KB973346

Hi all,

After installing this update, one of our servers stopped printing. After
checking it out, the print spooler service has stopped. Restarting doesn't
help as the service almost instantly just stops. Checking the logs, I find
this:

Source: Application Error
Eventide: 1000
Spoolsv.exe Faulting application, version 5.2.3790.3959, faulting module
Gdi32.dll, version 5.2.3790.4396, fault address 0x00037453.

Has anyone encountered this before?

Regards,
Bowen

See the "How to obtain help..." section of
http://support.microsoft.com/kb/973346.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

bowen wrote:
> Hi all,
>
> After installing this update, one of our servers stopped printing. After
> checking it out, the print spooler service has stopped. Restarting doesn't
> help as the service almost instantly just stops. Checking the logs, I find
> this:
>
> Source: Application Error
> Eventide: 1000
> Spoolsv.exe Faulting application, version 5.2.3790.3959, faulting module
> Gdi32.dll, version 5.2.3790.4396, fault address 0x00037453.
>
> Has anyone encountered this before?
>
> Regards,
> Bowen

Please also check the patch KB961371, uninstall it should can resolved it.

Nonsense!

KK2009 wrote:
> Please also check the patch KB961371, uninstall it should can resolved it.

PA Bear

Why U said it? it caused by KB961371 and MS didn`t provid other solution for
it.

You do not want a computer to remain vulnerable to either exploit!

OP made no mention of having installed KB961371.

If OP's problem is related to having installed KB973346 (which includes
previously-released ActiveX Killbits), the computer had not been kept fully
patched in the past and MS Support will help him deal with the issue (which
is most likely caused by outdated software).


KK2009 wrote:
> PA Bear
>
> Why U said it? it caused by KB961371 and MS didn`t provid other solution
> for
> it.

HI PA Bear,

I found it from internet and it be gathered after we encounter that error.
it is " Dr. Watson`s "dmp files

This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(17f4.518): Access violation - code c0000005 (first/second chance not
available)
eax=03eb0030 ebx=0000000c ecx=00000000 edx=001e33fc esi=00000000 edi=0234b11c
eip=69651311 esp=0234b024 ebp=0234b02c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
fontsub.dll -
fontsub!MergeFontPackage+0xdd0a:
69651311 8a28 mov ch,byte ptr [eax]
ds:0023:03eb0030=??
0:021> k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be
wrong.
0234b02c 69651503 fontsub!MergeFontPackage+0xdd0a
0234b058 69651aad fontsub!MergeFontPackage+0xdefc
0234b09c 69651b27 fontsub!MergeFontPackage+0xe4a6
0234b0b0 69651bc2 fontsub!MergeFontPackage+0xe520
0234b0d8 69647ab9 fontsub!MergeFontPackage+0xe5bb
0234b158 696436c5 fontsub!MergeFontPackage+0x44b2
0234b190 77c0740e fontsub!MergeFontPackage+0xbe
0234b1ec 77c04c0a gdi32!bMergeSubsetFont+0xe9
0234b268 77c04de0 gdi32!ProcessPages+0x48c
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
hpzpp5mc.DLL -
0234b29c 0208e48f gdi32!GdiGetPageCount+0x2f
0234b2e8 02087c6b hpzpp5mc!EnumPrintProcessorDatatypesW+0x753a
0234ee88 02097bfb hpzpp5mc!EnumPrintProcessorDatatypesW+0xd16
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
localspl.dll -
0234eeb0 763da229 hpzpp5mc!PrintDocumentOnPrintProcessor+0x5c
0234f948 763daadd localspl!SplDeleteSpooler+0xbd0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
kernel32.dll -
0234ffb8 7c82482f localspl!SplDeleteSpooler+0x1484
0234ffec 00000000 kernel32!GetModuleHandleA+0xdf

"KK2009" wrote:

> HI PA Bear,
>
> I found it from internet and it be gathered after we encounter that error.
> it is " Dr. Watson`s "dmp files
>
> This dump file has an exception of interest stored in it.
> The stored exception information can be accessed via .ecxr.
> (17f4.518): Access violation - code c0000005 (first/second chance not
> available)
> eax=03eb0030 ebx=0000000c ecx=00000000 edx=001e33fc esi=00000000 edi=0234b11c
> eip=69651311 esp=0234b024 ebp=0234b02c iopl=0 nv up ei pl nz na pe nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
> fontsub.dll -
> fontsub!MergeFontPackage+0xdd0a:
> 69651311 8a28 mov ch,byte ptr [eax]
> ds:0023:03eb0030=??
> 0:021> k
> ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 0234b02c 69651503 fontsub!MergeFontPackage+0xdd0a
> 0234b058 69651aad fontsub!MergeFontPackage+0xdefc
> 0234b09c 69651b27 fontsub!MergeFontPackage+0xe4a6
> 0234b0b0 69651bc2 fontsub!MergeFontPackage+0xe520
> 0234b0d8 69647ab9 fontsub!MergeFontPackage+0xe5bb
> 0234b158 696436c5 fontsub!MergeFontPackage+0x44b2
> 0234b190 77c0740e fontsub!MergeFontPackage+0xbe
> 0234b1ec 77c04c0a gdi32!bMergeSubsetFont+0xe9
> 0234b268 77c04de0 gdi32!ProcessPages+0x48c
> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
> hpzpp5mc.DLL -
> 0234b29c 0208e48f gdi32!GdiGetPageCount+0x2f
> 0234b2e8 02087c6b hpzpp5mc!EnumPrintProcessorDatatypesW+0x753a
> 0234ee88 02097bfb hpzpp5mc!EnumPrintProcessorDatatypesW+0xd16
> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
> localspl.dll -
> 0234eeb0 763da229 hpzpp5mc!PrintDocumentOnPrintProcessor+0x5c
> 0234f948 763daadd localspl!SplDeleteSpooler+0xbd0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
> kernel32.dll -
> 0234ffb8 7c82482f localspl!SplDeleteSpooler+0x1484
> 0234ffec 00000000 kernel32!GetModuleHandleA+0xdf

KB961371 will cause spoolsv.exe crash !!
remove this patch should work~
hope someone can respond to Microsoft ~~~

"KK2009" <> wrote in message news:5CD6FF76-A414-4905-9EC7-...
> HI PA Bear,
>
> I found it from internet and it be gathered after we encounter that error.
> it is " Dr. Watson`s "dmp files
>

> This dump file has an exception of interest stored in it.


Why?

What is hpzpp5mc?

Perhaps you should check with HP?


---

[X-post to WinXP & Vista Printing newsgroups]

HP strikes again!

Anders L wrote:
> Latest news...
>
> Below you see the latest I have from MS (everything before this is
> only info collection from MS).
>
> It is the print processor that is supplied with the HP UPD driver
> version 4.7. So I have created a case with HP and asked for them to
> supply a solution. I haven't tried their solution yet, but I'm quite
> sure that it will work, but I'm not sure about how the UPD driver will
> work with the default print processor (must be a reason why they
> supply their own).
>
> So now I'm just waiting for HP.
>
> The solution isn't pretty because it actually requires that you change
> the print processor for each print queue that uses the HP supplied one
> (can for sure be done via registry editor, or prnadmin from resource
> kit tools).
>
> best regards
>
> Anders
>
> __________
>
> Hello Anders,
>
> Like I mentioned yesterday most of the incidents that we get that is
> related to the spooler is crashing is pointing to a print processor or
> print monitor, this is the case here as well. When you install the
> update we tighten up the security, now the problem seems to be that
> the print processor/monitor is not updated for this change and
> therefore the spooler is crashing. So the first step is to follow the
> below article and remove the non-default processors/monitors.
>
> 260142 How to troubleshoot printing problems in Windows
> 2000 and in Windows Server 2003
> http://support.microsoft.com/default...b;EN-US;260142
>
> In this specific dump that you provided to us it looks to be the
> following module that is causing the problem, it might be worth
> checking with HP if they have an updated version of this module, my
> guess is that they have already started to get some incoming calls
> around this module:
>
> 0:022> lmvm hpcpp084
> start end module name
> 01110000 0115a000 hpcpp084 (deferred)
> Image path: C:\WINDOWS\system32\spool\prtprocs\w32x86\hpcpp084 .dll
> Timestamp: Fri Jan 30 23:22:09 2009 (49837D91)
> CompanyName: Hewlett-Packard Corporation
> ProductName: HP Print Processor
> FileVersion: 61.084.05.38
> LegalCopyright: Copyright (C) Hewlett-Packard Corp. 1997-2002
>
> So to summarize the action:
>
> 1. Since you have this issue worldwide I think the best is to
> remove all 3rd party and non-default monitors and processors as
> described in the above article, but at least remove the one that is
> related to the above module.
> 2. Install the update
> 3. Let ADPlus run just in case the problem occurs again so that
> we can have a new dump ( and again, the best option is if all the
> monitors and processors have been removed )
>
> I am looking forward to hear about the outcome of the above and if you
> have any questions regarding the above don’t hesitate to give me a
> call or send me an email.
>
> __________
>
>
> On 23 Jul., 11:57, Anders Lewinsky <alewin...@gmail.com> wrote:
>> On 23 Jul., 07:56, Andy <A...@discussions.microsoft.com> wrote:
>>
>>
>>
>>> "KK2009" wrote:
>>>> HI PA Bear,
>>
>>>> I found it from internet and it be gathered after we encounter that
>>>> error. it is " Dr. Watson`s "dmp files
>>
>>>> This dump file has an exception of interest stored in it.
>>>> The stored exception information can be accessed via .ecxr.
>>>> (17f4.518): Access violation - code c0000005 (first/second chance not
>>>> available)
>>>> eax=03eb0030 ebx=0000000c ecx=00000000 edx=001e33fc esi=00000000
>>>> edi=0234b11c eip=69651311 esp=0234b024 ebp=0234b02c iopl=0 nv up ei pl
>>>> nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
>>>> efl=00010206
>>>> *** ERROR: Symbol file could not be found. Defaulted to export symbols
>>>> for fontsub.dll -
>>>> fontsub!MergeFontPackage+0xdd0a:
>>>> 69651311 8a28 mov ch,byte ptr [eax]
>>>> ds:0023:03eb0030=??
>>>> 0:021> k
>>>> ChildEBP RetAddr
>>>> WARNING: Stack unwind information not available. Following frames may
>>>> be
>>>> wrong.
>>>> 0234b02c 69651503 fontsub!MergeFontPackage+0xdd0a
>>>> 0234b058 69651aad fontsub!MergeFontPackage+0xdefc
>>>> 0234b09c 69651b27 fontsub!MergeFontPackage+0xe4a6
>>>> 0234b0b0 69651bc2 fontsub!MergeFontPackage+0xe520
>>>> 0234b0d8 69647ab9 fontsub!MergeFontPackage+0xe5bb
>>>> 0234b158 696436c5 fontsub!MergeFontPackage+0x44b2
>>>> 0234b190 77c0740e fontsub!MergeFontPackage+0xbe
>>>> 0234b1ec 77c04c0a gdi32!bMergeSubsetFont+0xe9
>>>> 0234b268 77c04de0 gdi32!ProcessPages+0x48c
>>>> *** ERROR: Symbol file could not be found. Defaulted to export symbols
>>>> for hpzpp5mc.DLL -
>>>> 0234b29c 0208e48f gdi32!GdiGetPageCount+0x2f
>>>> 0234b2e8 02087c6b hpzpp5mc!EnumPrintProcessorDatatypesW+0x753a
>>>> 0234ee88 02097bfb hpzpp5mc!EnumPrintProcessorDatatypesW+0xd16
>>>> *** ERROR: Symbol file could not be found. Defaulted to export symbols
>>>> for localspl.dll -
>>>> 0234eeb0 763da229 hpzpp5mc!PrintDocumentOnPrintProcessor+0x5c
>>>> 0234f948 763daadd localspl!SplDeleteSpooler+0xbd0
>>>> *** ERROR: Symbol file could not be found. Defaulted to export symbols
>>>> for kernel32.dll -
>>>> 0234ffb8 7c82482f localspl!SplDeleteSpooler+0x1484
>>>> 0234ffec 00000000 kernel32!GetModuleHandleA+0xdf
>>
>>> KB961371 will cause spoolsv.exe crash !!
>>> remove this patch should work~
>>> hope someone can respond to Microsoft ~~~
>>
>> I have a case with MS about this. I'll respond here when I know more.
>> They have received a MPS report and crash dump file generated with
>> windows debugging tools.
>>
>> And I can also confirm that removing KB961371 will get it working
>> again.
>>
>> The security update is also about some fonts, so it makes sense that
>> the update is related to this problem.
>>
>> http://www.microsoft.com/technet/sec.../MS09-029.mspx
>>
>> I'm able to crash the spooler by sending an excel document I have to
>> the print queue, so easy to reproduce, and both on a printer server
>> with alot of print queues/drivers, and on a printer server with only
>> two drivers (and the lastest version of these drivers are installed).
>>
>> best regards
>>
>> Anders