Win XP Print Spooler Crashes

[clark.keith]

Hi,
I get the following error when printing

szAppName : spoolsv.exe szAppVer : 5.1.2600.2696
szModName : kernel32.dll szModVer : 5.1.2600.2180 offset :
0000a728

After restarting the service, the print job can be restarted
successfully.
I am running Win XP Pro SP2 plus all current patches.

Ideas?

Regards, keith

 

[Cari \(MS-MVP\)]

Uninstall and reinstall the printer. The spooler crashing is normally
caused by corrupted printer drivers.

http://www.coribright.com/windows/Article One.htm

 

[clark.keith]

Tried it all but did not work. Took the latest drivers etc. but no joy.

Many thanks for your help.
Keith

 

[Dieter Riekert]

Hi,
the error is in function CompareStringW in kernel32.dll.

7c80a710 83f801 cmp eax,0x1
7c80a713 0f87bcfcffff jnbe kernel32!CompareStringW+0xb57 (7c80a3d5)
7c80a719 837dc401 cmp dword ptr [ebp-0x3c],0x1
7c80a71d 0f84b2fcffff je kernel32!CompareStringW+0xb57 (7c80a3d5)
7c80a723 8b7d10 mov edi,[ebp+0x10]
7c80a726 33c9 xor ecx,ecx
7c80a728 668b0f mov cx,[edi]
7c80a72b 663b0b cmp cx,[ebx]

two strings are compared, one has an invalid address.
To find out what strings are compared run "ntsd -p <pid from spoolsv>"
you can get the pid from the taskmanager with the pid-column enabled.
After ntsd opens, type "g", print and wait for the debugger to stop.
With "k" you can get a stack trace to find out, where the call comes from.
To get the strings type
"d ebx" for the string with the correct address and
"d edi" for the invalid address.
Perhaps you get an idea what is compared.

Additionaly use regmon and filemon from www.sysinternals.com to see what
the spooler did before the crash.

Here some links for debugging basics.
(It's better to use windbg with debugging symbols)

http://www.codeproject.com/debug/cdbntsd.asp
http://www.codeproject.com/debug/windbg_part1.asp

Good luck

Dieter