[skrnn]

simsa,

Информация к размышлению

Блокировка.

0016d1c8 776c2b94 ole32!CCliModalLoop::BlockFn+0x39 [d:\w7rtm\com\ole32\com\dcomrem\callctrl.cxx @ 1122]
0016d1dc 776c2c1c ole32!CCliModalLoop::BlockFn+0x14f [d:\w7rtm\com\ole32\com\dcomrem\callctrl.cxx @ 1269]
0016d1ec 776c2c70 ole32!CCliModalLoop::~CCliModalLoop+0x10 [d:\w7rtm\com\ole32\com\dcomrem\callctrl.cxx @ 836]
0016d20c 776b6250 ole32!CoWaitForMultipleHandles+0x183 [d:\w7rtm\com\ole32\com\dcomrem\sync.cxx @ 119]
0016d248 776db8d4 ole32!CBindCtx::GetBindOptions+0x2d [d:\w7rtm\com\ole32\com\moniker2\cbindctx.cxx @ 241]


Мы видим зацикливание MSO!Ordinal

0016150c 38114002 MSO!Ordinal2897+0x101
00161510 3830a55c MSO!Ordinal9034+0x3e2
00161514 3830a810 MSO!Ordinal9034+0x696
00161518 3830a8f5 MSO!Ordinal9034+0x77b
0016151c 385ec879 MSO!Ordinal9179+0x684
00161520 383e3149 MSO!Ordinal483
00161524 00000000
00161548 38113630 MSO!Ordinal5546+0x496
0016154c 3830a55c MSO!Ordinal9034+0x3e2
00161550 3830a810 MSO!Ordinal9034+0x696
00161554 3830a8f5 MSO!Ordinal9034+0x77b
00161558 385ec879 MSO!Ordinal9179+0x684
0016155c 383e3149 MSO!Ordinal483
00161560 00000000
00161574 38113647 MSO!Ordinal5546+0x4ad
00161584 001615c0
00161588 3830a6b0 MSO!Ordinal9034+0x536
0016158c 3830a55c MSO!Ordinal9034+0x3e2
00161590 3830a810 MSO!Ordinal9034+0x696
00161594 3830a8f5 MSO!Ordinal9034+0x77b
00161598 385ec879 MSO!Ordinal9179+0x684
0016159c 383e3149 MSO!Ordinal483


Постоянно после MSO!Ordinal видим WARNING: Stack unwind information not available. Following frames may be wrong.
И только вверху после WWLIB видим такое же предупреждение.

. 0 Id: f6c.1b68 Suspend: 0 Teb: 7ffdf000 Unfrozen
# ChildEBP RetAddr Args to Child
00 00160528 77bb6a04 75e269dc 00000002 0016057c ntdll!KiFastSystemCallRet
01 0016052c 75e269dc 00000002 0016057c 00000001 ntdll!NtWaitForMultipleObjects+0xc
02 001605c8 77adbc8e 0016057c 001605f0 00000000 KERNELBASE!WaitForMultipleObjectsEx+0x100
03 00160610 77adbcfc 00000002 7ffdd000 00000000 kernel32!WaitForMultipleObjectsExImplementation+0xe0
04 0016062c 77aef165 00000002 00160660 00000000 kernel32!WaitForMultipleObjects+0x18
05 00160698 77aef202 00160778 00000001 00000001 kernel32!WerpReportFaultInternal+0x186
06 001606ac 77aeef30 00160778 00000001 00160748 kernel32!WerpReportFault+0x70
07 001606bc 77aeeeaa 00160778 00000001 5263cd9a kernel32!BasepReportFault+0x20
08 00160748 77be7f1a 00000000 77b8e304 00000000 kernel32!UnhandledExceptionFilter+0x1af
09 00160750 77b8e304 00000000 0016fe1c 77bc1278 ntdll!__RtlUserThreadStart+0x62
0a 00160764 77b8e18c 00000000 00000000 00000000 ntdll!_EH4_CallFilterFunc+0x12
0b 0016078c 77bb71b9 fffffffe 0016fe0c 00160898 ntdll!_except_handler4+0x8e
0c 001607b0 77bb718b 00160878 0016fe0c 00160898 ntdll!ExecuteHandler2+0x26
0d 001607d4 77b8f96f 00160878 0016fe0c 00160898 ntdll!ExecuteHandler+0x24
0e 00160860 77bb7017 01160878 00160898 00160878 ntdll!RtlDispatchException+0x127
0f 00160860 75e2b760 01160878 00160898 00160878 ntdll!KiUserExceptionDispatcher+0xf
10 00160bcc 6b07df60 e06d7363 00000001 00000003 KERNELBASE!RaiseException+0x58
11 00160c04 3197a5be 00160c14 3197a5c4 30cceed0 msvcr90!_CxxThrowException+0x48
WARNING: Stack unwind information not available. Following frames may be wrong.
12 00160c24 319798db 5277d67e 00000003 00000000 WWLIB!DllCanUnloadNow+0x8634
13 00160c4c 3197a62d 00160c68 5277d6b6 00000003 WWLIB!DllCanUnloadNow+0x7951
14 00160c84 30fbba71 80030009 65746938 00160ca8 WWLIB!DllCanUnloadNow+0x86a3
15 00160c94 31978b13 80030009 65746938 00000000 WWLIB!DllGetLCID+0x2ce07b
16 00160ca8 3131b7fc 00000000 0ef26cca 00000000 WWLIB!DllCanUnloadNow+0x6b89
17 00160cd8 30fdcc69 01c8ee50 0000000c 00000003 WWLIB!DllGetLCID+0x62de06
18 00163154 30e410c2 001646f0 00000006 00000001 WWLIB!DllGetLCID+0x2ef273
19 00164ac8 30e30d29 0000000c 00165668 00000001 WWLIB!DllGetLCID+0x1536cc
1a 001651b4 30e2823b 0000000c 0000000e 00165668 WWLIB!DllGetLCID+0x143333
1b 001651e0 30e1180b 0000000c 00168960 00100304 WWLIB!DllGetLCID+0x13a845
1c 00166c40 30e10dbe 00168960 03e6ae00 00166c9c WWLIB!DllGetLCID+0x123e15
1d 00166cb0 30e10c74 00168960 00000000 00166ea8 WWLIB!DllGetLCID+0x1233c8
1e 00166d48 30e128f9 00168960 00000000 00166ea8 WWLIB!DllGetLCID+0x12327e
1f 001672e0 30e3c0da 00168960 00000000 00167414 WWLIB!DllGetLCID+0x124f03
20 0016d160 30e39e3f 01ca5000 00000003 0016d254 WWLIB!DllGetLCID+0x14e6e4
21 0016d17c 310f3a87 01ca5000 00000003 0016d254 WWLIB!DllGetLCID+0x14c449
22 0016d308 310f386f 01ca5000 00000081 00000001 WWLIB!DllGetLCID+0x406091
23 0016d320 30d193cb 01ca5000 00000003 00000001 WWLIB!DllGetLCID+0x405e79
24 0016d7d8 30d1ab4f 01ca5000 00000001 00000003 WWLIB!DllGetLCID+0x2b9d5
25 0016d7f8 30d189f2 01ca5000 00000001 00000003 WWLIB!DllGetLCID+0x2d159
26 0016dacc 30bd8b7c 00000003 00000002 00000000 WWLIB!DllGetLCID+0x2affc
27 0016dae0 30bd8a64 319cf470 00000000 0014cdaa WWLIB!GetAllocCounters+0xe1db4
28 0016dafc 30b44efa 319cf470 000007dc 0014c5ce WWLIB!GetAllocCounters+0xe1c9c
29 0016db70 30b44667 76492b4d 319c96a0 00000000 WWLIB!GetAllocCounters+0x4e132
2a 0016db84 30b43169 00000000 0162008c 01620000 WWLIB!GetAllocCounters+0x4d89f
2b 0016dbac 30b413e6 30ae0000 77ae33d3 30ae50f7 WWLIB!GetAllocCounters+0x4c3a1
2c 0016fd1c 2fe51602 2fe50000 00000000 003223c1 WWLIB!GetAllocCounters+0x4a61e
2d 0016fd40 2fe5159a 2fe50000 00000000 003223c1 WINWORD+0x1602
2e 0016fdd0 77ae3c45 7ffdd000 0016fe1c 77bd37f5 WINWORD+0x159a
2f 0016fddc 77bd37f5 7ffdd000 77db3cfd 00000000 kernel32!BaseThreadInitThunk+0xe
30 0016fe1c 77bd37c8 2fe510ec 7ffdd000 ffffffff ntdll!__RtlUserThreadStart+0x70
31 0016fe34 00000000 2fe510ec 7ffdd000 00000000 ntdll!_RtlUserThreadStart+0x1b

1 Id: f6c.1130 Suspend: 1 Teb: 7ffdc000 Unfrozen
# ChildEBP RetAddr Args to Child
00 03cbf990 77bb6a04 77b9fe3b 00000003 0037ae10 ntdll!KiFastSystemCallRet
01 03cbf994 77b9fe3b 00000003 0037ae10 00000001 ntdll!NtWaitForMultipleObjects+0xc
02 03cbfb28 77ae3c45 00000000 03cbfb74 77bd37f5 ntdll!TppWaiterpThread+0x33d
03 03cbfb34 77bd37f5 0037ade0 74063995 00000000 kernel32!BaseThreadInitThunk+0xe
04 03cbfb74 77bd37c8 77b9fd0f 0037ade0 ffffffff ntdll!__RtlUserThreadStart+0x70
05 03cbfb8c 00000000 77b9fd0f 0037ade0 00000000 ntdll!_RtlUserThreadStart+0x1b

2 Id: f6c.18c4 Suspend: 1 Teb: 7ffd7000 Unfrozen
# ChildEBP RetAddr Args to Child
00 05cbfd70 77bb6a04 75e269dc 00000003 05cbfdc4 ntdll!KiFastSystemCallRet
01 05cbfd74 75e269dc 00000003 05cbfdc4 00000001 ntdll!NtWaitForMultipleObjects+0xc
02 05cbfe10 77adbc8e 05cbfdc4 05cbfe38 00000000 KERNELBASE!WaitForMultipleObjectsEx+0x100
03 05cbfe58 764962f9 00000003 7ffdd000 00000000 kernel32!WaitForMultipleObjectsExImplementation+0xe0
04 05cbfeac 764937f7 000003ac 0168bbe8 ffffffff user32!RealMsgWaitForMultipleObjectsEx+0x13c
05 05cbfec8 3811123c 00000002 0168bbe8 00000000 user32!MsgWaitForMultipleObjects+0x1f
WARNING: Stack unwind information not available. Following frames may be wrong.
06 05cbff6c 77ae3c45 0168b400 05cbffb8 77bd37f5 MSO!Ordinal1336+0x2cb
07 05cbff78 77bd37f5 0168b400 72063d59 00000000 kernel32!BaseThreadInitThunk+0xe
08 05cbffb8 77bd37c8 38111037 0168b400 ffffffff ntdll!__RtlUserThreadStart+0x70
09 05cbffd0 00000000 38111037 0168b400 00000000 ntdll!_RtlUserThreadStart+0x1b

3 Id: f6c.dfc Suspend: 1 Teb: 7ffd5000 Unfrozen
# ChildEBP RetAddr Args to Child
00 0662f7fc 77bb63a4 75e40647 000001c4 0662f868 ntdll!KiFastSystemCallRet
01 0662f800 75e40647 000001c4 0662f868 0662f844 ntdll!NtRemoveIoCompletion+0xc
02 0662f82c 3811c586 000001c4 0662f864 0662f868 KERNELBASE!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be wrong.
03 0662f870 38112ce6 00000000 38112ce6 0662f894 MSO!Ordinal2929+0xf3
04 0662f8c8 77ae3c45 01d607f0 0662f914 77bd37f5 MSO!Ordinal5551+0x8c
05 0662f8d4 77bd37f5 01d607f0 71af3bf5 00000000 kernel32!BaseThreadInitThunk+0xe
06 0662f914 77bd37c8 38112c8e 01d607f0 ffffffff ntdll!__RtlUserThreadStart+0x70
07 0662f92c 00000000 38112c8e 01d607f0 00000000 ntdll!_RtlUserThreadStart+0x1b

4 Id: f6c.dc8 Suspend: 1 Teb: 7ffd4000 Unfrozen
# ChildEBP RetAddr Args to Child
00 069df67c 77bb6a04 75e269dc 00000002 069df6d0 ntdll!KiFastSystemCallRet
01 069df680 75e269dc 00000002 069df6d0 00000001 ntdll!NtWaitForMultipleObjects+0xc
02 069df71c 77adbc8e 069df6d0 069df744 00000000 KERNELBASE!WaitForMultipleObjectsEx+0x100
03 069df764 764962f9 00000002 7ffdd000 00000000 kernel32!WaitForMultipleObjectsExImplementation+0xe0
04 069df7b8 764937f7 000005c8 069df818 ffffffff user32!RealMsgWaitForMultipleObjectsEx+0x13c
05 069df7d4 74727923 00000001 069df818 00000000 user32!MsgWaitForMultipleObjects+0x1f
06 069df820 74727842 00000000 00000000 00000000 GdiPlus!BackgroundThreadProc+0x59
07 069df838 77ae3c45 067b2218 069df884 77bd37f5 GdiPlus!DllRefCountSafeThreadThunk+0x10
08 069df844 77bd37f5 067b2218 71503a65 00000000 kernel32!BaseThreadInitThunk+0xe
09 069df884 77bd37c8 74727832 067b2218 ffffffff ntdll!__RtlUserThreadStart+0x70
0a 069df89c 00000000 74727832 067b2218 00000000 ntdll!_RtlUserThreadStart+0x1b

5 Id: f6c.1978 Suspend: 1 Teb: 7ffd3000 Unfrozen
# ChildEBP RetAddr Args to Child
00 08acfa44 77bb63a4 75e40647 000001c4 08acfab0 ntdll!KiFastSystemCallRet
01 08acfa48 75e40647 000001c4 08acfab0 08acfa8c ntdll!NtRemoveIoCompletion+0xc
02 08acfa74 3811c586 000001c4 08acfaac 08acfab0 KERNELBASE!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be wrong.
03 08acfab8 38112ce6 01d607f0 00000000 38112ce6 MSO!Ordinal2929+0xf3
04 08acfb14 77ae3c45 01d607f0 08acfb60 77bd37f5 MSO!Ordinal5551+0x8c
05 08acfb20 77bd37f5 01d607f0 7f613981 00000000 kernel32!BaseThreadInitThunk+0xe
06 08acfb60 77bd37c8 38112c8e 01d607f0 ffffffff ntdll!__RtlUserThreadStart+0x70
07 08acfb78 00000000 38112c8e 01d607f0 00000000 ntdll!_RtlUserThreadStart+0x1b

6 Id: f6c.1a7c Suspend: 1 Teb: 7ffde000 Unfrozen
# ChildEBP RetAddr Args to Child
00 08c5f7f8 764966c9 38515d4f 00000000 000002b4 ntdll!KiFastSystemCallRet
01 08c5f7fc 38515d4f 00000000 000002b4 00000000 user32!NtUserWaitMessage+0xc
WARNING: Stack unwind information not available. Following frames may be wrong.
02 08c5f85c 38515b9b 0003040a 000002b4 00000000 MSO!Ordinal8709+0xce8
03 08c5f870 77ae3c45 000002b4 08c5f8bc 77bd37f5 MSO!Ordinal8709+0xb34
04 08c5f87c 77bd37f5 000002b4 7f083a5d 00000000 kernel32!BaseThreadInitThunk+0xe
05 08c5f8bc 77bd37c8 38515b8a 000002b4 ffffffff ntdll!__RtlUserThreadStart+0x70
06 08c5f8d4 00000000 38515b8a 000002b4 00000000 ntdll!_RtlUserThreadStart+0x1b

7 Id: f6c.ea8 Suspend: 1 Teb: 7ffd6000 Unfrozen
# ChildEBP RetAddr Args to Child
00 0f22f9bc 77bb63a4 75e40647 000001c4 0f22fa28 ntdll!KiFastSystemCallRet
01 0f22f9c0 75e40647 000001c4 0f22fa28 0f22fa04 ntdll!NtRemoveIoCompletion+0xc
02 0f22f9ec 3811c586 000001c4 0f22fa24 0f22fa28 KERNELBASE!GetQueuedCompletionStatus+0x29
WARNING: Stack unwind information not available. Following frames may be wrong.
03 0f22fa30 38112ce6 00000000 38112ce6 0f22fa54 MSO!Ordinal2929+0xf3
04 0f22fa88 77ae3c45 01d607f0 0f22fad4 77bd37f5 MSO!Ordinal5551+0x8c
05 0f22fa94 77bd37f5 01d607f0 78ef3835 00000000 kernel32!BaseThreadInitThunk+0xe
06 0f22fad4 77bd37c8 38112c8e 01d607f0 ffffffff ntdll!__RtlUserThreadStart+0x70
07 0f22faec 00000000 38112c8e 01d607f0 00000000 ntdll!_RtlUserThreadStart+0x1b

8 Id: f6c.11e8 Suspend: 1 Teb: 7ffdb000 Unfrozen
# ChildEBP RetAddr Args to Child
00 094ef8bc 77bb6a34 77ba14df 0000020c 094ef974 ntdll!KiFastSystemCallRet
01 094ef8c0 77ba14df 0000020c 094ef974 7e8338c1 ntdll!ZwWaitForWorkViaWorkerFactory+0xc
02 094efa20 77ae3c45 00389370 094efa6c 77bd37f5 ntdll!TppWorkerThread+0x216
03 094efa2c 77bd37f5 00389370 7e83388d 00000000 kernel32!BaseThreadInitThunk+0xe
04 094efa6c 77bd37c8 77ba03e7 00389370 ffffffff ntdll!__RtlUserThreadStart+0x70
05 094efa84 00000000 77ba03e7 00389370 00000000 ntdll!_RtlUserThreadStart+0x1b


0:000> ~~[1b68]s;.frame 0n18;dv /t /v
eax=00000000 ebx=0016057c ecx=00000400 edx=00000000 esi=00000002 edi=00000000
eip=77bb70b4 esp=0016052c ebp=001605c8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
77bb70b4 c3 ret
12 00160c24 319798db WWLIB!DllCanUnloadNow+0x8634
Unable to enumerate locals, Win32 error 0n318
Private symbols (symbols.pri) are required for locals.

К сожалению дамп не выявил истинного виновника.
Вы пишите: После удаления word c помощью fix проблема с word исчезла но затем появилась вновь как флешка побывала в рабочем компе.
Вот это интересно. На эту флэшку Вы переносите файлы с другого компьютера?
Кроме того сообщаете, что Ваш диск перед зависанием забивается почти полностью.
Создайте 2 скриншота, один при нормальном состоянии, а другой перед зависанием и выявите, что же там записалось?

Скачайте с оф. сайта MBAM для проверки системы, а так же флэшки на вирусы.
При установке снимите флажок Включить пробную версию Malwarebytes (см. изображение ниже)