hairygeek

Word 2016 SHELL32.DLL, COMBASE.DLL crash on startup

Recommended Posts

Hello,

I've been having some issues with Office 365 lately. Basically, Word and Excel would hang randomly at the "Starting up" screen when opening a file. The workaround was to force end the WINWORD or EXCEL process and reopen the file.

After a few months of trial-and-error, I came across a forum post stating that ... MalwareBytes was causing the issue.

So I reinstalled my PC completely and replaced ESET and Malwarebytes with the Emsisoft Antimalware trial version.

I am now facing another issue, this time with Word 2016 only.

When I open a DOCX file (whatever the file is), Word starts, then the popup "Word has stopped working" appears immediately, but randomly.

The faulting module is either SHELL32.DLL (with 32 bits Office) or COMBASE.DLL (with 64 bits Office), with the 0xc0000005 error.

I have no other security software installed, no additionnal add-in in Word or buggy Shell Extensions.

Is there something I can do ?

Thanks !

Share this post


Link to post
Share on other sites

We are currently aware of an issue where our products are making certain versions of Microsoft Word crash. Currently the only workaround is to exclude winword.exe in Emsisoft Anti-Malware. We hope to have a beta update available soon to address this issue.

Here's how to exclude files from Emsisoft Anti-Malware:

Here are instructions on excluding a process from scanning and monitoring:

  1. Open Emsisoft Anti-Malware.
  2. Click on Settings in the menu at the top.
  3. Click on Exclusions in the menu at the top.
  4. To the right of the list to Exclude from scanning, click on the Add file button.
  5. Navigate to the file you would like to exclude, click on it once to select it, and then click Open.
  6. To the right of the list to Exclude from monitoring, click on the Add file button.
  7. Navigate to the file you would like to exclude, click on it once to select it, and then click Open.
  8. Close Emsisoft Anti-Malware.


Note: If a program you have excluded is running, then you will need to close it and reopen it for the exclusion to take effect. In some cases you will need to restart your computer before this will happen.

 

You can find the winword.exe file in one of the following locations (note that "Office14" is Microsoft Office 2010, and the number will be different for different versions of Office):

  • C:\Program Files (x86)\Microsoft Office\Office14\
  • C:\Program Files\Microsoft Office\Office14\

Share this post


Link to post
Share on other sites

No, any script that executes in Microsoft Word will need to download and execute the ransomware itself, and our Behavior Blocker will catch the ransomware.

Also, be sure to keep macros disabled in Word, and don't turn them back on even if a document asks you to. Trojans in Word documents will usually have something in them that looks like an error or warning message telling you to turn macros on, and when you do so that's when the malicious code runs.

Share this post


Link to post
Share on other sites
17 hours ago, hairygeek said:

I'll setup this workaround until a solution is found.

Just as a note, disabling macros in Word was Microsoft resolution to macro based malware in Word documents. It's not a great solution, but I have a feeling that they couldn't remove the more dangerous functions because some businesses relied on those features.

Share this post


Link to post
Share on other sites

OK. Hopefully we will be able to publish a beta update soon with a fix for this.

Share this post


Link to post
Share on other sites

I recommend keeping an eye on our changeblog, or subscribing to the RSS feed, so that you can see when the next beta is available:

http://changeblog.emsisoft.com/

http://changeblog.emsisoft.com/feed/

Here's how to switch to the Beta update feed so that you can install the beta when it's ready:

  1. Open Emsisoft Anti-Malware.

  2. Click on Settings in the menu at the top.

  3. Click on Updates in the menu at the top.

  4. On the left, under Update Settings, click on the box to the right of Update feed and select Beta from the list.

  5. Click on the Update now button on the right side.

Share this post


Link to post
Share on other sites

Hello,

The crash occured again today, this time with EXCEL.EXE (faulting module SHELL32.DLL) and latest beta version 2017.5.0.7538 (beta channel) while opening a file from the Desktop.

However, no more issues with Word (WINWORD.EXE) so far.

So it seems that issues with Word are fixed but not Excel (I've re-added Excel.exe as an exception).

 

 

Share this post


Link to post
Share on other sites

The next time Microsoft Excel crashes, lets get a memory dump from it. We can use either Process Hacker or Process Explorer.

Basically, when Microsoft Excel crashes, leave the error message on the screen and open either Process Hacker or Process Explorer. Find EXCEL.EXE in the list (Process Hacker has a search field in the upper-right corner), right-click on EXCEL.EXE, and select to save a dump. If using Process Explorer, make sure to save a Full Dump. You will be asked where to save it to, so saving it somewhere easy to find (your desktop, documents, etc) is recommended. Once you have saved the dump, find the file you saved, right-click on it, go to Send to, and select Compressed (zipped) folder. This will ZIP the dump file, and then you can attach it to a reply here on the forums.

Share this post


Link to post
Share on other sites

Thanks for letting us know. If you can get us a crash dump, then we should be able to figure out why it's happening.

Share this post


Link to post
Share on other sites

Hello,

Today Word hangs when I tried to open a file. Here is the DMP log.

However it was not a "AppCrash" event but an "AppHang" event (during the opening of a DOCX file).

Share this post


Link to post
Share on other sites

Hello.

The Crash continues in EXCEL.EXE. I'll post a dump also.

Nom d’événement du problème :    APPCRASH
Nom de l’application:    EXCEL.EXE
Version de l’application:    16.0.8067.2115
Horodatage de l’application:    5918bd78
Nom du module par défaut:    SHELL32.dll
Version du module par défaut:    10.0.15063.332
Horodateur du module par défaut:    0f3aadef
Code de l’exception:    c0000005
Décalage de l’erreur:    0011ee0b
Version du système:    10.0.15063.2.0.0.256.48
Identificateur de paramètres régionaux:    1036

It seems to me that it appears after a database update.

Share this post


Link to post
Share on other sites
On 5/30/2017 at 7:32 AM, hairygeek said:

Today Word hangs when I tried to open a file. Here is the DMP log.

However it was not a "AppCrash" event but an "AppHang" event (during the opening of a DOCX file).

This hang wasn't related to Emsisoft Anti-Malware, or the issue that was causing the crashes.

 

2 hours ago, hairygeek said:

The Crash continues in EXCEL.EXE. I'll post a dump also.

OK. Our developers will be happy to take a look at a dump from the crash as soon as they can. ;)

Share this post


Link to post
Share on other sites

Hello,

Today Word crashed again with Shell32.dll. Unfortunately I didn't do a dump. It seems that the bug occurs when my computer is waken from sleep after a long time. I'll keep you updated, and sorry for the long followup.

Share this post


Link to post
Share on other sites

WINWORD_EXE.dmp.zip

Hello,

Today after having put the computer to sleep for 8 hours, the issue occured again in Word, on first launch after waking from sleep, by opening a file on the desktop, a simple DOCX file without any formatting or embedded content.

The crash dump is attached below, crashing module shell32.dll. This is the "original" bug, the bug I face since the beginning.

Excel crashes randomly the same way.

By the way I am sorry for the "trial and error" topic.;) I am no developper, but if Emsisoft Antimalware is not the cause, I'll be happy to know what it is (I'm also sorry for the bad english, I'm french :rolleyes:) GT500, thank you for your patience.

Share this post


Link to post
Share on other sites

I've forwarded your dump to our developers.

 

On 6/4/2017 at 5:20 PM, hairygeek said:

after having put the computer to sleep for 8 hours

Does it usually happen shortly after your computer has been in sleep mode, or is the timing random?

Share this post


Link to post
Share on other sites

That seems to be the very same dump file as before. Are you sure you uploaded a different dump? Same breakpoint in the same location (DWrite.dll, which is used for hardware accelerated graphics and font rendering).

Share this post


Link to post
Share on other sites

Fabian, I am sorry I don't know.

But anyway I have the latest crash dump, this time from EXCEL.EXE. Fresh out of the box :)

Same faulting module SHELL32.DLL, same file opened. I have also just woken up the computer from sleep before opening the file.

So I think WORD and EXCEL issues are the same. Here is the latest crash dump from Excel, and this one is correct.

(I have uploaded the file via uploadfiles.io as I haven't got enough storage from this topic).

https://ufile.io/hz67h

Share this post


Link to post
Share on other sites

The Excel crash isn't caused by EAM either. The crash occurs inside Direct2D which is essentially the DirectX acceleration layer for font and image rendering. That is also probably why the crash disappears when you disable hardware acceleration, which disables the usage of DirectX. You may want to update your graphics card driver and see if the problem still occurs. Having an excessive amount of font files or corrupted fonts installed can cause issues as well. So checking your installed fonts may be a good idea.

Share this post


Link to post
Share on other sites

Thanks a lot for the advice and analysis.

The crash wasn't obvious at all, and without the proper skills to decrypt the crash log, it would be very difficult to diagnose the issue with the basic informations provided by Windows.

Very good support from Emsisoft :)

I have a question out of curiosity : If the crash is related to DWrite, then why is "SHELL32.DLL" named as the crashing DLL ?

Thanks.

Share this post


Link to post
Share on other sites

Hello.

This is the latest dump for WINWORD.EXE, fresh from today.
Here, there is no crash, simply Word hanging on the startup screen. I was forced to kill Word with the task manager.

Just before this issue, I disabled the right click Emisisoft scan shell extension. That's the unique thing I didn't do before.
The hardware acceleration in Word and Excel is still disabled.
The issue occured once again after waking up the computer from sleep.
My graphic card drivers (HD Graphics 4000) are up to date.

I have had the same issue with Word (hanging on startup) and MalwareBytes, that's why I reformatted my computer and chose Emsisoft.

I'll add the "root" folder of Office installation to the Emisisoft exceptions and see if the crash happens too.

To sum up, we'll see if the crash happens again :
- With EAM shell extension disabled and,
- Word and Excel hardware acceleration disabled and,
- "root" folder of Office added to EAM realtime guard exceptions.

I'm sorry guys that's a lot of troubleshooting.

Share this post


Link to post
Share on other sites

None of these dumps show any of our code being active and involved at the time of the crash. Can you exclude your Office folder (C:\Program Files (x86)\Microsoft Office\root\Office16\) from monitoring under Settings/Exclusions? If the problem persists with such an exclusion in place, the problem is definitely not Emsisoft Anti-Malware, but something else that is wrong with your Office installation. In that case, I would suggest contacting the Microsoft support to figure out what exactly causes the problem. The original problem only affected the 64-bit version running on a 64-bit system. So you wouldn't have been affected by the original issue anyway as you are running the 32-bit version of Office.

Share this post


Link to post
Share on other sites

Thank you.

I've made the following exclusion on the : Settings, Exclusions, then "Exclude from monitoring" section :

C:\Program Files (x86)\Microsoft Office\root\Office16\*.*

I'll try to monitor the behaviour of Word and Excel for a few days, then post back with my observations.

 

Share this post


Link to post
Share on other sites

After reinstalling Emsisoft, without touching any parameter, I just had an Excel crash again today.

Adding an exception for Office folder helped again. So I think I'll have to live with it.

I don't understand why if Emsisoft software is not the cause of the crash, then why the issue doesn't occur when Emsisoft software is disabled or not installed.

Share this post


Link to post
Share on other sites

That is weird, yes. Especially since the entire company uses Office and EAM as well and not one of them has had any problems so far. Can you give me your exact Office version (365 or Retail) as well as your Windows version? I will try to reproduce the problem again.

Share this post


Link to post
Share on other sites

My Office version is : Microsoft Office 365 - Subscription (it was purchased via a "Student" discount on Microsoft Website).

Version 1705 (build 8201.2102 Office "Click to run")

Share this post


Link to post
Share on other sites

Curiosity Question.    What happens if instead of putting the computer to sleep, you turn shut it down and  turn off power.   I've never found putting a computer saved me much time.

 

Pete

Share this post


Link to post
Share on other sites

Hello

I prefer putting my computer to sleep :)

I have noticied that if I delete folder from exclusions, but tell the "File Guard" module not to scan .doc, .docx, .xls and .xlsx files, the crash doesn't occur again.

Share this post


Link to post
Share on other sites

Thanks, hairygeek. The only difference I can see between our setups and yours is that you use 365 instead of the retail version, which is based on some virtualisation solution. So the File Guard interfering would actually make sense, even though the crash is still not in our code, but triggered probably because the scan introduces some delays.

Share this post


Link to post
Share on other sites

Hello,

By the way, removing "doc", "docx", "xls" and "xlsx" from File Guard scanning extensions is not enough, the crash occurs again.

The only workaround available is to exclude Office "root\Office16" folder, as before.

Share this post


Link to post
Share on other sites

Thanks for this workaround Hairygeek. This problem bothered me for months exactly as you describe and I tried all solutions offered by Microsoft. However this did not solve the issue. The workaround works fine for the moment. I use Windows 10 Home on my Acer laptop Aspire 7750 and I have Intel Core i3 2330M. 4Gb DDR3 memory and I replaced the 500Gb HDD with Samsung 850 EVO SSD 250Gb.

As for Microsoft Office I have Microsoft Office 2016 - Home and Business NL licence.    

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.