Print Spooler Service Dies

  • Thread starter Thread starter TheOne
  • Start date Start date
T

TheOne

I have a customer, whose computer can't start the print spooler
service on booting. It dies simply and if I start the service, for
some time it runs ok. However, it dies unexpectedly.

I found an ppt document which frequently kills the service when it's
printed using a usb printer.

I captured the event of spoolsv.exe using sysinternals procmon.exe,
but I couldn't decifer them, so I ask some help in interpreting the
events. Following is some part when debugger is started.

===+===+===
"276364","¿ÀÈÄ 5:29:56.6846179","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276365","¿ÀÈÄ
5:29:56.6846369","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276366","¿ÀÈÄ 5:29:56.6846514","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276367","¿ÀÈÄ
5:29:56.6846646","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276368","¿ÀÈÄ
5:29:56.6846844","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276369","¿ÀÈÄ 5:29:56.6847039","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276370","¿ÀÈÄ 5:29:56.6847185","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276371","¿ÀÈÄ
5:29:56.6847377","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276372","¿ÀÈÄ 5:29:56.6847523","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276373","¿ÀÈÄ
5:29:56.6847654","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276374","¿ÀÈÄ
5:29:56.6847852","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276375","¿ÀÈÄ 5:29:56.6848045","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276376","¿ÀÈÄ 5:29:56.6848185","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276377","¿ÀÈÄ
5:29:56.6848375","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276378","¿ÀÈÄ 5:29:56.6848520","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276379","¿ÀÈÄ
5:29:56.6848651","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276380","¿ÀÈÄ
5:29:56.6849107","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276381","¿ÀÈÄ 5:29:56.6849305","spoolsv.exe","3772","RegOpenKey","HKCU
\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT
FOUND","Desired Access: Read"
"276382","¿ÀÈÄ 5:29:56.6849450","spoolsv.exe","3772","RegOpenKey","HKCU
\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"276383","¿ÀÈÄ
5:29:56.6849643","spoolsv.exe","3772","RegQueryValue","HKCU\Control
Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"276384","¿ÀÈÄ 5:29:56.6849788","spoolsv.exe","3772","RegCloseKey","HKCU
\Control Panel\Desktop","SUCCESS",""
"276385","¿ÀÈÄ
5:29:56.6849923","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276386","¿ÀÈÄ 5:29:56.6851258","spoolsv.exe","3772","RegCreateKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP
Officejet K7100 Series\PrinterDriverData","SUCCESS","Desired Access:
Read/Write"
"276387","¿ÀÈÄ
5:29:56.6851917","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Officejet K7100
Series\PrinterDriverData\InstallationComplete","SUCCESS","Type:
REG_DWORD, Length: 4, Data: 0"
"276388","¿ÀÈÄ 5:29:56.6852272","spoolsv.exe","3772","RegCloseKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP
Officejet K7100 Series\PrinterDriverData","SUCCESS",""
"276389","¿ÀÈÄ
5:29:56.6852875","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276390","¿ÀÈÄ 5:29:56.6853132","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276391","¿ÀÈÄ 5:29:56.6853311","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276392","¿ÀÈÄ
5:29:56.6853722","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276393","¿ÀÈÄ 5:29:56.6853906","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276394","¿ÀÈÄ
5:29:56.6854113","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276395","¿ÀÈÄ 5:29:56.6854303","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276396","¿ÀÈÄ
5:29:56.6854789","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276397","¿ÀÈÄ 5:29:56.6854996","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276398","¿ÀÈÄ 5:29:56.6855152","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276399","¿ÀÈÄ
5:29:56.6855485","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276400","¿ÀÈÄ 5:29:56.6855633","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276401","¿ÀÈÄ
5:29:56.6855772","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276402","¿ÀÈÄ 5:29:56.6855948","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276403","¿ÀÈÄ
5:29:56.6856560","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276404","¿ÀÈÄ 5:29:56.6856773","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276405","¿ÀÈÄ 5:29:56.6856926","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276406","¿ÀÈÄ
5:29:56.6857253","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276407","¿ÀÈÄ 5:29:56.6857401","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276408","¿ÀÈÄ
5:29:56.6857546","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276409","¿ÀÈÄ 5:29:56.6857725","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276410","¿ÀÈÄ
5:29:56.6858463","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Read/Write"
"276411","¿ÀÈÄ 5:29:56.6858675","spoolsv.exe","3772","RegOpenKey","HKCU
\Printers\Connections\,,PARKJUYUN,USB001, Port","NAME NOT
FOUND","Desired Access: Read/Write"
"276412","¿ÀÈÄ 5:29:56.6858834","spoolsv.exe","3772","RegCreateKey","HKCU
\Printers\DevModePerUser","SUCCESS","Desired Access: Read/Write"
"276413","¿ÀÈÄ
5:29:56.6859178","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276414","¿ÀÈÄ 5:29:56.6859334","spoolsv.exe","3772","RegQueryKey","HKCU
\Printers\DevModePerUser","SUCCESS","Query: Cached, SubKeys: 0,
Values: 4"
"276415","¿ÀÈÄ
5:29:56.6859477","spoolsv.exe","3772","RegQueryValue","HKCU\Printers
\DevModePerUser\\\PARKJUYUN\USB001, Port","NAME NOT FOUND","Length:
144"
"276416","¿ÀÈÄ 5:29:56.6859656","spoolsv.exe","3772","RegCloseKey","HKCU
\Printers\DevModePerUser","SUCCESS",""
"276417","¿ÀÈÄ 5:29:56.6860709","spoolsv.exe","3772","RegOpenKey","HKLM
\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT
x86\Drivers\version-3\HP Officejet K7100 Series","SUCCESS","Desired
Access: Read"
"276418","¿ÀÈÄ
5:29:56.6861237","spoolsv.exe","3772","RegQueryValue","HKLM\System
\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers
\Version-3\HP Officejet K7100 Series\DEMFileName","NAME NOT
FOUND","Length: 144"
"276419","¿ÀÈÄ 5:29:56.6861505","spoolsv.exe","3772","RegCloseKey","HKLM
\System\CurrentControlSet\Control\Print\Environments\Windows NT
x86\Drivers\Version-3\HP Officejet K7100 Series","SUCCESS",""
"276420","¿ÀÈÄ
5:29:56.6861843","spoolsv.exe","3772","RegOpenKey","HKCU","SUCCESS","Desired
Access: Maximum Allowed"
"276421","¿ÀÈÄ 5:29:56.6862080","spoolsv.exe","3772","RegCreateKey","HKCU
\Software\Hewlett-Packard\DEMFileData\HP Officejet K7100
Series","SUCCESS","Desired Access: Read"
"276422","¿ÀÈÄ
5:29:56.6862486","spoolsv.exe","3772","RegCloseKey","HKCU","SUCCESS",""
"276423","¿ÀÈÄ
5:29:56.6862687","spoolsv.exe","3772","RegQueryValue","HKCU\Software
\Hewlett-Packard\DEMFileData\HP Officejet K7100 Series\DEMFile","NAME
NOT FOUND","Length: 144"
"276424","¿ÀÈÄ 5:29:56.6862882","spoolsv.exe","3772","RegCloseKey","HKCU
\Software\Hewlett-Packard\DEMFileData\HP Officejet K7100
Series","SUCCESS",""
"276425","¿ÀÈÄ
5:29:56.6873772","spoolsv.exe","3772","QueryNameInformationFile","C:
\WINDOWS\system32\spool\drivers
\w32x86\3\hpoh7103.BUD","SUCCESS","Name: \WINDOWS\system32\spool
\drivers\w32x86\3\hpoh7103.BUD"
"276426","¿ÀÈÄ 5:29:56.6878778","spoolsv.exe","3772","CloseFile","C:
\WINDOWS\system32\spool\drivers\w32x86\3\hpoh7103.BUD","SUCCESS",""
"276428","¿ÀÈÄ 5:29:56.6881329","spoolsv.exe","3772","RegOpenKey","HKLM
\Software\Microsoft\Windows NT\CurrentVersion
\AeDebug","SUCCESS","Desired Access: Query Value"
"276429","¿ÀÈÄ
5:29:56.6881834","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto","SUCCESS","Type:
REG_SZ, Length: 4, Data: 1"
"276430","¿ÀÈÄ
5:29:56.6881982","spoolsv.exe","3772","RegQueryValue","HKLM\SOFTWARE
\Microsoft\Windows NT\CurrentVersion\AeDebug
\Debugger","SUCCESS","Type: REG_SZ, Length: 52, Data: drwtsn32 -p %ld -
e %ld -g"
"276431","¿ÀÈÄ 5:29:56.6882206","spoolsv.exe","3772","RegCloseKey","HKLM
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug","SUCCESS",""
"276432","¿ÀÈÄ 5:29:56.6886081","spoolsv.exe","3772","QueryOpen","C:
\WINDOWS\system32\faultrep.dll","SUCCESS","CreationTime: 2004-08-04 ¿ÀÀü
12:53:14, LastAccessTime: 2008-08-19 ¿ÀÈÄ 5:25:21, LastWriteTime:
2004-08-04 ¿ÀÀü 12:53:14, ChangeTime: 2007-08-29 ¿ÀÈÄ 4:55:14,
AllocationSize: 81,920, EndOfFile: 79,872, FileAttributes: A"
"276434","¿ÀÈÄ 5:29:56.6929726","spoolsv.exe","3772","CreateFile","C:
\WINDOWS\system32\faultrep.dll","SUCCESS","Desired Access: Execute/
Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-
Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete,
AllocationSize: n/a, Impersonating: PARKJUYUN\Administrator,
OpenResult: Opened"

===+===+===

I guess it's indicating the spoolsv.exe is looking for the USB port
info but couldn't and dies. Is my guess right?

What can cause this?

TIA
 
Back
Top