KB973346

[bowen]

After installing this update, one of our servers stopped printing. After
checking it out, the print spooler service has stopped. Restarting doesn't
help as the service almost instantly just stops. Checking the logs, I find
this:

Source: Application Error
Eventide: 1000
Spoolsv.exe Faulting application, version 5.2.3790.3959, faulting module
Gdi32.dll, version 5.2.3790.4396, fault address 0x00037453.

Has anyone encountered this before?

[PA Bear [MS MVP]]

See the "How to obtain help..." section of
http://support.microsoft.com/kb/973346.

[KK2009]

Please also check the patch KB961371, uninstall it should can resolved it.

Why U said it? it caused by KB961371 and MS didn`t provid other solution for
it.

[PA Bear [MS MVP]]

You do not want a computer to remain vulnerable to either exploit!

OP made no mention of having installed KB961371.

If OP's problem is related to having installed KB973346 (which includes
previously-released ActiveX Killbits), the computer had not been kept fully
patched in the past and MS Support will help him deal with the issue (which
is most likely caused by outdated software).

[KK2009]

HI PA Bear,

I found it from internet and it be gathered after we encounter that error.
it is " Dr. Watson`s "dmp files

This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(17f4.518): Access violation - code c0000005 (first/second chance not
available)
eax=03eb0030 ebx=0000000c ecx=00000000 edx=001e33fc esi=00000000 edi=0234b11c
eip=69651311 esp=0234b024 ebp=0234b02c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
fontsub.dll -
fontsub!MergeFontPackage+0xdd0a:
69651311 8a28 mov ch,byte ptr [eax]
ds:0023:03eb0030=??
0:021> k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be
wrong.
0234b02c 69651503 fontsub!MergeFontPackage+0xdd0a
0234b058 69651aad fontsub!MergeFontPackage+0xdefc
0234b09c 69651b27 fontsub!MergeFontPackage+0xe4a6
0234b0b0 69651bc2 fontsub!MergeFontPackage+0xe520
0234b0d8 69647ab9 fontsub!MergeFontPackage+0xe5bb
0234b158 696436c5 fontsub!MergeFontPackage+0x44b2
0234b190 77c0740e fontsub!MergeFontPackage+0xbe
0234b1ec 77c04c0a gdi32!bMergeSubsetFont+0xe9
0234b268 77c04de0 gdi32!ProcessPages+0x48c
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
hpzpp5mc.DLL -
0234b29c 0208e48f gdi32!GdiGetPageCount+0x2f
0234b2e8 02087c6b hpzpp5mc!EnumPrintProcessorDatatypesW+0x753a
0234ee88 02097bfb hpzpp5mc!EnumPrintProcessorDatatypesW+0xd16
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
localspl.dll -
0234eeb0 763da229 hpzpp5mc!PrintDocumentOnPrintProcessor+0x5c
0234f948 763daadd localspl!SplDeleteSpooler+0xbd0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
kernel32.dll -
0234ffb8 7c82482f localspl!SplDeleteSpooler+0x1484
0234ffec 00000000 kernel32!GetModuleHandleA+0xdf

[Andy]

KB961371 will cause spoolsv.exe crash !!
remove this patch should work~
hope someone can respond to Microsoft ~~~

Why?

What is hpzpp5mc?

Perhaps you should check with HP?

[Anders Lewinsky]

I have a case with MS about this. I'll respond here when I know more.
They have received a MPS report and crash dump file generated with
windows debugging tools.

And I can also confirm that removing KB961371 will get it working
again.

The security update is also about some fonts, so it makes sense that
the update is related to this problem.

http://www.microsoft.com/technet/sec.../MS09-029.mspx

I'm able to crash the spooler by sending an excel document I have to
the print queue, so easy to reproduce, and both on a printer server
with alot of print queues/drivers, and on a printer server with only
two drivers (and the lastest version of these drivers are installed).

[Anders L]

Latest news...

Below you see the latest I have from MS (everything before this is
only info collection from MS).

It is the print processor that is supplied with the HP UPD driver
version 4.7. So I have created a case with HP and asked for them to
supply a solution. I haven't tried their solution yet, but I'm quite
sure that it will work, but I'm not sure about how the UPD driver will
work with the default print processor (must be a reason why they
supply their own).

So now I'm just waiting for HP.

The solution isn't pretty because it actually requires that you change
the print processor for each print queue that uses the HP supplied one
(can for sure be done via registry editor, or prnadmin from resource
kit tools).

[bowen]

Had a look at all the printers we have installed on the server
that's got that issue but none of the print processors we have are using the
same one as you've got. However, I'm still inclined to think the it's still
HP related - after all, the printers we have on that server are all HP's. Too
coincidental now I think. Anyhow, please do post back if you do hear back
from HP. I'll do the same in case we find a fix ourselves.

should try running Win2Kn3 SP2

Problem is rising on W2k3SP2 ...

Any updates so far ??

Sorry...no luck on my end. In fact one of the print servers at our other site
now has a similar issue...

[Anders L]

I have a hotfix from MS for testing that fixes the issue. I had one
document where I could reproduce the problem, and with the hotfix
installed it prints just fine. Without the hotfix, the spooler
crashes, even with the latest HP UPD 5.0 driver.

The info I have is that it will be available in the middle of august.

I'm not allowed to share the hotfix (and it might not be the final
version). But I was given it to test if it fixed the issue, and
yes :-)

I will wait for the final release before installing the hotfix in our
production environment, had a sandbox server that I could use for the
testing. I think I'll remove the security update KB961371 untill the
hotfix is released (users complaining quite a bit) ;-)

[bowen]

Awesome news Anders! Looking forward to that hotfix. Hopefully it comes out
soon!

Also, we've found a work-around at the moment. On the printer's properties
in the Advanced tab, if you remove the tick on "Enable advanced printing
features" it actually will stop the spooler from crashing. However, you do
lose the advanced options of your printer. Looks like we'll have to stay on
this until that hotfix is out.

[DaHude]

I am also looking formaward to test the final version asap.
Meanwhile we decided to rollback the patch (since this is possible
without restarting the server) and wait for a final release from M$.

Please keep us informed.

[Anders L]

Update finally avalible!!

http://www.microsoft.com/technet/sec.../MS09-029.mspx

If you download again you will se that it has a "v2" in the name. Also
under revisions you can see info about the update.

[DaHude]

thanks for keepin up2 date.
I will give it a try on one of my Spoolers which were affected last
time.

Thanks again and best regards.

[bowen]

Thanks for everything guys! Can confirm that the hotfix that MS came out with
has fixed our issue.