Spooler Subsystem App closed by Data Execution Prevention

Discussion in 'Windows XP Print / Fax' started by SharonW, Jan 16, 2009.

  1. SharonW

    SharonW Guest

    I am running XP Pro with SP3 on a system with a 3.2 Mhz processor and 1 G of
    memory. I have two 149 G drives, each with about 63G of free space. When I
    started the system this morning, Windows displayed a message headed "Data
    Execution Prevention" and reading "To help protect your computer, Windows has
    closed this program. Name: Spooler Subsystem App Publisher: Microsoft
    Corporation".

    All of my printers - 2 local and 2 networked - have disappeared, and when I
    try to reinstall them Windows displays the message "Operation could not be
    completed. The print spooler service is not running."

    Everything seemed to be working normally yesterday.

    I ran a full virus scan after getting this error - it says the system is
    clean.

    The formerly installed printers are -
    1) HP2200 on LPT1 - this was set to allow shared access since several users
    need to print to it
    2) Xerox Phaser 6250 on USB
    3) HP4000 on an internal IP address
    4) HP1312 on an internal IP address
    Printers 1, 2, and 3 have been installed on this system for several years. I
    installed the HP1312 on Tuesday Jan 13 to troubleshoot why its primary user
    was getting error messages from it. I don't think I'll reinstall it...

    There are 35 other systems in use in this building, and since no one has
    phoned me for support I believe my system is the only one showing this
    problem.

    How can I get my printing to work again?
     
    SharonW, Jan 16, 2009
    #1
    1. Advertisements

  2. You will need to start the Printer Spooler service

    in Services.msc or at a command prompt
    net start spooler


    most spooler failures are caused when print drivers corrupt the memory of
    the process.
    --
    Alan Morris
    Windows Printing Team
    Search the Microsoft Knowledge Base here:
    http://support.microsoft.com/search/?adv=1

    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Alan Morris [MSFT], Jan 19, 2009
    #2
    1. Advertisements

  3. SharonW

    SharonW Guest

    Thanks, Alan - but it doesn't work. When I type "net start spooler" at the
    command prompt, I get the messages "The Print Spooler service is starting.
    The Print Spooler service was started successfully." But when I next go to
    Printers and Faxes and click Add Printer, I get the message "Operation could
    not be completed. The print spooler service is not running."

    I tried a couple of variations -
    1) Cold boot, then enter "net start spooler" at the command prompt. Same
    result.
    2) Uninstall the software for that HP1312 printer, and cold boot after
    finishing the uninstall with its associated restarts. Enter "net start
    spooler" after the cold boot. Same result.

    Where do I go from here?

    TIA,

    Sharon
     
    SharonW, Jan 20, 2009
    #3
  4. SharonW

    SharonW Guest

    Addition to my post about this technique not working when I entered "net
    start spooler" at the command prompt -

    I just tried running services.msc - the Print Spooler service status was
    "stopped". When I clicked "Start", the status changed to "Started". Next I
    tried to add a printer, and a few seconds after I clicked "Add printer" the
    Print Spooler service status changed back to "Stopped".

    Sharon
     
    SharonW, Jan 20, 2009
    #4
  5. the service starts until it loads something (of fails to load something)
    which corrupts the spooler memory and terminates.

    If you are interested in debugging the process and determining which file is
    causing the problem we can go there but most people would rather just get
    the dang spooler running again.


    Bruce has some useful information on cleaning out the print drivers.
    http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm
    --
    Alan Morris
    Windows Printing Team
    Search the Microsoft Knowledge Base here:
    http://support.microsoft.com/search/?adv=1

    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Alan Morris [MSFT], Jan 20, 2009
    #5
  6. SharonW

    SharonW Guest

    Alan - I would LOVE to get the dang spooler running, but no luck so far.

    (Apologies in advance - this is going to be a long one.)

    Background detail - I don't think this is related to upgrading from an
    earlier version of Windows. When I set up systems, I always start with a
    clean install. Many data files on the pc were brought over from older
    installations, but this machine started with a freshly formatted drive and an
    install of Windows XP from scratch.

    I looked at Bruce's page and proceeded as follows -

    Installed the Windows Server 2003 Resource Kit

    Run - cleanspl.exe

    Got the error 'Unable to create registry key "\\(my system
    name)\HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\Print\Printers\Phaser 6250DP". Access is denied.'

    No, there is no listing in Add/Remove programs for my Xerox Phaser 6250.
    Yes, there should be a Xerox Phaser 6250 installed.

    So next I tried regedit, with appropriate fear and trembling.

    I deleted all keys from
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
    NTx86\Drivers\Version-3, without deleting Version-3 itself. (Version-2 was
    not present.)

    At the command prompt, I entered net stop spooler, then net start spooler.

    Next Windows Explorer - c:\windows\system32\spool\printers was empty. I
    deleted everything from c:\windows\system32\spool\drivers\w32x86\3, and
    everything else that was in the w32x86 folder except for folder "3".

    Back to the command prompt - net stop spooler, net start spooler. (Yes, I
    hit enter and allowed time for a response after each of those two commands.)

    Add Printer

    Operation could not be completed. The print spooler service is not running.
    (The usual error I've been getting.)

    I restarted the system, then restarted the print spooler again. Tried to add
    a printer - Operation could not be completed. I went to services.msc (so I
    could watch when things happened) and started the (stopped) print spooler,
    then tried once more to add a printer - the spooler stopped a few seconds
    later and I got the usual error message.

    Help! Is there anything else I can do?

    Thanks for your trouble,

    Sharon
     
    SharonW, Jan 21, 2009
    #6
  7. Okay let's find out what is causing the spooler service to fail.

    Launch task manager. On the Processes tab, change the view to include a
    column for PID

    open a command window
    type net start spooler

    You have one minute to complete the next couple tasks

    find spoolsv.exe in task manager, note the PID

    in the command window type
    ntsd -p [PID for spoolsv.exe] -g -G


    press enter and a bunch of module load info will scroll paste.


    when the process terminates you will see a prompt
    ntdll!DbgBreakPoint:
    7c822583 cc int 3
    0:001>


    type k

    hopefully this will indicate which module is failing.

    --
    Alan Morris
    Windows Printing Team
    Search the Microsoft Knowledge Base here:
    http://support.microsoft.com/search/?adv=1

    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Alan Morris [MSFT], Jan 21, 2009
    #7
  8. SharonW

    SharonW Guest

    YAY!! I think that did it!!

    When I ran ntsd as instructed, after I typed "k" the system displayed:

    ChildEBP RetAddr
    WARNING: Stack unwind information not available. Following frames may be
    wrong.
    00abe75c 00000000 HpTctMon +0x5d71

    Just before ntsd paused and let me type "k", it displayed:

    ***WARNING: Unable to verify checksum for c:\windows\system32\HpTcpMon.dll
    ***ERROR: Symbol file could not be found. Defaulted to export symbols for
    c:\windows\system32\HpTcpMon.dll - HpTcpMon+5d71: 10005d71 8901 mov [ecx] eax
    ds:0023:00000000=????????


    That left me very suspicious of hptcpmon.dll, so I renamed it as
    xhptcpmon.dll (to be sure it could be retrieved in case it turned out to be
    needed), typed "net start spooler" at the command prompt, and tried to add a
    printer.

    It worked.

    I now have my HP2200 and my usual network printer back and usable. I will
    reinstall the Phaser 6250 (when I locate its CD). I will not reinstall the
    HP1312 - especially after noting that windows\system32\hptcpmon.dll has the
    same date (3-3-2008) as an installer file, HpTcpMon.msi, in the install files
    for the HP1312.

    Thank you very much - it's been a pretty agonizing process, but at least I
    have some idea of how to proceed if one of my users should have similar
    problems (God forbid).

     
    SharonW, Jan 22, 2009
    #8
  9. This is too funny, my brother hit this same issue.

    The problem is the fact that you had installed a previous version of
    hptcpmon and the new version of hptcpmon terminates when it reads the old
    registry data from the previous version.

    You can fix this by deleting the old hptcpmon registry data, before
    installing the new driver with the updated version of hptcpmon.dll

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\HP
    Standard TCP/IP Port

    HP has data some place on their support site for this issue.



    --
    Alan Morris
    Windows Printing Team
    Search the Microsoft Knowledge Base here:
    http://support.microsoft.com/search/?adv=1

    This posting is provided "AS IS" with no warranties, and confers no rights.

     
    Alan Morris [MSFT], Jan 22, 2009
    #9
  10. SharonW

    lyumilwe Guest

     
    lyumilwe, Feb 7, 2009
    #10
  11. SharonW

    lyumilwe Guest

     
    lyumilwe, Feb 7, 2009
    #11
  12. SharonW

    lyumilwe Guest

     
    lyumilwe, Feb 7, 2009
    #12
  13. SharonW

    lyumilwe Guest

     
    lyumilwe, Feb 7, 2009
    #13
  14. Cari \(MS-MVP\), Feb 8, 2009
    #14
  15. SharonW

    SharonW Guest

    Alan -

    This is a (very belated) thank you for all your help on the spooler problem.
    I've reinstalled all my printers and life is good. AND thanks to you I know
    to watch out for old versions of hptcpmon.

    Problem solved, and I appreciate your expertise.

    Sharon W

     
    SharonW, Feb 9, 2009
    #15
  16. SharonW

    SharonW Guest

    Hi Cari -

    See my exchange with Alan Morris above - the spooler service would stop as
    soon as I tried to install a printer. However, don't worry about it - with
    Alan's help, the problem was solved several weeks ago.

    I don't know who lyumilwe is, but it isn't me. lyumilwe, if you're having
    this spooler problem, try reading through the advice I got from Alan Morris.
    It's pretty detailed and well worth following.

    Sharon W
     
    SharonW, Feb 9, 2009
    #16
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.