Win 7 and Office 2007 Lock Up

I have been running Windows 7 64bit Ultimate RTM, with Office 2007 for about 2 or 3 months. For the first two months or so it ran rock solid. Before that, even the Beta ran great. But over the last month or so it has been getting buggier and buggier. Primarily with the Office 2007 applications Outlook and Excel. I have had similar problems with Abobe Framemaker also.

When in Office or Excel, the application locks up. Task manager will start, but it will not kill the application. Other applications and the OS still run, but Office (or Framemaker as the case may be) is dead in the water. The only way to fix it is to hit the reset button. This is now happening 5 or 6 times a day. I have two RAID arrays on this machine, so boot time is considerable.

Has anybody else run into this problem?

System Specs
Tyan 5397 motherboard
2- Xenon 5272 dual core cpu's
16 Gig Ram
Nvidia GTX 280 GPU
Adaptec 5445 4-Drive 15K SAS Array
LSI 3000 4-Drive 15K SAS Array

If you go through this procedure to collect more info, it may be possible to explain the causes of the problem:

https://www.sevenforums.com/crash-loc...tml#post351755

I created a dump from an Outlook hanging, but the dump is 272meg, so I am not sure if it is going to upload. I zipped the file, but it is still 128 meg. Is there a way to make it smaller?

Hydrology said:

I created a dump from an Outlook hanging, but the dump is 272meg, so I am not sure if it is going to upload. I zipped the file, but it is still 128 meg. Is there a way to make it smaller?

Not using that particular info-gathering approach.

If your internet link doesn't exactly make it easy (or cheap) to transfer files of that size, I can suggest a way to strip out a summary (say 3MB) of the most important info, but you'll have to use a debugger to do it - not rocket science, but fiddly the first few times.

I can strip out the summary if you like, but I was able to upload the zip of the file to Rapidshare. The link is:

RapidShare: 1-CLICK Web hosting - Easy Filehosting

Let me know if this works for you.

Very interesting.

Short version: can you please test whether completely uninstalling your chosen anti-virus solution, if any, resolves this symptom. (I oughta have that line as my sig in this forum )


============================================

Detail: as big as that dump is, the problem is not actually in there, though there's enough info for educated guessing. Outlook is hung because its attempt to load a DLL is not being honoured by the kernel, for reasons which are not visible in the Outlook process address space (the dump). Here's the top of the relevant thread stack:

0:000:x86> kbna
# ChildEBP RetAddr Args to Child
00 003d38ac 7619dc73 003d3924 000f0005 00000000 ntdll_77c50000!NtCreateSection+0x12
01 003d3908 761a197d 00004298 00000000 00000000 KERNELBASE!CreateFileMappingW+0xe5
02 003d3ad8 761a1aed 003d3b24 003d3b1c 00000002 KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x475
03 003d3af8 761a1cc6 003d3b24 003d3b1c 00000002 KERNELBASE!BasepLoadLibraryAsDataFile+0x19
04 003d3b30 761993c3 003d3b5c 00000000 00000001 KERNELBASE!LoadLibraryExW+0x114
05 003d3d68 76199539 003d3dac 003d3eb4 00000001 KERNELBASE!ConvertTimeZoneMuiString+0xe4
06 003d3d8c 76199681 003d3da8 003d3eb4 003d3f08 KERNELBASE!ConvertTimeZoneMuiStrings+0x143
07 003d3e58 7619973f 003d3eb0 00000001 003d400c KERNELBASE!GetTimeZoneInformationRaw+0x8c
08 003d3e68 76199c8d 003d3eb0 003d403c 003d4120 KERNELBASE!GetTimeZoneInformation+0xf
09 003d400c 74bf669c 003d4040 003d402c 003d4110 KERNELBASE!SystemTimeToTzSpecificLocalTime+0x57

For some perfectly mundane reason, it needed to convert timezone info (it's a scheduling app after all!), and to do that it needs to "load" the DLL which contains the conversion code:

0:000:x86> du 003d3b5c
003d3b5c "C:\Windows\system32\tzres.dll"

"Time Zone... Resource"? Bob knows what the "res" stands for, but the TZ portion of the name is unmistakeable.

The act of "loading" a DLL entails creating a so-called "file mapping object" whereby the contents of the DLL are "mapped" into the (Outlook) address space, so that the functions therein can be called to do the work that's required.

The kernel calls that same construct a "section object", and the very last (topmost) function call on the stack is the syscall down (up!) into kernel-mode for the section object to be created. Obviously, that hasn't happened for some reason, and based on your observations it's unlikely to either, irrespective of how long you wait.

The next permutation of the problem description then becomes: "why is the kernel sometimes unable to create section objects?" The answer to that question is, by definition, to be found down in kernel-mode, and the most obvious and frequent cause is interference by some type of "security" inspection driver, hence the suggestion to try uninstalling the AV (disabling it is not a valid test).

Incidentally, this also goes a long way towards explaining the observed inability to "end task" the hung process. There's an outstanding kernel-mode call, so the act of terminating the Outlook process is not quite as simple as just shooting it in the head with the Task Manager's "end task" button. The kernel itself is now experiencing problems because of all this.

Several times I noticed that the hang occurred when I was trying to attach a file to an outlook email (which is the case for the dump I sent you), or opening a file in Excel. But I havent been keeping track of exactly when each freeze occurres. The Framemaker freeze generally occurrs when I have been away from the program for a while (but I have left it with an open file) and then I come back and it is frozen. It might be freezing when it is trying to do a timed backup.

Before the freeze that this dump represents, I had already removed the Zone Alarm program. I was beginning to think that that was the problem because it ran for half a day without freezing. But it eventually happend anyway.

I am using Symmantic Antivirus for Windows Small Business Server version 10.2. When I loaded the program I saw a warning whose text I cant quite remember, but it indicated that the program might not be compatible with Windows 7. The message was strong enough that I remember being surprised when the program seemed to work.

I will try removing it and see what happens.

It now seems to be stable, at least 2 days without a lockup which is pretty good. I will keep you posted.

That was it. It has been running stable eversince I removed Symantic antivirus.