KB973346

[X-post to WinXP & Vista Printing newsgroups]

HP strikes again!

Anders L wrote:
Latest news...

Below you see the latest I have from MS (everything before this is
only info collection from MS).

It is the print processor that is supplied with the HP UPD driver
version 4.7. So I have created a case with HP and asked for them to
supply a solution. I haven't tried their solution yet, but I'm quite
sure that it will work, but I'm not sure about how the UPD driver will
work with the default print processor (must be a reason why they
supply their own).

So now I'm just waiting for HP.

The solution isn't pretty because it actually requires that you change
the print processor for each print queue that uses the HP supplied one
(can for sure be done via registry editor, or prnadmin from resource
kit tools).

best regards

Anders

__________

Hello Anders,

Like I mentioned yesterday most of the incidents that we get that is
related to the spooler is crashing is pointing to a print processor or
print monitor, this is the case here as well. When you install the
update we tighten up the security, now the problem seems to be that
the print processor/monitor is not updated for this change and
therefore the spooler is crashing. So the first step is to follow the
below article and remove the non-default processors/monitors.

260142 How to troubleshoot printing problems in Windows
2000 and in Windows Server 2003
http://support.microsoft.com/default...b;EN-US;260142

In this specific dump that you provided to us it looks to be the
following module that is causing the problem, it might be worth
checking with HP if they have an updated version of this module, my
guess is that they have already started to get some incoming calls
around this module:

0:022 lmvm hpcpp084
start end module name
01110000 0115a000 hpcpp084 (deferred)
Image path: C:\WINDOWS\system32\spool\prtprocs\w32x86\hpcpp084 .dll
Timestamp: Fri Jan 30 23:22:09 2009 (49837D91)
CompanyName: Hewlett-Packard Corporation
ProductName: HP Print Processor
FileVersion: 61.084.05.38
LegalCopyright: Copyright (C) Hewlett-Packard Corp. 1997-2002

So to summarize the action:

1. Since you have this issue worldwide I think the best is to
remove all 3rd party and non-default monitors and processors as
described in the above article, but at least remove the one that is
related to the above module.
2. Install the update
3. Let ADPlus run just in case the problem occurs again so that
we can have a new dump ( and again, the best option is if all the
monitors and processors have been removed )

I am looking forward to hear about the outcome of the above and if you
have any questions regarding the above don’t hesitate to give me a
call or send me an email.

__________


On 23 Jul., 11:57, Anders Lewinsky wrote:
On 23 Jul., 07:56, Andy wrote:



"KK2009" wrote:
HI PA Bear,

I found it from internet and it be gathered after we encounter that
error. it is " Dr. Watson`s "dmp files

This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(17f4.518): Access violation - code c0000005 (first/second chance not
available)
eax=03eb0030 ebx=0000000c ecx=00000000 edx=001e33fc esi=00000000
edi=0234b11c eip=69651311 esp=0234b024 ebp=0234b02c iopl=0 nv up ei pl
nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for fontsub.dll -
fontsub!MergeFontPackage+0xdd0a:
69651311 8a28 mov ch,byte ptr [eax]
ds:0023:03eb0030=??
0:021 k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be
wrong.
0234b02c 69651503 fontsub!MergeFontPackage+0xdd0a
0234b058 69651aad fontsub!MergeFontPackage+0xdefc
0234b09c 69651b27 fontsub!MergeFontPackage+0xe4a6
0234b0b0 69651bc2 fontsub!MergeFontPackage+0xe520
0234b0d8 69647ab9 fontsub!MergeFontPackage+0xe5bb
0234b158 696436c5 fontsub!MergeFontPackage+0x44b2
0234b190 77c0740e fontsub!MergeFontPackage+0xbe
0234b1ec 77c04c0a gdi32!bMergeSubsetFont+0xe9
0234b268 77c04de0 gdi32!ProcessPages+0x48c
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for hpzpp5mc.DLL -
0234b29c 0208e48f gdi32!GdiGetPageCount+0x2f
0234b2e8 02087c6b hpzpp5mc!EnumPrintProcessorDatatypesW+0x753a
0234ee88 02097bfb hpzpp5mc!EnumPrintProcessorDatatypesW+0xd16
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for localspl.dll -
0234eeb0 763da229 hpzpp5mc!PrintDocumentOnPrintProcessor+0x5c
0234f948 763daadd localspl!SplDeleteSpooler+0xbd0
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for kernel32.dll -
0234ffb8 7c82482f localspl!SplDeleteSpooler+0x1484
0234ffec 00000000 kernel32!GetModuleHandleA+0xdf

KB961371 will cause spoolsv.exe crash !!
remove this patch should work~
hope someone can respond to Microsoft ~~~

I have a case with MS about this. I'll respond here when I know more.
They have received a MPS report and crash dump file generated with
windows debugging tools.

And I can also confirm that removing KB961371 will get it working
again.

The security update is also about some fonts, so it makes sense that
the update is related to this problem.

http://www.microsoft.com/technet/sec.../MS09-029.mspx

I'm able to crash the spooler by sending an excel document I have to
the print queue, so easy to reproduce, and both on a printer server
with alot of print queues/drivers, and on a printer server with only
two drivers (and the lastest version of these drivers are installed).

best regards

Anders

this one is an MS issue.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base he
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

"PA Bear [MS MVP]" wrote in message
...
[X-post to WinXP & Vista Printing newsgroups]

HP strikes again!

Anders L wrote:
Latest news...

Below you see the latest I have from MS (everything before this is
only info collection from MS).

It is the print processor that is supplied with the HP UPD driver
version 4.7. So I have created a case with HP and asked for them to
supply a solution. I haven't tried their solution yet, but I'm quite
sure that it will work, but I'm not sure about how the UPD driver will
work with the default print processor (must be a reason why they
supply their own).

So now I'm just waiting for HP.

The solution isn't pretty because it actually requires that you change
the print processor for each print queue that uses the HP supplied one
(can for sure be done via registry editor, or prnadmin from resource
kit tools).

best regards

Anders

__________

Hello Anders,

Like I mentioned yesterday most of the incidents that we get that is
related to the spooler is crashing is pointing to a print processor or
print monitor, this is the case here as well. When you install the
update we tighten up the security, now the problem seems to be that
the print processor/monitor is not updated for this change and
therefore the spooler is crashing. So the first step is to follow the
below article and remove the non-default processors/monitors.

260142 How to troubleshoot printing problems in Windows
2000 and in Windows Server 2003
http://support.microsoft.com/default...b;EN-US;260142

In this specific dump that you provided to us it looks to be the
following module that is causing the problem, it might be worth
checking with HP if they have an updated version of this module, my
guess is that they have already started to get some incoming calls
around this module:

0:022 lmvm hpcpp084
start end module name
01110000 0115a000 hpcpp084 (deferred)
Image path: C:\WINDOWS\system32\spool\prtprocs\w32x86\hpcpp084 .dll
Timestamp: Fri Jan 30 23:22:09 2009 (49837D91)
CompanyName: Hewlett-Packard Corporation
ProductName: HP Print Processor
FileVersion: 61.084.05.38
LegalCopyright: Copyright (C) Hewlett-Packard Corp. 1997-2002

So to summarize the action:

1. Since you have this issue worldwide I think the best is to
remove all 3rd party and non-default monitors and processors as
described in the above article, but at least remove the one that is
related to the above module.
2. Install the update
3. Let ADPlus run just in case the problem occurs again so that
we can have a new dump ( and again, the best option is if all the
monitors and processors have been removed )

I am looking forward to hear about the outcome of the above and if you
have any questions regarding the above don’t hesitate to give me a
call or send me an email.

__________


On 23 Jul., 11:57, Anders Lewinsky wrote:
On 23 Jul., 07:56, Andy wrote:



"KK2009" wrote:
HI PA Bear,

I found it from internet and it be gathered after we encounter that
error. it is " Dr. Watson`s "dmp files

This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(17f4.518): Access violation - code c0000005 (first/second chance not
available)
eax=03eb0030 ebx=0000000c ecx=00000000 edx=001e33fc esi=00000000
edi=0234b11c eip=69651311 esp=0234b024 ebp=0234b02c iopl=0 nv up ei pl
nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for fontsub.dll -
fontsub!MergeFontPackage+0xdd0a:
69651311 8a28 mov ch,byte ptr [eax]
ds:0023:03eb0030=??
0:021 k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be
wrong.
0234b02c 69651503 fontsub!MergeFontPackage+0xdd0a
0234b058 69651aad fontsub!MergeFontPackage+0xdefc
0234b09c 69651b27 fontsub!MergeFontPackage+0xe4a6
0234b0b0 69651bc2 fontsub!MergeFontPackage+0xe520
0234b0d8 69647ab9 fontsub!MergeFontPackage+0xe5bb
0234b158 696436c5 fontsub!MergeFontPackage+0x44b2
0234b190 77c0740e fontsub!MergeFontPackage+0xbe
0234b1ec 77c04c0a gdi32!bMergeSubsetFont+0xe9
0234b268 77c04de0 gdi32!ProcessPages+0x48c
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for hpzpp5mc.DLL -
0234b29c 0208e48f gdi32!GdiGetPageCount+0x2f
0234b2e8 02087c6b hpzpp5mc!EnumPrintProcessorDatatypesW+0x753a
0234ee88 02097bfb hpzpp5mc!EnumPrintProcessorDatatypesW+0xd16
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for localspl.dll -
0234eeb0 763da229 hpzpp5mc!PrintDocumentOnPrintProcessor+0x5c
0234f948 763daadd localspl!SplDeleteSpooler+0xbd0
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for kernel32.dll -
0234ffb8 7c82482f localspl!SplDeleteSpooler+0x1484
0234ffec 00000000 kernel32!GetModuleHandleA+0xdf

KB961371 will cause spoolsv.exe crash !!
remove this patch should work~
hope someone can respond to Microsoft ~~~

I have a case with MS about this. I'll respond here when I know more.
They have received a MPS report and crash dump file generated with
windows debugging tools.

And I can also confirm that removing KB961371 will get it working
again.

The security update is also about some fonts, so it makes sense that
the update is related to this problem.

http://www.microsoft.com/technet/sec.../MS09-029.mspx

I'm able to crash the spooler by sending an excel document I have to
the print queue, so easy to reproduce, and both on a printer server
with alot of print queues/drivers, and on a printer server with only
two drivers (and the lastest version of these drivers are installed).

best regards

Anders