Case of the Excel Hang on Worksheet Open

Excel was hanging for a long time on a very simple spreadsheet, with no macros, no Office File Validation, and no crazy add-ons, whenever the “Header” worksheet was first activated.

image

 

Launching excel with ProcDump http://live.sysinternals.com/ProcDumpe.exe in hang mode, we captured a dump file.

image

In WinDbg looking at the stack trace we can see hang is occurring in module OART, which is OfficeArt module. This hints our image might be linked to the issue, we also see urlmon and winhttp waiting which hints at network traffic.

0:000> ~*k

.  0  Id: 23b8.1b94 Suspend: 0 Teb: 7ee2d000 Unfrozen
ChildEBP RetAddr 
00c6de64 75a91211 ntdll!NtDelayExecution+0xc
00c6decc 75a91176 KERNELBASE!SleepEx+0x8a
00c6dedc 0fd387f2 KERNELBASE!Sleep+0xf
WARNING: Stack unwind information not available. Following frames may be wrong.
00c6def4 0f9338a7 OART!Ordinal7761+0x6b9bd
00c6df50 0f933881 OART!Ordinal8884+0x4a
00c6df60 10140b40 OART!Ordinal8884+0x24
00c6dfa8 0fd371e6 OART!Ordinal4307+0x396
00c6dfd8 0f93d0aa OART!Ordinal7761+0x6a3b1
00c6e00c 0f93d067 OART!Ordinal8060+0x53
00c6e01c 0faac57e OART!Ordinal8060+0x10
00c6e064 0f9234f8 OART!Ordinal5748+0x92
00c6e0b4 0f923bb9 OART!Ordinal5496+0x280
00c6e170 0f9308d8 OART!Ordinal3146+0x254
00c6e27c 0f934d43 OART!Ordinal9814+0x4be
00c6e2d4 00ef138e OART!Ordinal1525+0x690
00c6e618 00ef4751 EXCEL!Ordinal43+0x24138e
00c6e6bc 00d2f295 EXCEL!Ordinal43+0x244751
00c6e86c 00d2ef4a EXCEL!Ordinal43+0x7f295
00c6e960 00d2e9cc EXCEL!Ordinal43+0x7ef4a
00c6eab0 00d2e58c EXCEL!Ordinal43+0x7e9cc
00c6ebe4 00d2de92 EXCEL!Ordinal43+0x7e58c
00c6ec68 69770c62 EXCEL!Ordinal43+0x7de92
00c6ed0c 696561ac MSO!Ordinal3226+0xa6f
00c6ed44 6965589b MSO!Ordinal3894+0x372
00c6ed88 6965573d MSO!Ordinal9043+0xcfb
00c6edb0 695ac834 MSO!Ordinal9043+0xb9d
00c6edb8 75417834 MSO!MsoGetHmodPTLServices+0x3b9
00c6ede4 75417a9a user32!_InternalCallWinProc+0x23
00c6ee74 7541988e user32!UserCallWinProcCheckWow+0x184
00c6eee0 754198f1 user32!DispatchMessageWorker+0x208
00c6eeec 00ce4ba2 user32!DispatchMessageW+0x10
00c6ef20 0185c48d EXCEL!Ordinal43+0x34ba2
00c6ef88 0175a45c EXCEL!LinkASPPModelTable+0x1fe9f3
00c6f31c 0175b81e EXCEL!LinkASPPModelTable+0xfc9c2
00c6f414 017339b1 EXCEL!LinkASPPModelTable+0xfdd84
00c6f69c 01734d46 EXCEL!LinkASPPModelTable+0xd5f17
00c6f714 01084c96 EXCEL!LinkASPPModelTable+0xd72ac
00c6f840 00cd1eee EXCEL!Ordinal43+0x3d4c96
00c6f940 75417834 EXCEL!Ordinal43+0x21eee
00c6f96c 75417a9a user32!_InternalCallWinProc+0x23
00c6f9fc 7541988e user32!UserCallWinProcCheckWow+0x184
00c6fa68 754198f1 user32!DispatchMessageWorker+0x208
00c6fa74 00ce4ba2 user32!DispatchMessageW+0x10
00c6fb74 00cb4d5f EXCEL!Ordinal43+0x34ba2
00c6fbfc 00cb4a68 EXCEL!Ordinal43+0x4d5f
00c6fc90 7717919f EXCEL!Ordinal43+0x4a68
00c6fc9c 7747a8cb kernel32!BaseThreadInitThunk+0xe
00c6fce0 7747a8a1 ntdll!__RtlUserThreadStart+0x20
00c6fcf0 00000000 ntdll!_RtlUserThreadStart+0x1b

   1  Id: 23b8.23d0 Suspend: 0 Teb: 7ee27000 Unfrozen
ChildEBP RetAddr 
04d0fc80 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
04d0fe04 77179188 KERNELBASE!WaitForMultipleObjectsEx+0xdc
04d0fe20 695b8db1 kernel32!WaitForMultipleObjects+0x19
WARNING: Stack unwind information not available. Following frames may be wrong.
04d0fe64 695b8c43 MSO!Ordinal970+0xb63
04d0fedc 695a7e43 MSO!Ordinal970+0x9f5
04d0fef0 7747a8cb MSO!Ordinal7766+0x72f
04d0ff34 7747a8a1 ntdll!__RtlUserThreadStart+0x20
04d0ff44 00000000 ntdll!_RtlUserThreadStart+0x1b

   2  Id: 23b8.27ac Suspend: 0 Teb: 7ecff000 Unfrozen
ChildEBP RetAddr 
04e6f6d0 774527d3 ntdll!NtWaitForWorkViaWorkerFactory+0xc
04e6f874 7717919f ntdll!TppWorkerThread+0x259
04e6f880 7747a8cb kernel32!BaseThreadInitThunk+0xe
04e6f8c4 7747a8a1 ntdll!__RtlUserThreadStart+0x20
04e6f8d4 00000000 ntdll!_RtlUserThreadStart+0x1b

   3  Id: 23b8.1fa8 Suspend: 0 Teb: 7ecfc000 Unfrozen
ChildEBP RetAddr 
04fafcc0 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
04fafe44 77179188 KERNELBASE!WaitForMultipleObjectsEx+0xdc
04fafe60 695bb446 kernel32!WaitForMultipleObjects+0x19
WARNING: Stack unwind information not available. Following frames may be wrong.
04faff74 695b7349 MSO!Ordinal7961+0xbc0
04faff88 7747a8cb MSO!Ordinal6778+0x301
04faffcc 7747a8a1 ntdll!__RtlUserThreadStart+0x20
04faffdc 00000000 ntdll!_RtlUserThreadStart+0x1b

   4  Id: 23b8.12a8 Suspend: 0 Teb: 7ecf9000 Unfrozen
ChildEBP RetAddr 
050efab0 774527d3 ntdll!NtWaitForWorkViaWorkerFactory+0xc
050efc54 7717919f ntdll!TppWorkerThread+0x259
050efc60 7747a8cb kernel32!BaseThreadInitThunk+0xe
050efca4 7747a8a1 ntdll!__RtlUserThreadStart+0x20
050efcb4 00000000 ntdll!_RtlUserThreadStart+0x1b

   5  Id: 23b8.b98 Suspend: 0 Teb: 7ecf6000 Unfrozen
ChildEBP RetAddr 
0523fbf0 75a910fd ntdll!NtWaitForSingleObject+0xc
0523fc60 695a52f5 KERNELBASE!WaitForSingleObjectEx+0x99
WARNING: Stack unwind information not available. Following frames may be wrong.
0523fc74 69c6cbb0 MSO!Ordinal3901+0x343
0523fc8c 00cc7c5a MSO!Ordinal7377+0x2c
0523fcac 00cc7034 EXCEL!Ordinal43+0x17c5a
0523fcb8 7717919f EXCEL!Ordinal43+0x17034
0523fcc4 7747a8cb kernel32!BaseThreadInitThunk+0xe
0523fd08 7747a8a1 ntdll!__RtlUserThreadStart+0x20
0523fd18 00000000 ntdll!_RtlUserThreadStart+0x1b

   6  Id: 23b8.1ce8 Suspend: 0 Teb: 7ecf3000 Unfrozen
ChildEBP RetAddr 
0537f9dc 75a910fd ntdll!NtWaitForSingleObject+0xc
0537fa4c 695a52f5 KERNELBASE!WaitForSingleObjectEx+0x99
WARNING: Stack unwind information not available. Following frames may be wrong.
0537fa60 69c6cbb0 MSO!Ordinal3901+0x343
0537fa78 00cc7c5a MSO!Ordinal7377+0x2c
0537fa98 00cc7034 EXCEL!Ordinal43+0x17c5a
0537faa4 7717919f EXCEL!Ordinal43+0x17034
0537fab0 7747a8cb kernel32!BaseThreadInitThunk+0xe
0537faf4 7747a8a1 ntdll!__RtlUserThreadStart+0x20
0537fb04 00000000 ntdll!_RtlUserThreadStart+0x1b

   7  Id: 23b8.848 Suspend: 0 Teb: 7ecf0000 Unfrozen
ChildEBP RetAddr 
05f3f4c4 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
05f3f648 695dc998 KERNELBASE!WaitForMultipleObjectsEx+0xdc
WARNING: Stack unwind information not available. Following frames may be wrong.
05f3f664 69648bf8 MSO!Ordinal2376+0x125
05f3f790 69648a2b MSO!Ordinal208+0x1c6
05f3f7b0 6963fa6b MSO!Ordinal2847+0x3db
05f3f93c 6963f5e7 MSO!Ordinal1557+0x8fe
05f3f98c 6963f07f MSO!Ordinal1557+0x47a
05f3f9c0 6963ef9b MSO!Ordinal2260+0x433
05f3f9cc 6959981f MSO!Ordinal2260+0x34f
05f3f9fc 6958b5f8 MSO!Ordinal1788+0x1ee
05f3fa14 695881b1 MSO!Ordinal4578+0xf6
05f3fa48 695868f1 MSO!Ordinal9805+0x2a0
05f3fa9c 7717919f MSO!Ordinal1981+0xb7b
05f3faa8 7747a8cb kernel32!BaseThreadInitThunk+0xe
05f3faec 7747a8a1 ntdll!__RtlUserThreadStart+0x20
05f3fafc 00000000 ntdll!_RtlUserThreadStart+0x1b

   8  Id: 23b8.124c Suspend: 0 Teb: 7eced000 Unfrozen
ChildEBP RetAddr 
0693f4cc 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
0693f650 77035fd0 KERNELBASE!WaitForMultipleObjectsEx+0xdc
0693f784 7703603e combase!WaitCoalesced+0x73 [d:\blue_gdr\com\published\comutils\coalescedwait.cxx @ 70]
0693f7ac 77036101 combase!CROIDTable::WorkerThreadLoop+0x4b [d:\blue_gdr\com\combase\dcomrem\refcache.cxx @ 1480]
0693f8d4 77036257 combase!CRpcThread::WorkerLoop+0x2e [d:\blue_gdr\com\combase\dcomrem\threads.cxx @ 264]
0693f8e4 7717919f combase!CRpcThreadCache::RpcWorkerThreadEntry+0x16 [d:\blue_gdr\com\combase\dcomrem\threads.cxx @ 67]
0693f8f0 7747a8cb kernel32!BaseThreadInitThunk+0xe
0693f934 7747a8a1 ntdll!__RtlUserThreadStart+0x20
0693f944 00000000 ntdll!_RtlUserThreadStart+0x1b

   9  Id: 23b8.17d0 Suspend: 0 Teb: 7ecea000 Unfrozen
ChildEBP RetAddr 
06a3a658 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
06a3a7dc 7541c2a0 KERNELBASE!WaitForMultipleObjectsEx+0xdc
06a3a834 7541be18 user32!MsgWaitForMultipleObjectsEx+0x159
06a3a850 70a16ba2 user32!MsgWaitForMultipleObjects+0x1f
06a3a89c 70a16b26 urlmon!CTransaction::CompleteOperation+0x6f [d:\blue_gdr\inetcore\urlmon\trans\transact.cxx @ 2496]
06a3ad40 70a028ff urlmon!CTransaction::StartEx+0xffb [d:\blue_gdr\inetcore\urlmon\trans\transact.cxx @ 4453]
06a3ae20 70a01f3b urlmon!CBinding::StartBinding+0x92b [d:\blue_gdr\inetcore\urlmon\trans\cbinding.cxx @ 2289]
06a3ae64 70a0299e urlmon!CUrlMon::StartBinding+0x314 [d:\blue_gdr\inetcore\urlmon\trans\urlmon.cxx @ 1056]
06a3ae88 14415040 urlmon!CUrlMon::BindToStorage+0x4d [d:\blue_gdr\inetcore\urlmon\trans\urlmon.cxx @ 921]
06a3aeb8 14414f86 hlink!HrUrlmonBindToStorage+0x73
06a3aef4 14419eb7 hlink!HrResolveMonikerForData+0x172
06a3af0c 69bb217f hlink!HlinkResolveMonikerForData+0x29
WARNING: Stack unwind information not available. Following frames may be wrong.
06a3af48 69eb7620 MSO!Ordinal3677+0xc7c
06a3af90 69bb18fd MSO!Ordinal4502+0x1ae2a5
06a3afbc 69da3fb2 MSO!Ordinal3677+0x3fa
06a3c084 6a583550 MSO!Ordinal4502+0x9ac37
06a3c0c8 6a087fa4 MSO!Ordinal458+0x2bcd
06a3c344 1014af44 MSO!Ordinal670+0x13a
06a3c374 1014b975 OART!Ordinal6481+0xa0
06a3d3f4 1014ba40 OART!Ordinal11273+0xda
06a3f4e0 1014b7d3 OART!Ordinal3684+0x66
06a3f52c 0fd385de OART!Ordinal709+0x44
06a3f580 0fb1d456 OART!Ordinal7761+0x6b7a9
06a3f674 0fb1d349 OART!Ordinal9957+0xbd
06a3f6c4 0fc4f159 OART!Ordinal2726+0x1ff
06a3f728 1014bdad OART!Ordinal4876+0x1be1
06a3f744 1018e7d3 OART!Ordinal2361+0x31
06a3f784 1018edf4 OART!Ordinal10358+0x1b45
06a3f794 695f9cf4 OART!Ordinal10358+0x2166
06a3f7ac 6959981f MSO!Ordinal4294+0x24b
06a3f7dc 6958b5f8 MSO!Ordinal1788+0x1ee
06a3f7f4 695881b1 MSO!Ordinal4578+0xf6
06a3f828 695868f1 MSO!Ordinal9805+0x2a0
06a3f880 7717919f MSO!Ordinal1981+0xb7b
06a3f88c 7747a8cb kernel32!BaseThreadInitThunk+0xe
06a3f8d0 7747a8a1 ntdll!__RtlUserThreadStart+0x20
06a3f8e0 00000000 ntdll!_RtlUserThreadStart+0x1b

  10  Id: 23b8.25a8 Suspend: 0 Teb: 7ece7000 Unfrozen
ChildEBP RetAddr 
06b3fb30 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
06b3fcb4 7541c2a0 KERNELBASE!WaitForMultipleObjectsEx+0xdc
06b3fd0c 7541be18 user32!MsgWaitForMultipleObjectsEx+0x159
06b3fd28 6958683d user32!MsgWaitForMultipleObjects+0x1f
WARNING: Stack unwind information not available. Following frames may be wrong.
06b3fdc8 7717919f MSO!Ordinal1981+0xac7
06b3fdd4 7747a8cb kernel32!BaseThreadInitThunk+0xe
06b3fe18 7747a8a1 ntdll!__RtlUserThreadStart+0x20
06b3fe28 00000000 ntdll!_RtlUserThreadStart+0x1b

  11  Id: 23b8.10a4 Suspend: 0 Teb: 7ece4000 Unfrozen
ChildEBP RetAddr 
06c3fd40 75ad0dc0 ntdll!NtRemoveIoCompletion+0xc
06c3fd74 69588135 KERNELBASE!GetQueuedCompletionStatus+0x44
WARNING: Stack unwind information not available. Following frames may be wrong.
06c3fdb8 695868f1 MSO!Ordinal9805+0x224
06c3fe10 7717919f MSO!Ordinal1981+0xb7b
06c3fe1c 7747a8cb kernel32!BaseThreadInitThunk+0xe
06c3fe60 7747a8a1 ntdll!__RtlUserThreadStart+0x20
06c3fe70 00000000 ntdll!_RtlUserThreadStart+0x1b

  12  Id: 23b8.2438 Suspend: 0 Teb: 7ece1000 Unfrozen
ChildEBP RetAddr 
0bb8f850 75ad0dc0 ntdll!NtRemoveIoCompletion+0xc
0bb8f884 69588135 KERNELBASE!GetQueuedCompletionStatus+0x44
WARNING: Stack unwind information not available. Following frames may be wrong.
0bb8f8c8 695868f1 MSO!Ordinal9805+0x224
0bb8f920 7717919f MSO!Ordinal1981+0xb7b
0bb8f92c 7747a8cb kernel32!BaseThreadInitThunk+0xe
0bb8f970 7747a8a1 ntdll!__RtlUserThreadStart+0x20
0bb8f980 00000000 ntdll!_RtlUserThreadStart+0x1b

  13  Id: 23b8.e08 Suspend: 0 Teb: 7ecde000 Unfrozen
ChildEBP RetAddr 
0bccfbf8 75ad0dc0 ntdll!NtRemoveIoCompletion+0xc
0bccfc2c 69588135 KERNELBASE!GetQueuedCompletionStatus+0x44
WARNING: Stack unwind information not available. Following frames may be wrong.
0bccfc70 695868f1 MSO!Ordinal9805+0x224
0bccfcc8 7717919f MSO!Ordinal1981+0xb7b
0bccfcd4 7747a8cb kernel32!BaseThreadInitThunk+0xe
0bccfd18 7747a8a1 ntdll!__RtlUserThreadStart+0x20
0bccfd28 00000000 ntdll!_RtlUserThreadStart+0x1b

  14  Id: 23b8.2258 Suspend: 0 Teb: 7ecd8000 Unfrozen
ChildEBP RetAddr 
0e34fd44 774527d3 ntdll!NtWaitForWorkViaWorkerFactory+0xc
0e34fee8 7717919f ntdll!TppWorkerThread+0x259
0e34fef4 7747a8cb kernel32!BaseThreadInitThunk+0xe
0e34ff38 7747a8a1 ntdll!__RtlUserThreadStart+0x20
0e34ff48 00000000 ntdll!_RtlUserThreadStart+0x1b

  15  Id: 23b8.25a4 Suspend: 0 Teb: 7ecd5000 Unfrozen
ChildEBP RetAddr 
0eccfc10 75ad0dc0 ntdll!NtRemoveIoCompletion+0xc
0eccfc44 69588135 KERNELBASE!GetQueuedCompletionStatus+0x44
WARNING: Stack unwind information not available. Following frames may be wrong.
0eccfc88 695868f1 MSO!Ordinal9805+0x224
0eccfce0 7717919f MSO!Ordinal1981+0xb7b
0eccfcec 7747a8cb kernel32!BaseThreadInitThunk+0xe
0eccfd30 7747a8a1 ntdll!__RtlUserThreadStart+0x20
0eccfd40 00000000 ntdll!_RtlUserThreadStart+0x1b

  16  Id: 23b8.2220 Suspend: 0 Teb: 7ecd2000 Unfrozen
ChildEBP RetAddr 
11d8fbf8 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
11d8fd7c 7541c2a0 KERNELBASE!WaitForMultipleObjectsEx+0xdc
11d8fdd4 695da6dd user32!MsgWaitForMultipleObjectsEx+0x159
WARNING: Stack unwind information not available. Following frames may be wrong.
11d8fdf4 695da363 MSO!Ordinal1520+0x2d
11d8fe1c 6a4723c1 MSO!Ordinal2954+0x2c
11d8feb8 7717919f MSO!Ordinal3863+0x573a
11d8fec4 7747a8cb kernel32!BaseThreadInitThunk+0xe
11d8ff08 7747a8a1 ntdll!__RtlUserThreadStart+0x20
11d8ff18 00000000 ntdll!_RtlUserThreadStart+0x1b

  17  Id: 23b8.2648 Suspend: 0 Teb: 7ecbf000 Unfrozen
ChildEBP RetAddr 
128cf560 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
128cf6e4 7541c2a0 KERNELBASE!WaitForMultipleObjectsEx+0xdc
128cf73c 7541be18 user32!MsgWaitForMultipleObjectsEx+0x159
128cf758 711c812c user32!MsgWaitForMultipleObjects+0x1f
128cf7c8 711c82c5 uxtheme!CManagerImpl::_RunDelegateThread+0xb4
128cf7d4 711c8251 uxtheme!CManagerImpl::_DelegateThreadProc+0x6b
128cf7dc 7717919f uxtheme!CManagerImpl::s_ThreadProc+0xd
128cf7e8 7747a8cb kernel32!BaseThreadInitThunk+0xe
128cf82c 7747a8a1 ntdll!__RtlUserThreadStart+0x20
128cf83c 00000000 ntdll!_RtlUserThreadStart+0x1b

  18  Id: 23b8.16ac Suspend: 0 Teb: 7ecbc000 Unfrozen
ChildEBP RetAddr 
13cdfa44 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
13cdfbc8 736869b5 KERNELBASE!WaitForMultipleObjectsEx+0xdc
13cdfc2c 7368690b clr!DebuggerRCThread::MainLoop+0x98
13cdfc5c 7368683a clr!DebuggerRCThread::ThreadProc+0xcb
13cdfc8c 7717919f clr!DebuggerRCThread::ThreadProcStatic+0xb9
13cdfc98 7747a8cb kernel32!BaseThreadInitThunk+0xe
13cdfcdc 7747a8a1 ntdll!__RtlUserThreadStart+0x20
13cdfcec 00000000 ntdll!_RtlUserThreadStart+0x1b

  19  Id: 23b8.25a0 Suspend: 0 Teb: 7ecb9000 Unfrozen
ChildEBP RetAddr 
143ff69c 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
143ff820 7361df8f KERNELBASE!WaitForMultipleObjectsEx+0xdc
143ff86c 73627db8 clr!WKS::WaitForFinalizerEvent+0xbe
143ff8b4 736657a1 clr!WKS::GCHeap::FinalizerThreadWorker+0x6e
143ff8c8 7366580f clr!ManagedThreadBase_DispatchInner+0x67
143ff96c 736658dc clr!ManagedThreadBase_DispatchMiddle+0x82
143ff9c8 7367990a clr!ManagedThreadBase_DispatchOuter+0x5b
143ffa44 7361814d clr!WKS::GCHeap::FinalizerThreadStart+0x198
143ffae0 7717919f clr!Thread::intermediateThreadProc+0x4d
143ffaec 7747a8cb kernel32!BaseThreadInitThunk+0xe
143ffb30 7747a8a1 ntdll!__RtlUserThreadStart+0x20
143ffb40 00000000 ntdll!_RtlUserThreadStart+0x1b

  20  Id: 23b8.258c Suspend: 0 Teb: 7ecb6000 Unfrozen
ChildEBP RetAddr 
1331f554 75a910fd ntdll!NtWaitForSingleObject+0xc
1331f5c4 7352202c KERNELBASE!WaitForSingleObjectEx+0x99
1331f5f4 73522073 clr!CLREventWaitHelper2+0x31
1331f644 73521fd7 clr!CLREventWaitHelper+0x2a
1331f67c 735a8861 clr!CLREventBase::WaitEx+0x152
1331f694 7369de7e clr!CLREventBase::Wait+0x1a
1331f744 7361814d clr!AppDomain::ADUnloadThreadStart+0x2a4
1331f860 7717919f clr!Thread::intermediateThreadProc+0x4d
1331f86c 7747a8cb kernel32!BaseThreadInitThunk+0xe
1331f8b0 7747a8a1 ntdll!__RtlUserThreadStart+0x20
1331f8c0 00000000 ntdll!_RtlUserThreadStart+0x1b

  21  Id: 23b8.2790 Suspend: 0 Teb: 7ecb3000 Unfrozen
ChildEBP RetAddr 
1676fcb8 774527d3 ntdll!NtWaitForWorkViaWorkerFactory+0xc
1676fe5c 7717919f ntdll!TppWorkerThread+0x259
1676fe68 7747a8cb kernel32!BaseThreadInitThunk+0xe
1676feac 7747a8a1 ntdll!__RtlUserThreadStart+0x20
1676febc 00000000 ntdll!_RtlUserThreadStart+0x1b

  22  Id: 23b8.25c4 Suspend: 0 Teb: 7ecdb000 Unfrozen
ChildEBP RetAddr 
16cafa74 75a91211 ntdll!NtDelayExecution+0xc
16cafadc 75a91176 KERNELBASE!SleepEx+0x8a
16cafaec 708c15e6 KERNELBASE!Sleep+0xf
16cafb0c 708c1620 winhttp!SafeTerminateDll+0xba
16cafb50 77455e0a winhttp!FailFastThreadpoolWaitCallback<&SafeTerminateDll>+0x2a
16cafb78 77455d96 ntdll!TppExecuteWaitCallback+0x63
16cafb94 77455ccc ntdll!TppWaitCompletion+0x76
16cafd34 7717919f ntdll!TppWorkerThread+0x4bf
16cafd40 7747a8cb kernel32!BaseThreadInitThunk+0xe
16cafd84 7747a8a1 ntdll!__RtlUserThreadStart+0x20
16cafd94 00000000 ntdll!_RtlUserThreadStart+0x1b

  23  Id: 23b8.1c04 Suspend: 0 Teb: 7ec3f000 Unfrozen
ChildEBP RetAddr 
16dafa64 774527d3 ntdll!NtWaitForWorkViaWorkerFactory+0xc
16dafc08 7717919f ntdll!TppWorkerThread+0x259
16dafc14 7747a8cb kernel32!BaseThreadInitThunk+0xe
16dafc58 7747a8a1 ntdll!__RtlUserThreadStart+0x20
16dafc68 00000000 ntdll!_RtlUserThreadStart+0x1b

  24  Id: 23b8.2298 Suspend: 0 Teb: 7ec3c000 Unfrozen
ChildEBP RetAddr 
0c86f688 75aa0ca9 ntdll!NtWaitForMultipleObjects+0xc
0c86f80c 752918a4 KERNELBASE!WaitForMultipleObjectsEx+0xdc
0c86f834 7717919f crypt32!ILS_WaitForThreadProc+0x26
0c86f840 7747a8cb kernel32!BaseThreadInitThunk+0xe
0c86f884 7747a8a1 ntdll!__RtlUserThreadStart+0x20
0c86f894 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000> lmv m OART
start    end        module name
0f890000 10639000   OART       (export symbols)       OART.DLL
    Loaded symbol image file: OART.DLL
    Image path: C:\program files (X86)\microsoft office\Office15\OART.DLL
    Image name: OART.DLL
    Timestamp:        Tue May 06 15:41:15 2014 (536875FB)
    CheckSum:         00DB5B99
    ImageSize:        00DA9000
    File version:     15.0.4621.1000
    Product version:  15.0.4621.0
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0000.04e4
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft Office 2013
    InternalName:     OART
    OriginalFilename: OART.DLL
    ProductVersion:   15.0.4621.1000
    FileVersion:      15.0.4621.1000
    FileDescription:  Microsoft OfficeArt

 

Using Fiddler ( http://www.telerik.com/fiddler ) and launching the Excel document, sure enough we see HTTP traffic at time of the hang, to a non-existent web server.

image

Note, from Excel there is no obvious way to see that the image is attempting to come from a URL, except we do see the same URL in the image description

image

Renaming the .XLSX to a ZIP file we extract the contents

Using a file content search utility, like SearchMyFiles (http://www.nirsoft.net/utils/search_my_files.html), we find the offending components

image

The external target is located here. We can also see why we still see the image despite the fact this URL no longer exists, once the HTTP request fails, it reverts to the ../media/image1.png file.

image

Just like the classic way to remove formatting with a copy/paste into/from notepad, we can copy/paste image into MSPaint, copy it from MSPaint paste it back into Excel

No more hangs…

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Excel, Office, WinDbg and tagged . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s