The Print Spooler service terminated unexpectedly.

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

I have a problem I can't figure out. Both Dell and Microsoft will not help
without $$$. The computer is brand new...haven't even installed any software
on it yet.

Approximately every 68 seconds, I get the following in my event log:

---------------
Date: 5/30/2006 Source: Service Control Manager
Time: 6:58:25 AM Category: None
Type: Error Event ID: 7031
User: N/A
Computer: PG1W5V91

Description:
The Print Spooler service terminated unexpectedly. It has done this #
time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
---------------

That error is followed by the system restarting the service, but it it an
endless cycle. I've went through every single question and solution in this
printing section of the newsgroups as well as spending hours searching the
internet and Microsoft's support site, but to no avail...still no solution.

Anyone have anything that might help?

Thanx.

P.S. Keep in mind I have no printers installed, no printer drivers
installed, and the O/S is without errors otherwise.

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

Anyone?

Dieter · External Since: May 31, 2006 Posts: 3

Hi Steven,

have you tried the simple solutions ?

1. sfc /scannow
2. Check registry key
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\PostSPUpgrade]
for entries. If there are any, delete them.
3. reinstall the latest service pack and windows updates.

if yes, more information is needed, where the spooler crashes.(module,
adress,...)

to get that information you can try to run "drwtsn32". Perhaps it shows
error information for spoolsv.exe

An other way is to use "ntsd" or even better download the "debugging
tools for windows".
To use ntsd let the taskmanager show the process ids, open a command
prompt and run "ntsd -g -p <pid of spoolsv.exe>"
(you have 68 seconds to do this Wink

When the spooler now crashes ntsd will stop. Type "k" to get a stack
trace and notice the information about modules and adresses.
If debugging symbols are installed the stack trace will show more exact
module information.

Additional information about what the spooler did, before it crashed,
are delivered by regmon and filemon from www.sysinternals.com.
Filter the output to "spoolsv*" and check the last entries before the crash.

Dieter

> ...
> Approximately every 68 seconds, I get the following in my event log:
>
> ---------------
> Date: 5/30/2006 Source: Service Control Manager
> Time: 6:58:25 AM Category: None
> Type: Error Event ID: 7031
> User: N/A
> Computer: PG1W5V91
> ...
> That error is followed by the system restarting the service, but it it an
> endless cycle. I've went through every single question and solution in this
> printing section of the newsgroups as well as spending hours searching the
> internet and Microsoft's support site, but to no avail...still no solution.
>
> Anyone have anything that might help?
>
> Thanx.
>
> P.S. Keep in mind I have no printers installed, no printer drivers
> installed, and the O/S is without errors otherwise.

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

1. Yep...tried the sfc command...no change.
2. I have no "PostSPUpgrade" key present.
3. Reinstalling the SP and updates made no difference.

Unfortunately, I don't think the spooler service is actually crashing...I
may have misspoken when I first posted. Here's what I have...

Dell OptiPlex 210L
Pentium IV 2.8GHz
150GB SATA HDD
1GB DDR RAM
WinXPProSP2

This is a fresh install of the operating system. There is no other software
installed on this workstation yet.

My print spooler service is stoping and starting itself approximately every
60 seconds and I haven't even installed any printers yet.

I have pulled the following events from my system event log (in reverse
order). These same six events occur over and over infinitely:

-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:57:06 AM Category: None
Type: Error Event ID: 7031
User: N/A
Computer: DO210L

Description:
The Print Spooler service terminated unexpectedly. It has done this 1
time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:06 AM Category: None
Type: Information Event ID: 7036
User: N/A
Computer: DO210L

Description:
The Print Spooler service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:07 AM Category: None
Type: Information Event ID: 7036
User: N/A
Computer: DO210L

Description:
The Print Spooler service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:07 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service was successfully sent a stop control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:08 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------
Date: 06/02/2006 Source: Service Control Manager
Time: 7:58:08 AM Category: None
Type: Information Event ID: 7036
User: NT AUTHORITY\SYSTEM
Computer: DO210L

Description:
The Print Spooler service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------

It is an endless cycle that keeps repeating itself.

Any ideas?

Thanx.

Alan Morris [MSFT] · External Since: Oct 25, 2005 Posts: 509

Did you perform the OS installation or was this from Dell? Dell normally
bundles printers with their systems. Even if you did not purchase the
printer, some printer drivers may be installed from Dell.

Be sure to check the registry for installed print drivers since you can't
use the spooler to perform this task

HLM\SYSTEM\CurrentContolSet\Control\Printers\Enviroments\Windows NT
x86\drivers\

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

"Steven Sinclair" <StevenSinclair.TakeThisOut@discussions.microsoft.com> wrote in
message news:DBD7BB0D-EF76-4FCB-98BB-E21AD22D7770@microsoft.com...
> 1. Yep...tried the sfc command...no change.
> 2. I have no "PostSPUpgrade" key present.
> 3. Reinstalling the SP and updates made no difference.
>
> Unfortunately, I don't think the spooler service is actually crashing...I
> may have misspoken when I first posted. Here's what I have...
>
> Dell OptiPlex 210L
> Pentium IV 2.8GHz
> 150GB SATA HDD
> 1GB DDR RAM
> WinXPProSP2
>
> This is a fresh install of the operating system. There is no other
> software
> installed on this workstation yet.
>
> My print spooler service is stoping and starting itself approximately
> every
> 60 seconds and I haven't even installed any printers yet.
>
> I have pulled the following events from my system event log (in reverse
> order). These same six events occur over and over infinitely:
>
> -------------------------
> Date: 06/02/2006 Source: Service Control Manager
> Time: 7:57:06 AM Category: None
> Type: Error Event ID: 7031
> User: N/A
> Computer: DO210L
>
> Description:
> The Print Spooler service terminated unexpectedly. It has done this 1
> time(s). The following corrective action will be taken in 60000
> milliseconds:
> Restart the service.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> -------------------------
> Date: 06/02/2006 Source: Service Control Manager
> Time: 7:58:06 AM Category: None
> Type: Information Event ID: 7036
> User: N/A
> Computer: DO210L
>
> Description:
> The Print Spooler service entered the running state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> -------------------------
> Date: 06/02/2006 Source: Service Control Manager
> Time: 7:58:07 AM Category: None
> Type: Information Event ID: 7036
> User: N/A
> Computer: DO210L
>
> Description:
> The Print Spooler service entered the stopped state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> -------------------------
> Date: 06/02/2006 Source: Service Control Manager
> Time: 7:58:07 AM Category: None
> Type: Information Event ID: 7036
> User: NT AUTHORITY\SYSTEM
> Computer: DO210L
>
> Description:
> The Print Spooler service was successfully sent a stop control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> -------------------------
> Date: 06/02/2006 Source: Service Control Manager
> Time: 7:58:08 AM Category: None
> Type: Information Event ID: 7036
> User: NT AUTHORITY\SYSTEM
> Computer: DO210L
>
> Description:
> The Print Spooler service was successfully sent a start control.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> -------------------------
> Date: 06/02/2006 Source: Service Control Manager
> Time: 7:58:08 AM Category: None
> Type: Information Event ID: 7036
> User: NT AUTHORITY\SYSTEM
> Computer: DO210L
>
> Description:
> The Print Spooler service entered the running state.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> -------------------------
>
> It is an endless cycle that keeps repeating itself.
>
> Any ideas?
>
> Thanx.

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

The machine was originally installed from Dell with this problem, even though
there were no printers (or printer drivers) installed. After a couple of days
of trying to figure out what the problem was, I completely wiped the hard
drive and reinstalled the OS. To my chagrin, the issue is still occurring.

There were no registry entries for print drivers at that path.

I'm at a complete loss of what to do at this point. I have never before seen
this occur on any of our other 300 Dell machines...some preinstalled, some
custom installed.

Thanx.

"Alan Morris [MSFT]" wrote:

> Did you perform the OS installation or was this from Dell? Dell normally
> bundles printers with their systems. Even if you did not purchase the
> printer, some printer drivers may be installed from Dell.
>
> Be sure to check the registry for installed print drivers since you can't
> use the spooler to perform this task
>
> HLM\SYSTEM\CurrentContolSet\Control\Printers\Enviroments\Windows NT
> x86\drivers\
>
> --
> Alan Morris
> Windows Printing Team
> Search the Microsoft Knowledge Base here:
> http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "Steven Sinclair" <StevenSinclair RemoveThis @discussions.microsoft.com> wrote in
> message news:DBD7BB0D-EF76-4FCB-98BB-E21AD22D7770@microsoft.com...
> > 1. Yep...tried the sfc command...no change.
> > 2. I have no "PostSPUpgrade" key present.
> > 3. Reinstalling the SP and updates made no difference.
> >
> > Unfortunately, I don't think the spooler service is actually crashing...I
> > may have misspoken when I first posted. Here's what I have...
> >
> > Dell OptiPlex 210L
> > Pentium IV 2.8GHz
> > 150GB SATA HDD
> > 1GB DDR RAM
> > WinXPProSP2
> >
> > This is a fresh install of the operating system. There is no other
> > software
> > installed on this workstation yet.
> >
> > My print spooler service is stoping and starting itself approximately
> > every
> > 60 seconds and I haven't even installed any printers yet.
> >
> > I have pulled the following events from my system event log (in reverse
> > order). These same six events occur over and over infinitely:
> >
> > -------------------------
> > Date: 06/02/2006 Source: Service Control Manager
> > Time: 7:57:06 AM Category: None
> > Type: Error Event ID: 7031
> > User: N/A
> > Computer: DO210L
> >
> > Description:
> > The Print Spooler service terminated unexpectedly. It has done this 1
> > time(s). The following corrective action will be taken in 60000
> > milliseconds:
> > Restart the service.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > -------------------------
> > Date: 06/02/2006 Source: Service Control Manager
> > Time: 7:58:06 AM Category: None
> > Type: Information Event ID: 7036
> > User: N/A
> > Computer: DO210L
> >
> > Description:
> > The Print Spooler service entered the running state.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > -------------------------
> > Date: 06/02/2006 Source: Service Control Manager
> > Time: 7:58:07 AM Category: None
> > Type: Information Event ID: 7036
> > User: N/A
> > Computer: DO210L
> >
> > Description:
> > The Print Spooler service entered the stopped state.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > -------------------------
> > Date: 06/02/2006 Source: Service Control Manager
> > Time: 7:58:07 AM Category: None
> > Type: Information Event ID: 7036
> > User: NT AUTHORITY\SYSTEM
> > Computer: DO210L
> >
> > Description:
> > The Print Spooler service was successfully sent a stop control.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > -------------------------
> > Date: 06/02/2006 Source: Service Control Manager
> > Time: 7:58:08 AM Category: None
> > Type: Information Event ID: 7036
> > User: NT AUTHORITY\SYSTEM
> > Computer: DO210L
> >
> > Description:
> > The Print Spooler service was successfully sent a start control.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > -------------------------
> > Date: 06/02/2006 Source: Service Control Manager
> > Time: 7:58:08 AM Category: None
> > Type: Information Event ID: 7036
> > User: NT AUTHORITY\SYSTEM
> > Computer: DO210L
> >
> > Description:
> > The Print Spooler service entered the running state.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > -------------------------
> >
> > It is an endless cycle that keeps repeating itself.
> >
> > Any ideas?
> >
> > Thanx.
>
>
>

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

Alan?

"Steven Sinclair" wrote:

> The machine was originally installed from Dell with this problem, even though
> there were no printers (or printer drivers) installed. After a couple of days
> of trying to figure out what the problem was, I completely wiped the hard
> drive and reinstalled the OS. To my chagrin, the issue is still occurring.
>
> There were no registry entries for print drivers at that path.
>
> I'm at a complete loss of what to do at this point. I have never before seen
> this occur on any of our other 300 Dell machines...some preinstalled, some
> custom installed.
>
> Thanx.
>
>
> "Alan Morris [MSFT]" wrote:
>
> > Did you perform the OS installation or was this from Dell? Dell normally
> > bundles printers with their systems. Even if you did not purchase the
> > printer, some printer drivers may be installed from Dell.
> >
> > Be sure to check the registry for installed print drivers since you can't
> > use the spooler to perform this task
> >
> > HLM\SYSTEM\CurrentContolSet\Control\Printers\Enviroments\Windows NT
> > x86\drivers\
> >
> > --
> > Alan Morris
> > Windows Printing Team
> > Search the Microsoft Knowledge Base here:
> > http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto
> >
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> >
> > "Steven Sinclair" <StevenSinclair DeleteThis @discussions.microsoft.com> wrote in
> > message news:DBD7BB0D-EF76-4FCB-98BB-E21AD22D7770@microsoft.com...
> > > 1. Yep...tried the sfc command...no change.
> > > 2. I have no "PostSPUpgrade" key present.
> > > 3. Reinstalling the SP and updates made no difference.
> > >
> > > Unfortunately, I don't think the spooler service is actually crashing...I
> > > may have misspoken when I first posted. Here's what I have...
> > >
> > > Dell OptiPlex 210L
> > > Pentium IV 2.8GHz
> > > 150GB SATA HDD
> > > 1GB DDR RAM
> > > WinXPProSP2
> > >
> > > This is a fresh install of the operating system. There is no other
> > > software
> > > installed on this workstation yet.
> > >
> > > My print spooler service is stoping and starting itself approximately
> > > every
> > > 60 seconds and I haven't even installed any printers yet.
> > >
> > > I have pulled the following events from my system event log (in reverse
> > > order). These same six events occur over and over infinitely:
> > >
> > > -------------------------
> > > Date: 06/02/2006 Source: Service Control Manager
> > > Time: 7:57:06 AM Category: None
> > > Type: Error Event ID: 7031
> > > User: N/A
> > > Computer: DO210L
> > >
> > > Description:
> > > The Print Spooler service terminated unexpectedly. It has done this 1
> > > time(s). The following corrective action will be taken in 60000
> > > milliseconds:
> > > Restart the service.
> > >
> > > For more information, see Help and Support Center at
> > > http://go.microsoft.com/fwlink/events.asp.
> > > -------------------------
> > > Date: 06/02/2006 Source: Service Control Manager
> > > Time: 7:58:06 AM Category: None
> > > Type: Information Event ID: 7036
> > > User: N/A
> > > Computer: DO210L
> > >
> > > Description:
> > > The Print Spooler service entered the running state.
> > >
> > > For more information, see Help and Support Center at
> > > http://go.microsoft.com/fwlink/events.asp.
> > > -------------------------
> > > Date: 06/02/2006 Source: Service Control Manager
> > > Time: 7:58:07 AM Category: None
> > > Type: Information Event ID: 7036
> > > User: N/A
> > > Computer: DO210L
> > >
> > > Description:
> > > The Print Spooler service entered the stopped state.
> > >
> > > For more information, see Help and Support Center at
> > > http://go.microsoft.com/fwlink/events.asp.
> > > -------------------------
> > > Date: 06/02/2006 Source: Service Control Manager
> > > Time: 7:58:07 AM Category: None
> > > Type: Information Event ID: 7036
> > > User: NT AUTHORITY\SYSTEM
> > > Computer: DO210L
> > >
> > > Description:
> > > The Print Spooler service was successfully sent a stop control.
> > >
> > > For more information, see Help and Support Center at
> > > http://go.microsoft.com/fwlink/events.asp.
> > > -------------------------
> > > Date: 06/02/2006 Source: Service Control Manager
> > > Time: 7:58:08 AM Category: None
> > > Type: Information Event ID: 7036
> > > User: NT AUTHORITY\SYSTEM
> > > Computer: DO210L
> > >
> > > Description:
> > > The Print Spooler service was successfully sent a start control.
> > >
> > > For more information, see Help and Support Center at
> > > http://go.microsoft.com/fwlink/events.asp.
> > > -------------------------
> > > Date: 06/02/2006 Source: Service Control Manager
> > > Time: 7:58:08 AM Category: None
> > > Type: Information Event ID: 7036
> > > User: NT AUTHORITY\SYSTEM
> > > Computer: DO210L
> > >
> > > Description:
> > > The Print Spooler service entered the running state.
> > >
> > > For more information, see Help and Support Center at
> > > http://go.microsoft.com/fwlink/events.asp.
> > > -------------------------
> > >
> > > It is an endless cycle that keeps repeating itself.
> > >
> > > Any ideas?
> > >
> > > Thanx.
> >
> >
> >

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

Dieter,

Here's the ntsd information:

---------------
*** wait with pending attach
Loaded dbghelp extension DLL
The call to LoadLibrary(ext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded exts extension DLL
The call to LoadLibrary(uext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded ntsdexts extension DLL
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
ModLoad: 01000000 01010000 C:\WINDOWS\system32\spoolsv.exe
ModLoad: 7c900000 7c9b0000 C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f4000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f01000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77f10000 77f57000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77d40000 77dd0000 C:\WINDOWS\system32\USER32.dll
ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll
ModLoad: 6f880000 6fa4a000 C:\WINDOWS\AppPatch\AcGenral.DLL
ModLoad: 76b40000 76b6d000 C:\WINDOWS\system32\WINMM.dll
ModLoad: 774e0000 7761d000 C:\WINDOWS\system32\ole32.dll
ModLoad: 77120000 771ac000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 77be0000 77bf5000 C:\WINDOWS\system32\MSACM32.dll
ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.dll
ModLoad: 7c9c0000 7d1d5000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 769c0000 76a73000 C:\WINDOWS\system32\USERENV.dll
ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\UxTheme.dll
ModLoad: 629c0000 629c9000 C:\WINDOWS\system32\LPK.DLL
ModLoad: 74d90000 74dfb000 C:\WINDOWS\system32\USP10.dll
ModLoad: 773d0000 774d2000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Cont
rols_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
ModLoad: 5d090000 5d127000 C:\WINDOWS\system32\comctl32.dll
ModLoad: 11310000 11326000 C:\PROGRA~1\NETSUP~1\pcimonhook.dll
Access violation - code c0000005 (first chance)
eax=113202a0 ebx=11310000 ecx=00000001 edx=00ce3379 esi=00000001 edi=00000000
eip=7c80b529 esp=00cdf838 ebp=00cdf88c iopl=0 nv up ei ng nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010296
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\W
INDOWS\system32\kernel32.dll -
kernel32!GetModuleHandleA:
7c80b529 8bff mov edi,edi
0:006>
---------------

Any ideas?

Thanx.

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

Here's the second trace...

---------------

Microsoft (R) Windows User-Mode Debugger Version 5.1.2600.0
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach
Loaded dbghelp extension DLL
The call to LoadLibrary(ext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded exts extension DLL
The call to LoadLibrary(uext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded ntsdexts extension DLL
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
ModLoad: 01000000 01010000 C:\WINDOWS\system32\spoolsv.exe
ModLoad: 7c900000 7c9b0000 C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f4000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f01000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77f10000 77f57000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77d40000 77dd0000 C:\WINDOWS\system32\USER32.dll
ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll
ModLoad: 6f880000 6fa4a000 C:\WINDOWS\AppPatch\AcGenral.DLL
ModLoad: 76b40000 76b6d000 C:\WINDOWS\system32\WINMM.dll
ModLoad: 774e0000 7761d000 C:\WINDOWS\system32\ole32.dll
ModLoad: 77120000 771ac000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 77be0000 77bf5000 C:\WINDOWS\system32\MSACM32.dll
ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.dll
ModLoad: 7c9c0000 7d1d5000 C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 769c0000 76a73000 C:\WINDOWS\system32\USERENV.dll
ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\UxTheme.dll
ModLoad: 629c0000 629c9000 C:\WINDOWS\system32\LPK.DLL
ModLoad: 74d90000 74dfb000 C:\WINDOWS\system32\USP10.dll
ModLoad: 773d0000 774d2000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Cont
rols_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
ModLoad: 5d090000 5d127000 C:\WINDOWS\system32\comctl32.dll
ModLoad: 11310000 11326000 C:\PROGRA~1\NETSUP~1\pcimonhook.dll
Access violation - code c0000005 (first chance)
eax=113202a0 ebx=11310000 ecx=00000001 edx=00ce3379 esi=00000001 edi=00000000
eip=7c80b529 esp=00cdf838 ebp=00cdf88c iopl=0 nv up ei ng nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010296
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\W
INDOWS\system32\kernel32.dll -
kernel32!GetModuleHandleA:
7c80b529 8bff mov edi,edi
0:006> k
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\W
INDOWS\system32\ntdll.dll -
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be
wrong.
00cdf88c 7c9011a7 kernel32!GetModuleHandleA
00cdf8ac 7c91cbab ntdll!LdrInitializeThunk+0x29
00cdf9b4 7c916178 ntdll!LdrFindResourceDirectory_U+0x276
00cdfc60 7c9162da ntdll!RtlValidateUnicodeString+0x506
00cdff08 7c801bb9 ntdll!LdrLoadDll+0x110
00cdff70 7c801d6e kernel32!LoadLibraryExW+0xc8
00cdff84 7c801da4 kernel32!LoadLibraryExA+0x1f
00cdffa0 00bdf023 kernel32!LoadLibraryA+0x2d
00cdffec 00000000 0xbdf023
0:006>
---------------

Thanx.

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

Anyone...

Help...

Please...

Dieter · External Since: May 31, 2006 Posts: 3

Hi Steven,

you have Netsupport Manager installed, which caused the problem
(pcimonhook.dll)

Take a look at the following link (the only link about pcimonhook.dll in
google)

http://www.prosoft.de/static/knowledgebase/faq.php?SelectedFAQID=499&P...ESSID=4

it says:

rename injlib.dll to _injlib.dll
and pcimonhook.dll to _pcimonhook.dll in C:\PROGRA~1\NETSUP~1\

if you don't need netsupport manager, then deinstall it or try to
reinstall (we had problems with this software too)

Dieter

> Anyone...
>
> Help...
>
> Please...
>
>

Alan Morris [MSFT] · External Since: Oct 25, 2005 Posts: 509

thanks Dieter

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

"Dieter" <"dieter.riekert"@lvbprint.de> wrote in message
news:e64jc7$g7$03$1@news.t-online.com...
> Hi Steven,
>
> you have Netsupport Manager installed, which caused the problem
> (pcimonhook.dll)
>
> Take a look at the following link (the only link about pcimonhook.dll in
> google)
>
> http://www.prosoft.de/static/knowledgebase/faq.php?SelectedFAQID=499&P...ESSID=4
>
> it says:
>
> rename injlib.dll to _injlib.dll
> and pcimonhook.dll to _pcimonhook.dll in C:\PROGRA~1\NETSUP~1\
>
> if you don't need netsupport manager, then deinstall it or try to
> reinstall (we had problems with this software too)
>
> Dieter
>
>> Anyone...
>>
>> Help...
>>
>> Please...
>>

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

So, this is just one of those funky circumstances in which this problem only
(by total chance) effects one machine out of over three hundred?

Sheesh...no wonder I had such a hard time finding a solution.

Thanx, Dieter...I'll try the renaming and let you know how it goes,
unfortunately, I need netsupportmanager on all my machines.

Thanx again.

"Dieter" <"dieter.riekert" wrote:

> Hi Steven,
>
> you have Netsupport Manager installed, which caused the problem
> (pcimonhook.dll)
>
> Take a look at the following link (the only link about pcimonhook.dll in
> google)
>
> http://www.prosoft.de/static/knowledgebase/faq.php?SelectedFAQID=499&P...ESSID=4
>
> it says:
>
> rename injlib.dll to _injlib.dll
> and pcimonhook.dll to _pcimonhook.dll in C:\PROGRA~1\NETSUP~1\
>
> if you don't need netsupport manager, then deinstall it or try to
> reinstall (we had problems with this software too)
>
> Dieter
>
> > Anyone...
> >
> > Help...
> >
> > Please...
> >
> >
>

Dieter · External Since: May 31, 2006 Posts: 3

Hi Alan,
Hi Steven,

I dont't understand why the instruction mov edi,edi

ModLoad: 5d090000 5d127000 C:\WINDOWS\system32\comctl32.dll
ModLoad: 11310000 11326000 C:\PROGRA~1\NETSUP~1\pcimonhook.dll
Access violation - code c0000005 (first chance)
eax=113202a0 ebx=11310000 ecx=00000001 edx=00ce3379 esi=00000001
edi=00000000
eip=7c80b529 esp=00cdf838 ebp=00cdf88c iopl=0 nv up ei ng nz ac
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010296
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\kernel32.dll -
kernel32!GetModuleHandleA:
7c80b529 8bff mov edi,edi

from ntsd-output could cause the access violation.
eax points to pcimonhook.dll.

I think the "data execution prevention" for modern 64 bit processors
does not work with injected dlls or windows use it the wrong way.
(7c80b529 is in the address space of kernel32.dll and should not be a
data segment).

So Steven, please try whether the problem disappears, if you disable
data execution prevention.

Dieter

Steven Sinclair · External Since: Mar 10, 2005 Posts: 49

IT WORKED!!!

8^)>

WOOOOOOOOOHOOOOOOOOOOOOO!!!

Just renamed those two files and restarted.

Thanx very much!

"Steven Sinclair" wrote:

> So, this is just one of those funky circumstances in which this problem only
> (by total chance) effects one machine out of over three hundred?
>
> Sheesh...no wonder I had such a hard time finding a solution.
>
> Thanx, Dieter...I'll try the renaming and let you know how it goes,
> unfortunately, I need netsupportmanager on all my machines.
>
> Thanx again.
>
> "Dieter" <"dieter.riekert" wrote:
>
> > Hi Steven,
> >
> > you have Netsupport Manager installed, which caused the problem
> > (pcimonhook.dll)
> >
> > Take a look at the following link (the only link about pcimonhook.dll in
> > google)
> >
> > http://www.prosoft.de/static/knowledgebase/faq.php?SelectedFAQID=499&P...ESSID=4
> >
> > it says:
> >
> > rename injlib.dll to _injlib.dll
> > and pcimonhook.dll to _pcimonhook.dll in C:\PROGRA~1\NETSUP~1\
> >
> > if you don't need netsupport manager, then deinstall it or try to
> > reinstall (we had problems with this software too)
> >
> > Dieter
> >
> > > Anyone...
> > >
> > > Help...
> > >
> > > Please...
> > >
> > >
> >

DennisT · External Since: Jul 27, 2009 Posts: 1

Dieter,
you the MAN !!!.
I had this problem 2 weeks now and couldn't find a solution, until I
saw this post here.
Thanks Smile

Dieter;1919978 Wrote:
> Hi Steven,
>
> you have Netsupport Manager installed, which caused the problem
> (pcimonhook.dll)
>
> Take a look at the following link (the only link about pcimonhook.dll
> in
> google)
>
> http://www.prosoft.de/static/knowledgebase/faq.php?SelectedFAQID=499&P...ESSID=4
>
> it says:
>
> rename injlib.dll to _injlib.dll
> and pcimonhook.dll to _pcimonhook.dll in C:\PROGRA~1\NETSUP~1\
>
> if you don't need netsupport manager, then deinstall it or try to
> reinstall (we had problems with this software too)
>
> Dieter
>
> > Anyone...
> >
> > Help...
> >
> > Please...
> >
> >

--
DennisT
------------------------------------------------------------------------
DennisT's Profile: http://forums.techarena.in/members/118646.htm
View this thread: http://forums.techarena.in/xp-print-fax/520744.htm

http://forums.techarena.in