Spooler Subsystem App closed by Data Execution Prevention

[SharonW]

I am running XP Pro with SP3 on a system with a 3.2 Mhz processor and 1 G of
memory. I have two 149 G drives, each with about 63G of free space. When I
started the system this morning, Windows displayed a message headed "Data
Execution Prevention" and reading "To help protect your computer, Windows has
closed this program. Name: Spooler Subsystem App Publisher: Microsoft
Corporation".

All of my printers - 2 local and 2 networked - have disappeared, and when I
try to reinstall them Windows displays the message "Operation could not be
completed. The print spooler service is not running."

Everything seemed to be working normally yesterday.

I ran a full virus scan after getting this error - it says the system is
clean.

The formerly installed printers are -
1) HP2200 on LPT1 - this was set to allow shared access since several users
need to print to it
2) Xerox Phaser 6250 on USB
3) HP4000 on an internal IP address
4) HP1312 on an internal IP address
Printers 1, 2, and 3 have been installed on this system for several years. I
installed the HP1312 on Tuesday Jan 13 to troubleshoot why its primary user
was getting error messages from it. I don't think I'll reinstall it...

There are 35 other systems in use in this building, and since no one has
phoned me for support I believe my system is the only one showing this
problem.

How can I get my printing to work again?

[Alan Morris [MSFT]]

You will need to start the Printer Spooler service

in Services.msc or at a command prompt
net start spooler

most spooler failures are caused when print drivers corrupt the memory of
the process.
--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

"SharonW" <Sha...@discussions.microsoft.com> wrote in message
news:B227FAC7-426C-481E...@microsoft.com...

[SharonW]

Thanks, Alan - but it doesn't work. When I type "net start spooler" at the
command prompt, I get the messages "The Print Spooler service is starting.
The Print Spooler service was started successfully." But when I next go to
Printers and Faxes and click Add Printer, I get the message "Operation could

not be completed. The print spooler service is not running."

I tried a couple of variations -
1) Cold boot, then enter "net start spooler" at the command prompt. Same
result.
2) Uninstall the software for that HP1312 printer, and cold boot after
finishing the uninstall with its associated restarts. Enter "net start
spooler" after the cold boot. Same result.

Where do I go from here?

TIA,

Sharon

[SharonW]

Addition to my post about this technique not working when I entered "net
start spooler" at the command prompt -

I just tried running services.msc - the Print Spooler service status was
"stopped". When I clicked "Start", the status changed to "Started". Next I
tried to add a printer, and a few seconds after I clicked "Add printer" the
Print Spooler service status changed back to "Stopped".

Sharon

[Alan Morris [MSFT]]

the service starts until it loads something (of fails to load something)
which corrupts the spooler memory and terminates.

If you are interested in debugging the process and determining which file is
causing the problem we can go there but most people would rather just get
the dang spooler running again.

Bruce has some useful information on cleaning out the print drivers.
http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

"SharonW" <Sha...@discussions.microsoft.com> wrote in message

news:2DA229E1-3294-464E...@microsoft.com...

[SharonW]

Alan - I would LOVE to get the dang spooler running, but no luck so far.

(Apologies in advance - this is going to be a long one.)

Background detail - I don't think this is related to upgrading from an
earlier version of Windows. When I set up systems, I always start with a
clean install. Many data files on the pc were brought over from older
installations, but this machine started with a freshly formatted drive and an
install of Windows XP from scratch.

I looked at Bruce's page and proceeded as follows -

Installed the Windows Server 2003 Resource Kit

Run - cleanspl.exe

Got the error 'Unable to create registry key "\\(my system
name)\HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\Print\Printers\Phaser 6250DP". Access is denied.'

No, there is no listing in Add/Remove programs for my Xerox Phaser 6250.
Yes, there should be a Xerox Phaser 6250 installed.

So next I tried regedit, with appropriate fear and trembling.

I deleted all keys from
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
NTx86\Drivers\Version-3, without deleting Version-3 itself. (Version-2 was
not present.)

At the command prompt, I entered net stop spooler, then net start spooler.

Next Windows Explorer - c:\windows\system32\spool\printers was empty. I
deleted everything from c:\windows\system32\spool\drivers\w32x86\3, and
everything else that was in the w32x86 folder except for folder "3".

Back to the command prompt - net stop spooler, net start spooler. (Yes, I
hit enter and allowed time for a response after each of those two commands.)

Add Printer

Operation could not be completed. The print spooler service is not running.

(The usual error I've been getting.)

I restarted the system, then restarted the print spooler again. Tried to add
a printer - Operation could not be completed. I went to services.msc (so I
could watch when things happened) and started the (stopped) print spooler,
then tried once more to add a printer - the spooler stopped a few seconds
later and I got the usual error message.

Help! Is there anything else I can do?

Thanks for your trouble,

[Alan Morris [MSFT]]

Okay let's find out what is causing the spooler service to fail.

Launch task manager. On the Processes tab, change the view to include a
column for PID

open a command window
type net start spooler

You have one minute to complete the next couple tasks

find spoolsv.exe in task manager, note the PID

in the command window type
ntsd -p [PID for spoolsv.exe] -g -G

press enter and a bunch of module load info will scroll paste.

when the process terminates you will see a prompt
ntdll!DbgBreakPoint:
7c822583 cc int 3
0:001>

type k

hopefully this will indicate which module is failing.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

"SharonW" <Sha...@discussions.microsoft.com> wrote in message

news:6D9A88D7-A798-4040...@microsoft.com...

[SharonW]

YAY!! I think that did it!!

When I ran ntsd as instructed, after I typed "k" the system displayed:

ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be
wrong.
00abe75c 00000000 HpTctMon +0x5d71

Just before ntsd paused and let me type "k", it displayed:

***WARNING: Unable to verify checksum for c:\windows\system32\HpTcpMon.dll
***ERROR: Symbol file could not be found. Defaulted to export symbols for
c:\windows\system32\HpTcpMon.dll - HpTcpMon+5d71: 10005d71 8901 mov [ecx] eax
ds:0023:00000000=????????

That left me very suspicious of hptcpmon.dll, so I renamed it as
xhptcpmon.dll (to be sure it could be retrieved in case it turned out to be
needed), typed "net start spooler" at the command prompt, and tried to add a
printer.

It worked.

I now have my HP2200 and my usual network printer back and usable. I will
reinstall the Phaser 6250 (when I locate its CD). I will not reinstall the
HP1312 - especially after noting that windows\system32\hptcpmon.dll has the
same date (3-3-2008) as an installer file, HpTcpMon.msi, in the install files
for the HP1312.

Thank you very much - it's been a pretty agonizing process, but at least I
have some idea of how to proceed if one of my users should have similar
problems (God forbid).

[Alan Morris [MSFT]]

This is too funny, my brother hit this same issue.

The problem is the fact that you had installed a previous version of
hptcpmon and the new version of hptcpmon terminates when it reads the old
registry data from the previous version.

You can fix this by deleting the old hptcpmon registry data, before
installing the new driver with the updated version of hptcpmon.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\HP
Standard TCP/IP Port

HP has data some place on their support site for this issue.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

"SharonW" <Sha...@discussions.microsoft.com> wrote in message

news:25D999EF-A6B4-4730...@microsoft.com...

[lyumilwe]

[lyumilwe]

[lyumilwe]

[lyumilwe]

[Cari (MS-MVP)]

What happens when you restart the Spooler service:
http://www.coribright.com/windows/Article_Nine.htm
--
Cari (MS-MVP) Printing & Imaging
www.coribright.com/windows

"lyumilwe" <lyum...@discussions.microsoft.com> wrote in message
news:5FDD0466-23BD-494A...@microsoft.com...

[SharonW]

Alan -

This is a (very belated) thank you for all your help on the spooler problem.
I've reinstalled all my printers and life is good. AND thanks to you I know
to watch out for old versions of hptcpmon.

Problem solved, and I appreciate your expertise.

Sharon W

[SharonW]

Hi Cari -

See my exchange with Alan Morris above - the spooler service would stop as
soon as I tried to install a printer. However, don't worry about it - with
Alan's help, the problem was solved several weeks ago.

I don't know who lyumilwe is, but it isn't me. lyumilwe, if you're having
this spooler problem, try reading through the advice I got from Alan Morris.
It's pretty detailed and well worth following.

Sharon W