spoolsv.exe

[ray2nite]

We're running an xp professional service pack 2 workstation which also serves as a file and print server in the

office. It also mounts local printers, one in particular , on a remote desktop to a server outside the office.
The printers include a hp 4050 ps, and a thermal printer used by UPS worldship. Not an especially heavy
windows setup, just basic office and a few light programs, and the above mentioned worldship.

The configuration has worked well for a long time. Friday morning the spoolsv.exe exploded and is
pegging the CPU at 99%. I can kill spoolsv.exe and get the computer running again, but I have to restart
the print spooler service in control panel to restore the printers and print, and the computer gets
pegged again, usually immediately or in seconds, and becomes almost unusable. It eventually gets completely frozen

and I must kill the process again and repeat. Other symtoms are windows explorer/ my computer hanging for a
long time with the flashlight. I usually see this with a bad usb device.

Is this a common problem? I really would like to avoid major reconfiguration of this machine. Would a system
restore to Thursday be a safe approach? Would a utility like commfix be safe to try,or could it make things worse?
I don't believe there is any virus. I installed the new trial of avg 9 and will try trendmicro next, but I see
no evidence of an infection yet. All printer Caches are empty.

 

[Turkbear]

Hi,
A couple of ideas from a Google search, maybe one will help:

http://forums.ocworkbench.com/showthread.php?t=56312

( may be a SP2 bug

http://www.computing.net/answers/windows-xp/after-sp2-spoolsvexe-100cpu/114269.html

http://www.adminnotes.com/index/2006/01/spoolsvexe_caus.html

As you can see, it is not an uncommon problem...





To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[linney]

This a post that might help you.

Stopping of the Print Spooler
thread779-686557

Any reason why you have not gone for SP3?

 

[goombawaho]

Any reason why you have not gone for SP3?" Bravo!!!

"Using XP as a file/print server" - You get what you've got.

 

[linney]

Using System Restore to return to last Thursday would not cause too many problems other than the loss of updates or programs installed since then. If you don't like the outcome there will be an "undo" restore point created by System Restore for you to use to return to the present.

As to your question about Commfix, if it is the application mentioned in these threads then it would obviously be unwise to run it.

http://www.google.com.au/search?q=c...&ie=&oe=&redir_esc=&ei=Ie2TS6blIZGTkAWfm_iMDQ

Maybe it is some other program that I am just not familiar with?

 

[robmazco]

Ive had the occasional problem with other HP printers.
Deleting the files under the sys32/spool folder has worked.

If on the rare occasion it didnt, I used the next steps to resolve:

http://support.microsoft.com/kb/312052

Either way, problem was resolved. And I have seen this on sp2 and sp3 machines for what its worth.

 

[ray2nite]

Thanks, I meant combofix.
Actually there were corrupted files in the sys32/spool. Shut everything off, wiped, reconnected and restarted the spool, and all worked.
The workstation shares with 2 other computers, and is adequate. SP2 is stable, I manually add updates at my discretion. I've seen issues with sp3 and don't install it without a legitimate reason on a system that's already working.
I believe the problem started with an outside user playing with the terminal ports so print jobs from other remote terminal users went to an inactive printer driver on this machine. This happened before, but never caused a crash like this.

 

[linney]

Combofix requires some expert knowledge to run according to this site.

A guide and tutorial on using ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

 

[goombawaho]

It only requires EXPERT knowledge to FIX your computer IF ComboFix screws up your computer. If it does it's thing and does it right - nothing to do, no more malware to worry about.

If there's a problem - well then things can get more complicated. Just like anything else - use at your own peril.

I've only seen it break one computer out of about 20 I've ran it on. That doesn't mean your chances are 1 in 20 - just what I've seen so far.