T
TheOne
I have a customer, whose computer can't start the print spooler
service on booting. It dies simply and if I start the service, for
some time it runs ok. However, it dies unexpectedly.
I found an ppt document which frequently kills the service when it's
printed using a usb printer.
I captured the event of spoolsv.exe using sysinternals procmon.exe,
but I couldn't decifer them, so I ask some help in interpreting the
events. Following is some part when debugger is started.
===+===+===
"276364","¿ÀÈÄ 5:29:56.6846179","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276365","¿ÀÈÄ
5:29:56.6846369","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276366","¿ÀÈÄ 5:29:56.6846514","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276367","¿ÀÈÄ
5:29:56.6846646","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276368","¿ÀÈÄ
5:29:56.6846844","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276369","¿ÀÈÄ 5:29:56.6847039","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276370","¿ÀÈÄ 5:29:56.6847185","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276371","¿ÀÈÄ
5:29:56.6847377","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276372","¿ÀÈÄ 5:29:56.6847523","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276373","¿ÀÈÄ
5:29:56.6847654","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276374","¿ÀÈÄ
5:29:56.6847852","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276375","¿ÀÈÄ 5:29:56.6848045","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276376","¿ÀÈÄ 5:29:56.6848185","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276377","¿ÀÈÄ
5:29:56.6848375","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276378","¿ÀÈÄ 5:29:56.6848520","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276379","¿ÀÈÄ
5:29:56.6848651","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276380","¿ÀÈÄ
5:29:56.6849107","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276381","¿ÀÈÄ 5:29:56.6849305","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276382","¿ÀÈÄ 5:29:56.6849450","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276383","¿ÀÈÄ
5:29:56.6849643","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276384","¿ÀÈÄ 5:29:56.6849788","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276385","¿ÀÈÄ
5:29:56.6849923","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276386","¿ÀÈÄ 5:29:56.6851258","spoolsv.exe","3772","RegCreateKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP
Officejet K7100 Series\PrinterDriverData","SUCCESS","Desired Access:
Read/Write"
"276387","¿ÀÈÄ
5:29:56.6851917","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Officejet K7100
Series\PrinterDriverData\InstallationComplete","SUCCESS","Type:
REG_DWORD, Length: 4, Data: 0"
"276388","¿ÀÈÄ 5:29:56.6852272","spoolsv.exe","3772","RegCloseKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP
Officejet K7100 Series\PrinterDriverData","SUCCESS",""
"276389","¿ÀÈÄ
5:29:56.6852875","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276390","¿ÀÈÄ 5:29:56.6853132","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276391","¿ÀÈÄ 5:29:56.6853311","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276392","¿ÀÈÄ
5:29:56.6853722","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276393","¿ÀÈÄ 5:29:56.6853906","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276394","¿ÀÈÄ
5:29:56.6854113","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276395","¿ÀÈÄ 5:29:56.6854303","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276396","¿ÀÈÄ
5:29:56.6854789","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276397","¿ÀÈÄ 5:29:56.6854996","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276398","¿ÀÈÄ 5:29:56.6855152","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276399","¿ÀÈÄ
5:29:56.6855485","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276400","¿ÀÈÄ 5:29:56.6855633","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276401","¿ÀÈÄ
5:29:56.6855772","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276402","¿ÀÈÄ 5:29:56.6855948","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276403","¿ÀÈÄ
5:29:56.6856560","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276404","¿ÀÈÄ 5:29:56.6856773","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276405","¿ÀÈÄ 5:29:56.6856926","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276406","¿ÀÈÄ
5:29:56.6857253","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276407","¿ÀÈÄ 5:29:56.6857401","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276408","¿ÀÈÄ
5:29:56.6857546","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276409","¿ÀÈÄ 5:29:56.6857725","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276410","¿ÀÈÄ
5:29:56.6858463","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276411","¿ÀÈÄ 5:29:56.6858675","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276412","¿ÀÈÄ 5:29:56.6858834","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276413","¿ÀÈÄ
5:29:56.6859178","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276414","¿ÀÈÄ 5:29:56.6859334","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276415","¿ÀÈÄ
5:29:56.6859477","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276416","¿ÀÈÄ 5:29:56.6859656","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276417","¿ÀÈÄ 5:29:56.6860709","spoolsv.exe","3772","RegOpenKey","HKLM
\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT
x86\Drivers\version-3\HP Officejet K7100 Series","SUCCESS","Desired
Access: Read"
"276418","¿ÀÈÄ
5:29:56.6861237","spoolsv.exe","3772","RegQueryValue","HKLM\System
\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers
\Version-3\HP Officejet K7100 Series\DEMFileName","NAME NOT
FOUND","Length: 144"
"276419","¿ÀÈÄ 5:29:56.6861505","spoolsv.exe","3772","RegCloseKey","HKLM
\System\CurrentControlSet\Control\Print\Environments\Windows NT
x86\Drivers\Version-3\HP Officejet K7100 Series","SUCCESS",""
"276420","¿ÀÈÄ
5:29:56.6861843","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276421","¿ÀÈÄ 5:29:56.6862080","spoolsv.exe","3772","RegCreateKey","HKCU
\Software\Hewlett-Packard\DEMFileData\HP Officejet K7100
Series","SUCCESS","Desired Access: Read"
"276422","¿ÀÈÄ
5:29:56.6862486","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276423","¿ÀÈÄ
5:29:56.6862687","spoolsv.exe","3772","RegQueryValue","HKCU\Software
\Hewlett-Packard\DEMFileData\HP Officejet K7100 Series\DEMFile","NAME
NOT FOUND","Length: 144"
"276424","¿ÀÈÄ 5:29:56.6862882","spoolsv.exe","3772","RegCloseKey","HKCU
\Software\Hewlett-Packard\DEMFileData\HP Officejet K7100
Series","SUCCESS",""
"276425","¿ÀÈÄ
5:29:56.6873772","spoolsv.exe","3772","QueryNameInformationFile","C:
\WINDOWS\system32\spool\drivers
\w32x86\3\hpoh7103.BUD","SUCCESS","Name: \WINDOWS\system32\spool
\drivers\w32x86\3\hpoh7103.BUD"
"276426","¿ÀÈÄ 5:29:56.6878778","spoolsv.exe","3772","CloseFile","C:
\WINDOWS\system32\spool\drivers\w32x86\3\hpoh7103.BUD","SUCCESS",""
"276428","¿ÀÈÄ 5:29:56.6881329","spoolsv.exe","3772","RegOpenKey","HKLM
\Software\Microsoft\Windows NT\CurrentVersion
\AeDebug","SUCCESS","Desired Access: Query Value"
"276429","¿ÀÈÄ
5:29:56.6881834","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto","SUCCESS","Type:
REG_SZ, Length: 4, Data: 1"
"276430","¿ÀÈÄ
5:29:56.6881982","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\AeDebug
\Debugger","SUCCESS","Type: REG_SZ, Length: 52, Data: drwtsn32 -p %ld -
e %ld -g"
"276431","¿ÀÈÄ 5:29:56.6882206","spoolsv.exe","3772","RegCloseKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug","SUCCESS",""
"276432","¿ÀÈÄ 5:29:56.6886081","spoolsv.exe","3772","QueryOpen","C:
\WINDOWS\system32\faultrep.dll","SUCCESS","CreationTime: 2004-08-04 ¿ÀÀü
12:53:14, LastAccessTime: 2008-08-19 ¿ÀÈÄ 5:25:21, LastWriteTime:
2004-08-04 ¿ÀÀü 12:53:14, ChangeTime: 2007-08-29 ¿ÀÈÄ 4:55:14,
AllocationSize: 81,920, EndOfFile: 79,872, FileAttributes: A"
"276434","¿ÀÈÄ 5:29:56.6929726","spoolsv.exe","3772","CreateFile","C:
\WINDOWS\system32\faultrep.dll","SUCCESS","Desired Access: Execute/
Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-
Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete,
AllocationSize: n/a, Impersonating: PARKJUYUN\Administrator,
OpenResult: Opened"
===+===+===
I guess it's indicating the spoolsv.exe is looking for the USB port
info but couldn't and dies. Is my guess right?
What can cause this?
TIA
service on booting. It dies simply and if I start the service, for
some time it runs ok. However, it dies unexpectedly.
I found an ppt document which frequently kills the service when it's
printed using a usb printer.
I captured the event of spoolsv.exe using sysinternals procmon.exe,
but I couldn't decifer them, so I ask some help in interpreting the
events. Following is some part when debugger is started.
===+===+===
"276364","¿ÀÈÄ 5:29:56.6846179","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276365","¿ÀÈÄ
5:29:56.6846369","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276366","¿ÀÈÄ 5:29:56.6846514","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276367","¿ÀÈÄ
5:29:56.6846646","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276368","¿ÀÈÄ
5:29:56.6846844","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276369","¿ÀÈÄ 5:29:56.6847039","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276370","¿ÀÈÄ 5:29:56.6847185","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276371","¿ÀÈÄ
5:29:56.6847377","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276372","¿ÀÈÄ 5:29:56.6847523","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276373","¿ÀÈÄ
5:29:56.6847654","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276374","¿ÀÈÄ
5:29:56.6847852","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276375","¿ÀÈÄ 5:29:56.6848045","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276376","¿ÀÈÄ 5:29:56.6848185","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276377","¿ÀÈÄ
5:29:56.6848375","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276378","¿ÀÈÄ 5:29:56.6848520","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276379","¿ÀÈÄ
5:29:56.6848651","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276380","¿ÀÈÄ
5:29:56.6849107","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276381","¿ÀÈÄ 5:29:56.6849305","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276382","¿ÀÈÄ 5:29:56.6849450","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276383","¿ÀÈÄ
5:29:56.6849643","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276384","¿ÀÈÄ 5:29:56.6849788","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276385","¿ÀÈÄ
5:29:56.6849923","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276386","¿ÀÈÄ 5:29:56.6851258","spoolsv.exe","3772","RegCreateKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP
Officejet K7100 Series\PrinterDriverData","SUCCESS","Desired Access:
Read/Write"
"276387","¿ÀÈÄ
5:29:56.6851917","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Officejet K7100
Series\PrinterDriverData\InstallationComplete","SUCCESS","Type:
REG_DWORD, Length: 4, Data: 0"
"276388","¿ÀÈÄ 5:29:56.6852272","spoolsv.exe","3772","RegCloseKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP
Officejet K7100 Series\PrinterDriverData","SUCCESS",""
"276389","¿ÀÈÄ
5:29:56.6852875","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276390","¿ÀÈÄ 5:29:56.6853132","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276391","¿ÀÈÄ 5:29:56.6853311","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276392","¿ÀÈÄ
5:29:56.6853722","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276393","¿ÀÈÄ 5:29:56.6853906","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276394","¿ÀÈÄ
5:29:56.6854113","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276395","¿ÀÈÄ 5:29:56.6854303","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276396","¿ÀÈÄ
5:29:56.6854789","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276397","¿ÀÈÄ 5:29:56.6854996","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276398","¿ÀÈÄ 5:29:56.6855152","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276399","¿ÀÈÄ
5:29:56.6855485","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276400","¿ÀÈÄ 5:29:56.6855633","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276401","¿ÀÈÄ
5:29:56.6855772","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276402","¿ÀÈÄ 5:29:56.6855948","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276403","¿ÀÈÄ
5:29:56.6856560","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276404","¿ÀÈÄ 5:29:56.6856773","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276405","¿ÀÈÄ 5:29:56.6856926","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276406","¿ÀÈÄ
5:29:56.6857253","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276407","¿ÀÈÄ 5:29:56.6857401","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276408","¿ÀÈÄ
5:29:56.6857546","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276409","¿ÀÈÄ 5:29:56.6857725","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276410","¿ÀÈÄ
5:29:56.6858463","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276411","¿ÀÈÄ 5:29:56.6858675","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276412","¿ÀÈÄ 5:29:56.6858834","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276413","¿ÀÈÄ
5:29:56.6859178","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276414","¿ÀÈÄ 5:29:56.6859334","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276415","¿ÀÈÄ
5:29:56.6859477","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276416","¿ÀÈÄ 5:29:56.6859656","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276417","¿ÀÈÄ 5:29:56.6860709","spoolsv.exe","3772","RegOpenKey","HKLM
\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT
x86\Drivers\version-3\HP Officejet K7100 Series","SUCCESS","Desired
Access: Read"
"276418","¿ÀÈÄ
5:29:56.6861237","spoolsv.exe","3772","RegQueryValue","HKLM\System
\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers
\Version-3\HP Officejet K7100 Series\DEMFileName","NAME NOT
FOUND","Length: 144"
"276419","¿ÀÈÄ 5:29:56.6861505","spoolsv.exe","3772","RegCloseKey","HKLM
\System\CurrentControlSet\Control\Print\Environments\Windows NT
x86\Drivers\Version-3\HP Officejet K7100 Series","SUCCESS",""
"276420","¿ÀÈÄ
5:29:56.6861843","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276421","¿ÀÈÄ 5:29:56.6862080","spoolsv.exe","3772","RegCreateKey","HKCU
\Software\Hewlett-Packard\DEMFileData\HP Officejet K7100
Series","SUCCESS","Desired Access: Read"
"276422","¿ÀÈÄ
5:29:56.6862486","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276423","¿ÀÈÄ
5:29:56.6862687","spoolsv.exe","3772","RegQueryValue","HKCU\Software
\Hewlett-Packard\DEMFileData\HP Officejet K7100 Series\DEMFile","NAME
NOT FOUND","Length: 144"
"276424","¿ÀÈÄ 5:29:56.6862882","spoolsv.exe","3772","RegCloseKey","HKCU
\Software\Hewlett-Packard\DEMFileData\HP Officejet K7100
Series","SUCCESS",""
"276425","¿ÀÈÄ
5:29:56.6873772","spoolsv.exe","3772","QueryNameInformationFile","C:
\WINDOWS\system32\spool\drivers
\w32x86\3\hpoh7103.BUD","SUCCESS","Name: \WINDOWS\system32\spool
\drivers\w32x86\3\hpoh7103.BUD"
"276426","¿ÀÈÄ 5:29:56.6878778","spoolsv.exe","3772","CloseFile","C:
\WINDOWS\system32\spool\drivers\w32x86\3\hpoh7103.BUD","SUCCESS",""
"276428","¿ÀÈÄ 5:29:56.6881329","spoolsv.exe","3772","RegOpenKey","HKLM
\Software\Microsoft\Windows NT\CurrentVersion
\AeDebug","SUCCESS","Desired Access: Query Value"
"276429","¿ÀÈÄ
5:29:56.6881834","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto","SUCCESS","Type:
REG_SZ, Length: 4, Data: 1"
"276430","¿ÀÈÄ
5:29:56.6881982","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\AeDebug
\Debugger","SUCCESS","Type: REG_SZ, Length: 52, Data: drwtsn32 -p %ld -
e %ld -g"
"276431","¿ÀÈÄ 5:29:56.6882206","spoolsv.exe","3772","RegCloseKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug","SUCCESS",""
"276432","¿ÀÈÄ 5:29:56.6886081","spoolsv.exe","3772","QueryOpen","C:
\WINDOWS\system32\faultrep.dll","SUCCESS","CreationTime: 2004-08-04 ¿ÀÀü
12:53:14, LastAccessTime: 2008-08-19 ¿ÀÈÄ 5:25:21, LastWriteTime:
2004-08-04 ¿ÀÀü 12:53:14, ChangeTime: 2007-08-29 ¿ÀÈÄ 4:55:14,
AllocationSize: 81,920, EndOfFile: 79,872, FileAttributes: A"
"276434","¿ÀÈÄ 5:29:56.6929726","spoolsv.exe","3772","CreateFile","C:
\WINDOWS\system32\faultrep.dll","SUCCESS","Desired Access: Execute/
Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-
Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete,
AllocationSize: n/a, Impersonating: PARKJUYUN\Administrator,
OpenResult: Opened"
===+===+===
I guess it's indicating the spoolsv.exe is looking for the USB port
info but couldn't and dies. Is my guess right?
What can cause this?
TIA