1.

Solve : Nightmare with spoolsv.exe?

Answer»

Hi all,
This is a problem I've been having with Spoolsv.exe, which as you know is the print spooler service. Apologies if this belongs in the windows, hardware, or drivers forum. Forum mods are more than welcome to move it.

The computer:
I'm running an Alienware Aurora-M 9700 laptop with Windows XP (fully updated), 2.2 Ghz Athlon processor, 2 GB RAM, 2 80 GB drives in RAID config (which has failed, but that's another story) and a bunch of other stuff I will post if asked.

When it first started:
I got a virus over the summer that Symantec was useless to do anything about (I had symantec antivirus installed & up to date and it found nothing). My first clue was that whenever the computer started, I got an error with spoolsv.exe, with the computer asking me if I wanted to debug it. What happens is a window from the "Visual Studio Just-In_Time Debugger" pops up and tells me that:
"An unhandled win32 exception occurred in spoolsv.exe [2864]".

It gives me the option to debug, and if I do, it tells me that:
"Unhandled exception at 0x7c93426d in spoolsv.exe: 0xC0000005: Access violation reading location 0x000696b8". I can't do much more after that except display assembly code, which doesn't really help.

A few days later, I noticed that clicking "view workgroup computers" brought up a number of computers and printers I've never heard of. This of course tipped me off to the fact that I probably had a trojan of some sort going on.

What I did:
Like I said, Symantec wasn't much help. Once I noticed the networked computers, I deleted all the connections, and ended up running every cleaning tool I could get my hands on. This included Spybot & Adaware. Eventually I got a trial version of Kaspersky 6.0, which seemed to find and fix the virus (a trojan of some kind). I found that the remote desktop settings had been enabled in my firewall, so I fixed that. I ran HijackThis after destroying the virus and found nothing suspicious.

However, even with the virus found and destroyed, the problem with spoolsv.exe persisted. I did massive google searches and didn't turn up much. Interestingly, I checked and found that the size of the actual spoolsv.exe file seemed ok (57856 bytes, verified here as probably ok: http://www.file.net/process/spoolsv.exe.html)

Also, copying a known good spoolsv.exe over the one on my laptop had no effect, so it seemed like the problem wasn't with the service itself. Eventually, I found out that if I simply made it so that the print spooler service wasn't started on PC startup, I could actually just start it when I needed it, print, then stop it, and everything was ok.

This was an ok solution for now, because I'm in my last semester of a grad school program, and I'm planning on just doing a fresh install once the program is over. However, this solution didn't last.

What happened next:
A couple of days ago when I tried to print, I started to get that same error (even when I manually start the service). I did it a few times and I got it to work, so I grumbled and went on my way. But today, my trial key for kaspersky ran out. I shelled out the bucks for the new version, installed, and now my print spooler seems to have totally *censored* the bed. Every time I tried to manually start the print spooler, it started, but then when I tried to do anything (such as access the list of printers), or print from a program, I get the error noted above with spoolsv.exe. The service crashes, and I'm SOL.

What I did:
Another massive google search ensued. This time there was more info on possible configuration issues. So, I did the following:
1. Deleted all files in the c:windows/system32/spool/printers directory, as directed here (as well as many other places):
http://www.gopaultech.com/2006/03/print-spooler-subsystem-app-error/

2. After step 1 had no effect, I manually deleted the registry keys for ALL of my printers and the driver files found in the .../spool/drivers/w32x86 directory (I also cleaned out the .../spool/drivers/color directory to be sure). This was as per these directions, which contain a superset of the directions from step 1:
http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm

3. After step 2 had no effect, I downloaded and ran CCleaner at the direction of several threads from this forum. This, perhaps unsurprisingly, had no effect.

Where I am now:
About to punt my laptop off a cliff. This thing cost way too much, can probably outpeform Deep Blue, and I just want to print-and I can't. I think it's still some sort of configuration issue, but I have no idea what else to delete or reset. So please-if anyone has any ideas about what else could possibly be done (aside from a reinstall of windows, which I can't afford right now in my last semester) I'd really appreciate it. I'm happy to post a HijackThis log, or whatever else, if it would be at all helpful.Ater doing all that you have done...

Why not just do a BACKUP and then a clean install...

Why rack your brain downloading, installing and running this and that...when the easiest thing to do would be a clean install...As I said, I'm in the last semester of a grad school program. I have dozens of programs installed to support the program, which would take forever and 3 days to reinstall and reconfig, and I'd need them up and running immediately. The inability to print, unfortunately, is less important than the inability to do my work. It is, however, ******* annoying.

Also, considering all that I've read in my most recent google search, I'm convinced that it's simply some sort of *censored* configuration issue and not another virus. Therefore I'm holding onto the extremely slim hope that there's one more file I could delete or one more registry fix I could apply and it'd all go away. If this isn't the case I'll eat the inability to print for another 3 MONTHS. But hey, can't hurt to ask for help too.Just an idea but why not just save your work to a file and throw them on a flash drive and print them on campus as needed ? ?

{t does sound like an aggravating problem though...Oh, I do. There's 50 ways around it, I know. The point is simply that I shouldn't have to, and I'm a STUBBORN person when it comes to technology working the way it is supposed to.



Discussion

No Comment Found