all are using Office 2003 SP3. All machines have most
of the latest updates, etc.

Some other facts:

- We do not use and have never used Norton Antivirus.

- We do not use EndNote.

- We've tried restarting our servers and workstations.

- We use NOD32 Antivirus. I completely disabled this on one of the
computers, but it still has the problem, and in fact, still says "Running
virus scan...".

- I've tried running a repair on Office on one of the comptuers, but this
did not resolve the issue.

- I've examined the various Windows and Office updates applied to my machine
that works versus the ones that are having problems. I haven't found anything
to this point that is unique to one or the other.

- The problem persists even when starting Word with "/safe" or "/a" switches.

- I've tried using Word "/unregserver" and "/regserver" switches to
re-register. This has had no effect.

- There is nothing in either of these directories:
C:\Program Files\Microsoft Office\Office11\STARTUP
C:\Documents and Settings\User_Name\Application Data\Microsoft\Word\STARTUP

- We've recreated Normal.dot for a couple of users, but the problem persists.

- We can open the documents using WordPad without any problems. If the
document is then saved from WordPad (in RTF format), we can then open the
document from Word.

The strangest part is how it just suddenly began to happen. We hadn't done
any kind of upgrades or made changes, and some of the workstations
(notebooks) had not been connected to the network in a while and did not get
the latest Windows updates from our server. Virus scans find nothing wrong
with any files, and no malware has been detected on the machines.

Does anybody out there have any ideas?

 

[Terry Farrell]

Word (Office) does NOT have any virus scanning ability. If you are suffering
that error message, then you MUST have a virus scanner that is causing the
problem. There just isn't any other explanation.

Have you ever had Norton AV installed?

 

[bhaf]

No we have never had any Norton product installed on our systems. We did have
Symantec Antivirus Corporate Edition installed at one point, but this was
uninstalled back in June. Since then, we've been running NOD32 from ESET.
Other than daily threat definitions, this hasn't changed recently.

I disabled NOD32 as best I could from within the UI, removed it from
HKLM...Run registry key, and prevented the related service from starting all
of which made it appear to not be running. However, I'm going to try
completely uninstalling it from one of our spare machines when I have a
chance.

Thanks,

bhaf

 

[Suzanne S. Barnhill]

If Norton AV was installed at one time then the DLL for the Office
Plug-in could still be registered.

Search for : officeav.dll

If you find it then go to Start/Run and run the following command:

regsvr32 /u "<path>\officeav.dll"

Here is a KB article that provides a few additional details. It does
not include information on Norton CE but it will contain additional
details on the unregister command if you need them:
http://support.microsoft.com/?kbid=329820

 

[bhaf]

As I mentioned, we have never had any Norton product on any of our machines.
I did search for officeav.dll in case it was also used in the Symantec AV
product (which is much different than Norton AV), but this file was not found
anywhere on the computers.

I've got a call into our current AV vendor (ESET's NOD32) to see if they
know anything about this. I'm also trying to determine which computers have
problems and which don't to see if I can find differences between them.

bhaf

 

[Terry Farrell]

Norton = Symantec. When Symantec purchased Norton and started screwing up
all their products, they decided to keep the Norton name on home products
because the home users had not heard of Symantec as it had always been a
corporate name. Basically, NAV and Symantec AV are the same product but
designed for a corporate networked environment with central management from
the server. The problem is that the .dll Suzanne mentioned is neither
uninstalled nor deregistered when Norton/Symantec is removed. It then comes
back to bite you at a later date by trying to run a virus scan in Office
even though it isn't installed.

Terry

 

[Beth Melton]

If you've never had a version of Norton that uses the Office Plug-in then
another culprit is older add-ins placed in a Startup folder. These use a
..wll extension and the reason you are seeing "Running virus scan" is Word is
using the same engine as the third-party virus scanners to check for macros.
The only way to remove the behavior is to remove the add-ins.

If after checking both Startup folder, the one in the Office Bin and the one
for your Startup location for Word, then you should perform a search for the
DLL Suzanne cited. It's one of those things you should rule out just in
case.

Please post all follow-up questions to the newsgroup. Requests for
assistance by email cannot be acknowledged.

~~~~~~~~~~~~~~~
Beth Melton
Microsoft Office MVP

Coauthor of Word 2007 Inside Out:
http://www.microsoft.com/MSPress/books/9801.aspx#AboutTheBook

Word FAQ: http://mvps.org/word
TechTrax eZine: http://mousetrax.com/techtrax/
MVP FAQ site: http://mvps.org/

 

[bhaf]

I don't think it has anything to do with antivirus now, and here's why:

1) One of the first machines to have the problem is fairly new. In looking
back, I realized that this was purchased and set up several months after we
stopped using Symantec AV. Thus it had NOD32 from the very beginning.

2) I can find no trace of a file named officeav.dll either on the hard
drive or in the registry.

3) I just completely uninstalled our current AV software, NOD32, from one
of the machines, so this machine no longer has any active AV. Word still
freezes when trying to open a document on it, but it no longer displays
"Running virus scan..." in the status bar - the status bar just has the usual
"page", "sec", etc. I'm thinking that the virus scan message was just the
last thing it displayed before freezing but that it wasn't actually freezing
during the AV scan.

The other thing I've realized is that all of the problem machines are on the
LAN. I work at a remote location, and though I log on to the domain, I do so
via a VPN connection between routers. The other machine that I know so far
that works is another remote machine that is not connected to the domain at
all. So I'm looking into non-AV causes now.

Thanks,

bhaf

 

[Suzanne S. Barnhill]

Just so you understand: Word has no built-in ability to scan for viruses. If
you are getting this message, it is coming from a plug-in from some
anti-virus application.

 

[Terry Farrell]

The three main problems stopping Word opening are a corrupt or incompatible
printer driver (Word MUST be able to see a printer driver to work), a
corrupt normal.dot or a bad or incompatible third party add-in.

You can check that Word itself is OK but starting Word in Safe Mode. From
Start Run (Winkey+R) type in

winword /a

and press enter. If Word starts OK, then it eliminates Word as a problem
pointing at the other possible problems that need investigating. See
http://word.mvps.org/FAQs/AppErrors/ProbsOpeningWord.htm for more
information.

Terry

 

[bhaf]

I'm posting again to update those who have been trying to help and point out
some info that I think was missed.

First of all, I no longer think it is related to antivirus software at all.
I uninstalled our current AV software, NOD32, from one of the machines, and
it no longer says "Running virus scan" when trying to open files. However, it
still freezes when trying to open the problem files.

At least one of the problem machines has never had any Norton or Symantec AV
product, and scanning the entire hard drive of a couple of the machines found
no files named officeav.dll or any files with the extension .wll. None of the
Word startup directories has anything in it at all. I've tried changing Macro
security settings, although we don't use any macros, and this hasn't had any
effect.

So I don't believe the AV software has anything to do with it. I think it
just happened to freeze when that message was displayed.

We don't have a problem opening Word itself. And we can open some files
without problems. But when the problem computers try to open one of the
problem files, the file never opens, the hourglass is shown in Word, and
nothing else happens. This happens whether or not Word was started using
/safe or /a switches, and it happens when holding the shift key down when
opening. It happens when opening from within Word (File>Open) or when
double-clicking a file in Explorer or an e-mail attachment.

On the one machine I've used for most testing and deleted the AV software
from, I've also uninstalled Office 2003 and then reinstalled it without
recent service packs and updates. It still has the problem.

I've also tried deleting the Normal.dot file, but that didn't have any
effect. I guess Word 2003 no longer automatically creates a new one, but I
went through the steps to create a new one (with different default font), and
I've tried copying the Normal.dot from one of the "good" computers, but the
problem persists.

I've shifted my focus to the Word documents to see if I can figure out what
is different about the files that have problems. I took one of the problem
files and deleted all text, headers, author, etc. and saved it so it appears
blank. But the file still had the problem. I've created some new files on
both good and bad computers, but these files all open without problems.

I must say this is about the most puzzling issue I can remember in my years
in IT. I appreciate the suggestions, but so far haven't found a resolution.

Thanks,

bhaf

 

[Suzanne S. Barnhill]

It sounds as if the problem files are almost certainly damaged. Have you
tried using Open and Repair on one of them? See also
http://word.mvps.org/FAQs/AppErrors/CorruptDoc.htm

 

[HairBeGone]

All of a sudden, my company is having a very strange problem with Microsoft
Word that prevents us from accessing most of our Word documents. As we have
many important documents in Word, this is a critical issue for us. The
problem is that when users try to open certain files, Word freezes with the
message "Running virus scan..." in the status bar. The user must use Task
Manager or click the "X" to close the window and choose "End Now" to
eventually exit Word.

The problem began with one user on 12/11/07, but since then several other
users have noticed the problem. (We have about 15 users total, and I don't
know about the other ones yet.) The problem doesn't happen on all files, but
it happens on a large majority of them. Some files are old (from 2006 and
earlier) and others were created in the last few days. We've had the problem
with files on the file server and with e-mail attachments. Although most
local files open without issue, if we move a problem file to a local drive,
we still can't open it.

It seems to be related to particular files so the problem occurs on
different workstations when trying to open a particular file. However, I am
able to open the "problem" files on one of my own two workstations without
trouble.

We are on a domain with a Windows Small Business Server 2003 domain
controller and a separate Windows Server 2003 file server. All workstations
are Windows XP SP2, and all are using Office 2003 SP3. All machines have most
of the latest updates, etc.

Some other facts:

- We do not use and have never used Norton Antivirus.

- We do not use EndNote.

- We've tried restarting our servers and workstations.

- We use NOD32 Antivirus. I completely disabled this on one of the
computers, but it still has the problem, and in fact, still says "Running
virus scan...".

- I've tried running a repair on Office on one of the comptuers, but this
did not resolve the issue.

- I've examined the various Windows and Office updates applied to my machine
that works versus the ones that are having problems. I haven't found anything
to this point that is unique to one or the other.

- The problem persists even when starting Word with "/safe" or "/a" switches.

- I've tried using Word "/unregserver" and "/regserver" switches to
re-register. This has had no effect.

- There is nothing in either of these directories:
C:\Program Files\Microsoft Office\Office11\STARTUP
C:\Documents and Settings\User_Name\Application Data\Microsoft\Word\STARTUP

- We've recreated Normal.dot for a couple of users, but the problem persists.

- We can open the documents using WordPad without any problems. If the
document is then saved from WordPad (in RTF format), we can then open the
document from Word.

The strangest part is how it just suddenly began to happen. We hadn't done
any kind of upgrades or made changes, and some of the workstations
(notebooks) had not been connected to the network in a while and did not get
the latest Windows updates from our server. Virus scans find nothing wrong
with any files, and no malware has been detected on the machines.

Does anybody out there have any ideas?

 

[bhaf]

Well, you're on to something, Suzanne. I opened one of the problem files on
one of the good computers, saved as HTML, then reopened and saved as regular
Word file per your link. I was then able to open the repaired file on a bad
computer.

I also tried restoring one of the bad files from a tape from a few weeks
ago, before any problems began. I thought maybe something corrupted the files
recently. But the restored file also had the problem.

As about 90% of files tested so far have the problem and we have about
10,000 Word docs on our network share, I still need to find some way around
this. I can't believe all of these files are actually corrupted, but there is
obviously something different about them since repairing solves the problem.
The only pattern I've seen in the computers that work vs. don't work is that
all of the ones on the LAN don't work but all remote or VPN computers do work.

My VPN connected computer uses the internal DNS server on the LAN, so I
don't think that's it. And both servers have been restarted this week.

Maybe the answer will come to me over the weekend. Anyway, thanks for your
suggestions. If you have any other ideas, I'll be anxious to hear them.

bhaf

 

[Suzanne S. Barnhill]

You have my sympathies, but I have no further ideas. Sorry.

 

[bhaf]

I FIGURED IT OUT!

The problem Word documents reference a document template that was on one of
our old servers. (We migrated servers back in May.) I found the reference to
it in Tools>Templates and Add-Ins from the Word menu. The same template is
now available on our new server, and the path is the same except for the
server name. However, the old documents (and new ones created from them)
still point to the old server.

The old server is still hooked up because I use it to store some disk images
and such. The document template and folders referenced in the Word documents
are long gone however.

I haven't fully tested it, but this is what seems to have happened:

When the old server is completely powered down, there are no problems with
Word. Word must realize the server isn't connected and open the file anyway.

If the old server is turned on and fully functional, there are no problems
with Word. Word must see that the original template is no longer there and
open the file anyway.

The problem is that the old server went into some kind of in between state
on or around 12/6, a few days before we noticed the problems. I noticed this
when checking our WSUS console today and found the last contact with that
server was 12/6. I can ping the server and get a normal response, but I can't
get any other response from it and it appears to be hung.

I work remotely and everyone in that office is gone for the weekend, so I
can't restart the computer. But if I delete the document template reference
from a problem document (in Tools>Templates and Add-Ins) and save the
document, I can then open it without problems on one of the LAN computers.

Obviously, our remote computers can never connect to the servers anyway, so
Word can't find the server and opens the file for them. My domain computer
connected via VPN has full access to our network. But being on a different
subnet or maybe just because it's connected via WAN, it must behave
differently than those on the LAN, so it worked too. Only those computers on
the LAN had the problem because they thought the server was active but
probably never got a response from it.

I assume that on Monday when we either power off or restart the old server,
everything will work again. I'll repost if that is not the case.

Thanks for your help, and now I can really relax this weekend!

bhaf

 

[Suzanne S. Barnhill]

If I were more network-savvy, I might have been more helpful to begin with,
as this sort of problem is far from uncommon. Different versions of Word are
better or worse about giving up the hunt for a missing template; the more
places they have to look, of course, the longer it takes (if a system is not
connected to the network at all, naturally it doesn't take as long).

 

[Terry Farrell]

What you can do is get the system admin to add a Redirect command on the
server so that anyone opening a document that looks for the old template
will be redirected to its correct location. That will save having to do
anything to all those documents.

Please don't ask me how to create the redirect though: servers are not my
forte. But I know this works as we did this for several companies whose
servers we upgraded and had to change the name of the new servers.

Terry

 

[bhaf]

Thank you Terry and Suzanne for all of your efforts in helping with this
issue. I'm a one person IT department, so I'm also the SysAdmin that will
have to figure out the Redirect command (I'm not familiar with it). Actually,
I'm not sure yet what I'll do for the long term. For the moment, we shut down
the old server, and things are back to the way they were.

Thanks,

bhaf

 

[Alan Schmid]

I FIGURED IT OUT!

I too, figured it out. I wanted to post in this year-old thread just to make
sure people such as myself had a hard answer, in case theirs didn't involve
servers and templates.

Mine was an antivirus issue. There was a botched uninstall of AVG FREE (go
figure) and I didn't know it was botched until I tried to patch office. IE
crashed on install of the Office Genuine Validation Tool, and gave the
faulting module of avgoff2k.dll.

Listed in grisoft's technical (harrumph) support FAQ:

START/RUN
regsvr32 /u avgoff2k.dll
Click OK

after viewing this (and doing the actual command), VIOLA! Word opens
documents again, and the Normal.dot issue is resolved as well. Ooorah!

Thanks to all in this thread for thier hard work, regardless of it being
ages ago.