Member Avatar for DDoerschuk

I would like to ask for help on this problem that I've tried to troubleshoot, but have had no success at. The print spooler on a windows XP Home Edition SP3 machine is refusing to start. Previous to this problem, 5 or 6 printers had been configured and working for many months.

  1. Printers and Faxes window is EMPTY, except for "Add Printer"
  2. Click "Add Printer", returned error message: "Operation could not be completed. The print spooler service is not running."
  3. Execute: net start spooler, returned error message: "The service name is invalid".
  4. Execute: services.msc, Print Spooler Service is NOT on the list of services.
  5. Execute: sfc /scannow, process requested original XP disk, inserted disk, disk activity occured, sfc terminated normally without message.
  6. System and Application Event Logs contain no Spooler errors.

  7. Execute: regedit and found:

    My Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler
    (default) REG-SZ (value not set)
    DependOnService REG_MULTI_SZ RPCSS
    Type REG_DWORD 0x00000010(16)
    Enum
    (Default) REG_SZ (value not set)
    0 REG_SZ Root\LEGACY_SPOOLER\0000
    Count REG_DWORD 0x00000001 (1)
    NextInstance REG_DWORD 0x00000001 (1)

    Other than DependOnService (I checked that RPCSS is running) I don't know what these entries mean.

  8. C:\Windows\System32 contains:

            4/14/2008   7:00          75,264  spoolss.dll
        8/17/2010   8:17          58,880  spoolsv.exe

    whose respective properties are:
    spoolss.dll Company Name: Microsoft Corporation
    spoolss.dll File Description: Spooler SubSystem DLL
    spoolss.dll File Version: 5.1.2600.5512 (xpsp.080413-0852)
    spoolss.dll Internal Name: spoolss.dll
    spoolss.dll Legal Copyright: c Microsoft Corporation. All rights reserved.
    spoolss.dll Legal Trademarks:
    spoolss.dll Original Filename: spoolss.dll
    spoolss.dll Product Name: Microsoftr Windowsr Operating System
    spoolss.dll Product Version: 5.1.2600.5512
    and
    spoolsv.exe Company Name: Microsoft Corporation
    spoolsv.exe File Description: Spooler SubSystem App
    spoolsv.exe File Version: 5.1.2600.6024 (xpsp_sp3_gdr.100817-1626)
    spoolsv.exe Internal Name: spoolsv.exe
    spoolsv.exe Legal Copyright: c Microsoft Corporation. All rights reserved.
    spoolsv.exe Legal Trademarks:
    spoolsv.exe Original Filename: spoolsv.exe
    spoolsv.exe Product Name: Microsoftr Windowsr Operating System
    spoolsv.exe Product Version: 5.1.2600.6024

Thank you for taking a look at my problem!
Dave

  • 4 Contributors
  • 12 Replies
  • 876 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by nullptr

Recommended Answers

All 12 Replies

Member Avatar for rubberman

Go to the Services page in the Control Panel and see if the spooler is listed there. If it is running then try to restart it. If not running, then start it and click on the autostart icon so it will start on next reboot of the OS. If it isn't showing up at all, then go to the add/remove software page. On the left side of the screen should be a panel showing what Microsoft services and applications have been installed. There should be an Add button which would show available applications and services - the print spooler should show up there.

commented: Excellent answer and what I was just about to suggest. +11
Member Avatar for DDoerschuk

Rubberman,

Thank you for your suggestions. I apologize for taking 2 days to get back with you.

The Services page in Control Panel does not have an entry for "Print Spooler" (or any reasonable variation on that name). It is not that the Spooler is not started, or not in automatic; rather, the entire Print Spooler entry does not exist in the Services page list.

I also tried your 2nd suggestion, but had no luck there either. Executing: Control Panel | Add or Remove Programs | Add/Remove Windows Components does nothing at all on this computer. It's kind of bizarre: I select the "Add/Remove Windows Components" button on the left-side panel of the "Add or Remove Programs" window, and the button visually registers a pick, but does not actually do anything.

I've re-executed sfc /scannow, and re-applied Service Pack 3, and rebooted quite a few times. Sorry to say that I'm still stuck!

Member Avatar for rproffitt

One more thing to check out. Is the file printui.dll in the usual Windows folders?
The old SFC /SCANNOW may or may not bring it back.

Edited by rproffitt because: Typo.
Member Avatar for rubberman

I think something munged your system. Do the following:

  1. Run the disc check tool to see if the file system is ok. If it is, go to #2 (which will require a reboot).
  2. Schedule the sector check tool to run on reboot.
  3. Run a virus scanner on your file system.

These will verify that the disc and file system are ok, and try to fix them if not. If the disc and file system are ok, then if you have a recovery partition on the disc, boot from that and run the recovery tool to replace lost dll's and such. I assume you have a good virus scanner? If not, you can download and run the open source scanner ClamWin.

commented: All three suggestions were correct and diagnosed problems! +1
Member Avatar for DDoerschuk

rproffitt,
Thank you for the good idea. I checked, and copies of printui.dll exist in 3 windows directories:
c:\windows\system32
c:\windows\ServicePackFiles\i386
c:\windows\system32\dllcache

rubberman,
I've just discovered I cannot upload the excel spreadsheet onto which I've compacted/edited all my test results. This is sort of bad news for me, but I will give you the gist of what I've discovered so far.

I've run tests with ZoneAlarm (my default subscribed-to AV program that runs all the time), and AVG and ClamWin. They found and quarantined 20 viruses that ZoneAlarm had apparently missed; here's the list, please let me know if you recognize any of these as being a cause of great concern or further action.
SWF.Exploit.Kit-368
SWF.Exploit.Kit-201
Trojan horse Exploit.SWF_c.HO
Exploit.FLV
Trojan horse Exploit.SWF_c.QF
SWF.Exploit.Kit-49
Trojan horse Exploit.SWF_c.BW
Trojan.Webber.A
Email.Trojan-107
Packed.Revolt
Trojan horse Injector.FP
Win32/Cryptor
Exploit.IFrame.Gen
Email.Phishing.Card-29
Html.Exploit.CVE_2014_2797
Win.Worm.Chir-2121
Corrupted executable file
MalSign.OpenCandy.7AF
Win.Worm.Chir-1754
Win.Trojan.Ramnit-5603

Regarding chkdsk c: /f and chkdsk c: /r, there were over 1800 discrepancies found initially, but this was cured on the first try by chkdsk. Further chkdsk /f or /r runs always turned up a few discrepancies: fewer than 10 except for once when it found 79.

Finally, I have gained insight into SFC. I've run it several times during this problem, and it simply asks for the XP CD disk, runs for a while, and then terminates silently. I assumed (ouch) that this meant all was well. If a microsoft-provided system file was found to be corrupt, surely all sorts of windows would pop up and bells would ring. Right? Turns out not so much. Errors are buried in the Event Viewer, in the System listing, from the source: "Windows File Protection". I have 9 files that SFC cannot copy to the DLL cache. Here is the error message, identical for all the files:

The system file <filename> could not be copied into the DLL cache. The specific error code is 0x000003e3 [The I/O operation has been aborted because of either a thread exit or an application request.] This file is necessary to maintain system stability.

Where <filename> in the error message is replaced by 1 of these 9 file names:
c:\windows\system32\drivers\netflx3.sys
c:\windows\system32\drivers\netwlan5.sys
c:\windows\system32\drivers\ngrpci.sys
c:\windows\system32\drivers\nm5a2wdm.sys
c:\windows\system32\drivers\nscirda.sys
c:\windows\system32\drivers\nsmmc.sys
c:\windows\system32\drivers\ntapm.sys
c:\windows\system32\inetsrv\ntfsdrv.dll
c:\windows\system32\drivers\ntgrip.sys

All these file do exist in c:\windows\system32\dllcache except for one: "ntfsdrv.dll". I believe it is supposed to reside in c:\Windows\System32\Inetsrv, but it is not in that directory either.

So, my original problem described in my first post about no printers or spooler existing still stands true. I wish I could have posted my spreadsheet, but I think I've touched on all the important parts in this post.

I'd appreciate any pointers on what I should do next!

Thank you for your help,
Dave

Edited by DDoerschuk
Member Avatar for nullptr

Scan your system with Eset's online scanner. If Ramnit is detected, repeat the scan until it's no longer detected.
http://www.eset.com/us/online-scanner/

Post back with the results.

Edited by nullptr
commented: Great new tool, new to me. Found a LOT of viruses! +1
Member Avatar for DDoerschuk

nullptr,
Thank you for your advice about Eset. I ran their online scanner twice: the first time it quarantined the list of files below, the second time it found zero threats. It never saw Ramnit, so I'm hoping that the instances of Win.Trojan.Ramnit-5603 quarantined by ClamWin were the only ones present.

Win32/Toolbar.Montiera.B
Win32/Toolbar.Montiera.E
Win32/Toolbar.Conduit
Win32/InstallMonetizer.AQ
a variant of Win32/Toolbar.Conduit.P
a variant of Win32/Toolbar.Conduit.B
a variant of Win32/Toolbar.Montiera.A
Win32/Toolbar.Montiera.I
a variant of Win32/Toolbar.Conduit.K
a variant of Win32/Systweak.L
a variant of Win32/Systweak.N
a variant of Win32/Systweak
a variant of Win32/Adware.Softomate.AD application
Win32/Toolbar.Widgi
Win32/Toolbar.Conduit.Y

So, the disk's logical consistency looks good, and we've crushed a LOT of viruses! Sadly, I still cannot start the print spooler (original problem) and the SFC behavior described 2 posts back (SFC won't load 9 files into DLL cache) is still with me.

I deeply appreciate all the help I've received. It has done me a great deal of good. Any further thoughts on this problem will be gratefully received!

Dave

Member Avatar for nullptr

It appears that the Eset scan found a lot of PUAs.
Is your installation disk one for XP service pack 3?
Have you tried running SFC from safe mode?

For the print spooler, open notepad and copy/paste the content of the following code box:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler]
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"Description"="Loads files to memory for later printing."
"DisplayName"="Print Spooler"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,e8,47,0c,\
  00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00
"Group"="SpoolerGroup"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,70,00,6f,00,6f,00,6c,00,73,00,76,00,2e,00,65,00,78,00,65,00,00,00
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000110

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Performance]
"Close"="PerfClose"
"Collect"="PerfCollect"
"Collect Timeout"=dword:000007d0
"Library"="winspool.drv"
"Object List"="1450"
"Open"="PerfOpen"
"Open Timeout"=dword:00000fa0
"WbemAdapFileSignature"=hex:bd,83,ab,a6,1e,8a,cc,c8,d9,ff,b8,69,f2,94,18,ce
"WbemAdapFileTime"=hex:00,64,e9,f6,f8,9d,c8,01
"WbemAdapFileSize"=dword:00023c00
"WbemAdapStatus"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,\
  05,0b,00,00,00,00,00,18,00,9d,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  23,02,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,\
  02,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

Save as type: All Files (*.*)
File name: SpoolFix.reg

Double click and allow it to merge with the registry.
If the merge is successful, reboot the computer and check whether the print spooler is listed in services.

Edited by nullptr
commented: You've just got to love somebody who can dash off 40 lines of registry script and fix your problem! +1
Member Avatar for DDoerschuk

nullptr,

You have nailed the printer problem! Running your registry script and rebooting bought back all my printers, and they work fine. Thank you so much!

My XP installation disk is for SP2, and I'm running SP3. I assumed that those system files changed in the SP2 -> SP3 transition would be copied by SFC from the installation cache directory on C: created during the transition, but I may be completely wrong. Surely, Microsoft doesn't expect users to buy a new installation disk every time a service pack is released?

I have tried running SFC in safe mode, but it quits saying it wants the RPC server running. RPC will run in Safe Network mode, but the RPC locator service won't start.

Thank you again for the terrific win on the registry script!

Dave

Member Avatar for nullptr

It would be worthwhile slipstreaming service pack 3 into your installation disk. The guide here is comprehensive and relatively easy to follow.

If you like, I can get you to run SystemLook to see if the correct copy of the problem files is stored anywhere on your computer. Let me know if you wish to pursue this.

I'd recommend also running AdwCleaner (click the Download Now @ BleepingComputer button.) just to remove any dregs of all the junkware removed.

Edited by nullptr because: clarity
commented: Another 2-for-2 correct suggestions! +1
Member Avatar for DDoerschuk

nullptr,

Fantastic! I built a slipstream disk - quite easy, I just plodded through the instructions on the excellent tutorial you linked. I ran SFC using the newly burned disk, and all 9 of the files that wouldn't install before worked fine: the only event log message was the "successful completion" one!

Then I ran AdwCleaner, and it found 7 folders and 49 registry entries to delete.

You have cured all my problems, and I am very pleased and grateful! Thank you very much for your excellent advice!

Best regards,
Dave

Member Avatar for nullptr

Dave,

That's great news and thanks for the feedback. :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.