The Print Spooler service terminated unexpectedly.

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have a problem I can't figure out. Both Dell and Microsoft will not help
without $$$. The computer is brand new...haven't even installed any software
on it yet.

Approximately every 68 seconds, I get the following in my event log:

---------------
Date: 5/30/2006 Source: Service Control Manager
Time: 6:58:25 AM Category: None
Type: Error Event ID: 7031
User: N/A
Computer: PG1W5V91

Description:
The Print Spooler service terminated unexpectedly. It has done this #
time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
---------------

That error is followed by the system restarting the service, but it it an
endless cycle. I've went through every single question and solution in this
printing section of the newsgroups as well as spending hours searching the
internet and Microsoft's support site, but to no avail...still no solution.

Anyone have anything that might help?

Thanx.

P.S. Keep in mind I have no printers installed, no printer drivers
installed, and the O/S is without errors otherwise.
 
Hi Steven,

have you tried the simple solutions ?

1. sfc /scannow
2. Check registry key
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\PostSPUpgrade]
for entries. If there are any, delete them.
3. reinstall the latest service pack and windows updates.

if yes, more information is needed, where the spooler crashes.(module,
adress,...)

to get that information you can try to run "drwtsn32". Perhaps it shows
error information for spoolsv.exe

An other way is to use "ntsd" or even better download the "debugging
tools for windows".
To use ntsd let the taskmanager show the process ids, open a command
prompt and run "ntsd -g -p <pid of spoolsv.exe>"
(you have 68 seconds to do this ;)
When the spooler now crashes ntsd will stop. Type "k" to get a stack
trace and notice the information about modules and adresses.
If debugging symbols are installed the stack trace will show more exact
module information.

Additional information about what the spooler did, before it crashed,
are delivered by regmon and filemon from www.sysinternals.com.
Filter the output to "spoolsv*" and check the last entries before the crash.

Dieter
 
1. Yep...tried the sfc command...no change.
2. I have no "PostSPUpgrade" key present.
3. Reinstalling the SP and updates made no difference.

Unfortunately, I don't think the spooler service is actually crashing...I
may have misspoken when I first posted. Here's what I have...

Dell OptiPlex 210L
Pentium IV 2.8GHz
150GB SATA HDD
1GB DDR RAM
WinXPProSP2

This is a fresh install of the operating system. There is no other software
installed on this workstation yet.

My print spooler service is stoping and starting itself approximately every
60 seconds and I haven't even installed any printers yet.

I have pulled the following events from my system event log (in reverse
order). These same six events occur over and over infinitely:

-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:57:06 AM Category: None
Type: Error Event ID: 7031
User: N/A
Computer: DO210L

Description:
The Print Spooler service terminated unexpectedly. It has done this 1
time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:06 AM Category: None
Type: Information Event ID: 7036
User: N/A
Computer: DO210L

Description:
The Print Spooler service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:07 AM Category: None
Type: Information Event ID: 7036
User: N/A
Computer: DO210L

Description:
The Print Spooler service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:07 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service was successfully sent a stop control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:08 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:08 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------

It is an endless cycle that keeps repeating itself.

Any ideas?

Thanx.
 
Did you perform the OS installation or was this from Dell? Dell normally
bundles printers with their systems. Even if you did not purchase the
printer, some printer drivers may be installed from Dell.

Be sure to check the registry for installed print drivers since you can't
use the spooler to perform this task

HLM\SYSTEM\CurrentContolSet\Control\Printers\Enviroments\Windows NT
x86\drivers\

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.
 
The machine was originally installed from Dell with this problem, even though
there were no printers (or printer drivers) installed. After a couple of days
of trying to figure out what the problem was, I completely wiped the hard
drive and reinstalled the OS. To my chagrin, the issue is still occurring.

There were no registry entries for print drivers at that path.

I'm at a complete loss of what to do at this point. I have never before seen
this occur on any of our other 300 Dell machines...some preinstalled, some
custom installed.

Thanx.


Alan Morris said:
Did you perform the OS installation or was this from Dell? Dell normally
bundles printers with their systems. Even if you did not purchase the
printer, some printer drivers may be installed from Dell.

Be sure to check the registry for installed print drivers since you can't
use the spooler to perform this task

HLM\SYSTEM\CurrentContolSet\Control\Printers\Enviroments\Windows NT
x86\drivers\

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Steven Sinclair said:
1. Yep...tried the sfc command...no change.
2. I have no "PostSPUpgrade" key present.
3. Reinstalling the SP and updates made no difference.

Unfortunately, I don't think the spooler service is actually crashing...I
may have misspoken when I first posted. Here's what I have...

Dell OptiPlex 210L
Pentium IV 2.8GHz
150GB SATA HDD
1GB DDR RAM
WinXPProSP2

This is a fresh install of the operating system. There is no other
software
installed on this workstation yet.

My print spooler service is stoping and starting itself approximately
every
60 seconds and I haven't even installed any printers yet.

I have pulled the following events from my system event log (in reverse
order). These same six events occur over and over infinitely:

-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:57:06 AM Category: None
Type: Error Event ID: 7031
User: N/A
Computer: DO210L

Description:
The Print Spooler service terminated unexpectedly. It has done this 1
time(s). The following corrective action will be taken in 60000
milliseconds:
Restart the service.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:06 AM Category: None
Type: Information Event ID: 7036
User: N/A
Computer: DO210L

Description:
The Print Spooler service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:07 AM Category: None
Type: Information Event ID: 7036
User: N/A
Computer: DO210L

Description:
The Print Spooler service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:07 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service was successfully sent a stop control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:08 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:08 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------

It is an endless cycle that keeps repeating itself.

Any ideas?

Thanx.
Click to expand...
Click to expand...
 
Alan?

Steven Sinclair said:
The machine was originally installed from Dell with this problem, even though
there were no printers (or printer drivers) installed. After a couple of days
of trying to figure out what the problem was, I completely wiped the hard
drive and reinstalled the OS. To my chagrin, the issue is still occurring.

There were no registry entries for print drivers at that path.

I'm at a complete loss of what to do at this point. I have never before seen
this occur on any of our other 300 Dell machines...some preinstalled, some
custom installed.

Thanx.


Alan Morris said:
Did you perform the OS installation or was this from Dell? Dell normally
bundles printers with their systems. Even if you did not purchase the
printer, some printer drivers may be installed from Dell.

Be sure to check the registry for installed print drivers since you can't
use the spooler to perform this task

HLM\SYSTEM\CurrentContolSet\Control\Printers\Enviroments\Windows NT
x86\drivers\

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Steven Sinclair said:
1. Yep...tried the sfc command...no change.
2. I have no "PostSPUpgrade" key present.
3. Reinstalling the SP and updates made no difference.

Unfortunately, I don't think the spooler service is actually crashing...I
may have misspoken when I first posted. Here's what I have...

Dell OptiPlex 210L
Pentium IV 2.8GHz
150GB SATA HDD
1GB DDR RAM
WinXPProSP2

This is a fresh install of the operating system. There is no other
software
installed on this workstation yet.

My print spooler service is stoping and starting itself approximately
every
60 seconds and I haven't even installed any printers yet.

I have pulled the following events from my system event log (in reverse
order). These same six events occur over and over infinitely:

-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:57:06 AM Category: None
Type: Error Event ID: 7031
User: N/A
Computer: DO210L

Description:
The Print Spooler service terminated unexpectedly. It has done this 1
time(s). The following corrective action will be taken in 60000
milliseconds:
Restart the service.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:06 AM Category: None
Type: Information Event ID: 7036
User: N/A
Computer: DO210L

Description:
The Print Spooler service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:07 AM Category: None
Type: Information Event ID: 7036
User: N/A
Computer: DO210L

Description:
The Print Spooler service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:07 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service was successfully sent a stop control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:08 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:08 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------

It is an endless cycle that keeps repeating itself.

Any ideas?

Thanx.
Click to expand...
Click to expand...
Click to expand...
 
Dieter,

Here's the ntsd information:

---------------
*** wait with pending attach
Loaded dbghelp extension DLL
The call to LoadLibrary(ext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded exts extension DLL
The call to LoadLibrary(uext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded ntsdexts extension DLL
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
ModLoad: 01000000 01010000 C:\WINDOWS\system32\spoolsv.exe
ModLoad: 7c900000 7c9b0000 C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f4000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f01000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77f10000 77f57000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77d40000 77dd0000 C:\WINDOWS\system32\USER32.dll
ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll
ModLoad: 6f880000 6fa4a000 C:\WINDOWS\AppPatch\AcGenral.DLL
ModLoad: 76b40000 76b6d000 C:\WINDOWS\system32\WINMM.dll
ModLoad: 774e0000 7761d000 C:\WINDOWS\system32\ole32.dll
ModLoad: 77120000 771ac000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 77be0000 77bf5000 C:\WINDOWS\system32\MSACM32.dll
ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.dll
ModLoad: 7c9c0000 7d1d5000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 769c0000 76a73000 C:\WINDOWS\system32\USERENV.dll
ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\UxTheme.dll
ModLoad: 629c0000 629c9000 C:\WINDOWS\system32\LPK.DLL
ModLoad: 74d90000 74dfb000 C:\WINDOWS\system32\USP10.dll
ModLoad: 773d0000 774d2000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Cont
rols_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
ModLoad: 5d090000 5d127000 C:\WINDOWS\system32\comctl32.dll
ModLoad: 11310000 11326000 C:\PROGRA~1\NETSUP~1\pcimonhook.dll
Access violation - code c0000005 (first chance)
eax=113202a0 ebx=11310000 ecx=00000001 edx=00ce3379 esi=00000001 edi=00000000
eip=7c80b529 esp=00cdf838 ebp=00cdf88c iopl=0 nv up ei ng nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010296
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\W
INDOWS\system32\kernel32.dll -
kernel32!GetModuleHandleA:
7c80b529 8bff mov edi,edi
0:006>
 
Here's the second trace...

---------------

Microsoft (R) Windows User-Mode Debugger Version 5.1.2600.0
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach
Loaded dbghelp extension DLL
The call to LoadLibrary(ext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded exts extension DLL
The call to LoadLibrary(uext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded ntsdexts extension DLL
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
ModLoad: 01000000 01010000 C:\WINDOWS\system32\spoolsv.exe
ModLoad: 7c900000 7c9b0000 C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f4000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f01000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77f10000 77f57000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77d40000 77dd0000 C:\WINDOWS\system32\USER32.dll
ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll
ModLoad: 6f880000 6fa4a000 C:\WINDOWS\AppPatch\AcGenral.DLL
ModLoad: 76b40000 76b6d000 C:\WINDOWS\system32\WINMM.dll
ModLoad: 774e0000 7761d000 C:\WINDOWS\system32\ole32.dll
ModLoad: 77120000 771ac000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 77be0000 77bf5000 C:\WINDOWS\system32\MSACM32.dll
ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.dll
ModLoad: 7c9c0000 7d1d5000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 769c0000 76a73000 C:\WINDOWS\system32\USERENV.dll
ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\UxTheme.dll
ModLoad: 629c0000 629c9000 C:\WINDOWS\system32\LPK.DLL
ModLoad: 74d90000 74dfb000 C:\WINDOWS\system32\USP10.dll
ModLoad: 773d0000 774d2000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Cont
rols_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
ModLoad: 5d090000 5d127000 C:\WINDOWS\system32\comctl32.dll
ModLoad: 11310000 11326000 C:\PROGRA~1\NETSUP~1\pcimonhook.dll
Access violation - code c0000005 (first chance)
eax=113202a0 ebx=11310000 ecx=00000001 edx=00ce3379 esi=00000001 edi=00000000
eip=7c80b529 esp=00cdf838 ebp=00cdf88c iopl=0 nv up ei ng nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010296
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\W
INDOWS\system32\kernel32.dll -
kernel32!GetModuleHandleA:
7c80b529 8bff mov edi,edi
0:006> k
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\W
INDOWS\system32\ntdll.dll -
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be
wrong.
00cdf88c 7c9011a7 kernel32!GetModuleHandleA
00cdf8ac 7c91cbab ntdll!LdrInitializeThunk+0x29
00cdf9b4 7c916178 ntdll!LdrFindResourceDirectory_U+0x276
00cdfc60 7c9162da ntdll!RtlValidateUnicodeString+0x506
00cdff08 7c801bb9 ntdll!LdrLoadDll+0x110
00cdff70 7c801d6e kernel32!LoadLibraryExW+0xc8
00cdff84 7c801da4 kernel32!LoadLibraryExA+0x1f
00cdffa0 00bdf023 kernel32!LoadLibraryA+0x2d
00cdffec 00000000 0xbdf023
0:006>
 
Hi Steven,

you have Netsupport Manager installed, which caused the problem
(pcimonhook.dll)

Take a look at the following link (the only link about pcimonhook.dll in
google)

http://www.prosoft.de/static/knowle...99&PHPSESSID=465ec9fc09066fbdfeac6d22ed05ee75

it says:

rename injlib.dll to _injlib.dll
and pcimonhook.dll to _pcimonhook.dll in C:\PROGRA~1\NETSUP~1\

if you don't need netsupport manager, then deinstall it or try to
reinstall (we had problems with this software too)

Dieter
 
Hi Alan,
Hi Steven,

I dont't understand why the instruction mov edi,edi


ModLoad: 5d090000 5d127000 C:\WINDOWS\system32\comctl32.dll
ModLoad: 11310000 11326000 C:\PROGRA~1\NETSUP~1\pcimonhook.dll
Access violation - code c0000005 (first chance)
eax=113202a0 ebx=11310000 ecx=00000001 edx=00ce3379 esi=00000001
edi=00000000
eip=7c80b529 esp=00cdf838 ebp=00cdf88c iopl=0 nv up ei ng nz ac
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010296
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
kernel32!GetModuleHandleA:
7c80b529 8bff mov edi,edi

from ntsd-output could cause the access violation.
eax points to pcimonhook.dll.

I think the "data execution prevention" for modern 64 bit processors
does not work with injected dlls or windows use it the wrong way.
(7c80b529 is in the address space of kernel32.dll and should not be a
data segment).

So Steven, please try whether the problem disappears, if you disable
data execution prevention.

Dieter
 
So, this is just one of those funky circumstances in which this problem only
(by total chance) effects one machine out of over three hundred?

Sheesh...no wonder I had such a hard time finding a solution.

Thanx, Dieter...I'll try the renaming and let you know how it goes,
unfortunately, I need netsupportmanager on all my machines.

Thanx again.
 
IT WORKED!!!

8^)>

WOOOOOOOOOHOOOOOOOOOOOOO!!!

Just renamed those two files and restarted.

Thanx very much!
 
Back
Top