locked
Excessive CPU usage by Spooler service RRS feed

  • Question

  • I am running Windows 7 64 bit. The spooler service uses 50% of the cpu. There are no files in the system32/spooler/printers folder. When I try to open Printers and devices in the control panel it runs forever but will not open. The thread running indicates that Adobe Reader is attempting to open ntdll.dll.

    Help!

    Saturday, October 23, 2010 11:55 PM

Answers

  • Andre's advice started me thinking. I used Process Explorer to identify the troublesome thread. I then looked at the stack and found a looping dll - E_IUIC19SA.DLL. Th properties indicated it was opened by Adobe Reader which is strange since I don't think Adobe Reader can open a DLL. The properties indicated the DLL was a component of an Epson color printer driver. I renamed the file E_IUIC19SA.DUD and rebooted. Everything is now fine all my installed printers are back and working and I have no print spooler problems.

    Andre thank you for your assistance and patience. Could you have confused my etl file with another one.

    • Marked as answer by jctx2 Friday, October 29, 2010 6:23 PM
    Friday, October 29, 2010 6:22 PM

All replies

  • Hi,

    make a xperf trace [1] to diagnostic the high CPU usage. Please upload the etl file to your SkyDrive [2] and post a link here.

    I'll take a look at it.

    André

    [1] http://www.msfn.org/board/index.php?showtopic=140264
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, October 24, 2010 9:39 AM
  • Hi André,

    Thanks for offering to help but I ran into problems following your instructions. I had no problem installing the SDK Performance tools but when I ran xperf I got a message saying my computer was not fully configured and stated the same instruction I found later in your instruction.

    HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management

    and create a DWORD (if it not already exists) DisablePagingExecutive and set the value to 1 and reboot to enable the setting.

    I went into regedit and did a key search for HKLM. Thu only thing I found was two instances of HKLMEmailName. My registry does not contain the key above.

    I can offer a little more information. I tried doing a clean boot with all start up programs disabled and all services except Microsoft's disabled. The problem was still there and again the thread consuming the cpu was Adobe Reader attempting to open ntdll.dll

    I still need help!

    Tuesday, October 26, 2010 5:26 PM
  • Have you set the DisablePagingExecutive value? Does it work?

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, October 26, 2010 9:48 PM
  • No I have not disabled it as I said above my registry does not contain the referenced HKLM key.
    Wednesday, October 27, 2010 2:48 PM
  • ok, create the value and try it again.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, October 27, 2010 2:55 PM
  • I don't know how to to that.
    Wednesday, October 27, 2010 6:27 PM
  • Run windows update, update everything and reboot. Update the security software and run a full scan. Recent malware uses the spooler service.
    Wednesday, October 27, 2010 8:10 PM
  • What don't you know? Creating the value? make a right click, select new->DWORD (32Bit) and give it the name and set the value to 1.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, October 27, 2010 10:16 PM
  • I don't know where to put it. As I said earlier. I went into regedit and did a key search for HKLM. Thu only thing I found were two instances of HKLMEmailName. My registry does not contain the key HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management What do I need to add and where do I put it.
    Wednesday, October 27, 2010 11:18 PM
  • HKLM = HKEY_LOCAL_MACHINE

    so the full path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, October 28, 2010 10:29 AM
  • OK, I finally got it. Here is the link

     

    https://cid-0dee5ac89a5fa994.skydrive.live.com/redir.aspx?resid=DEE5AC89A5FA994!183

    Thursday, October 28, 2010 5:20 PM
  • OK, I finally got it. Here is the link

     

    https://cid-0dee5ac89a5fa994.skydrive.live.com/redir.aspx?resid=DEE5AC89A5FA994!183

    the link doesn't work. Set the sharing permission to everyone so that I can see the file.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, October 28, 2010 11:00 PM
  • Done. try again
    Friday, October 29, 2010 12:45 AM
  • Hi,

    ok, I checked the trace and found the cause:

     

    Process Name, Process, Stack, Count, Cpu, Count: Sampled Profile
    spoolsv.exe, spoolsv.exe (1424), [Root], 3978, , 3978
    , ,    |- ntdll.dll!RtlUserThreadStart, 3947, , 3947
    , ,    |     kernel32.dll!BaseThreadInitThunk, 3947, , 3947
    , ,    |     ntdll.dll!TppWorkerThread, 3947, , 3947
    , ,    |     ntdll.dll!TppSimplepExecuteCallback, 3947, , 3947
    , ,    |     win32spl.dll!NThreadingLibrary::TWorkCrew::tpSimpleCallback, 3947, , 3947
    , ,    |     win32spl.dll!TPrintOpen::InitializeSpoolers, 3947, , 3947
    , ,    |     win32spl.dll!TPrintOpen::InitializeServer, 3947, , 3947
    , ,    |     win32spl.dll!TPrintOpen::InitializeServerPrinters, 3947, , 3947
    , ,    |     win32spl.dll!TPrintOpen::DeleteLocalPrinter, 3947, , 3947
    , ,    |     win32spl.dll!NCSRCommon::TLocalPrinter::Delete, 3947, , 3947
    , ,    |     localspl.dll!SplDeletePrinterWithJobs, 3947, , 3947
    , ,    |     localspl.dll!InternalDeletePrinter, 3947, , 3947
    , ,    |     localspl.dll!PrinterDriverEvent, 3947, , 3947
    , ,    |     localspl.dll!SplDriverEvent, 3947, , 3947
    , ,    |     localspl.dll!sandbox::SandboxPrinterDriverEvent, 3947, , 3947
    , ,    |     localspl.dll!sandbox::SandboxObserver::SandboxDriverEvent, 3947, , 3947
    , ,    |     PrintIsolationProxy.dll!sandbox::PrintSandboxObject::SandboxDriverEvent, 3947, , 3947
    , ,    |     winspool.drv!SpoolerPrinterEvent, 3947, , 3947
    , ,    |     winspool.drv!SpoolerPrinterEventNative, 3947, , 3947
    , ,    |     E_GU39SE.DLL !?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     E_GU39SE.DLL!?, 3947, , 3947
    , ,    |     |- E_GU39SE.DLL!?, 3944, , 3944
    , ,    |     |     |- E_GU39SE.DLL!?, 3692, , 3692


    the DLL E_GU39SE.DLL is the cuase.

    Look at the file properties to see who is the maker of the DLL and update the software or remove it.

    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, October 29, 2010 12:01 PM
  • Maybe I am being dense again, but I can't find it. I went into file explorer and did a search on all drives but found nothing. I searched the registry for a reference and found nothing. I am perplexed. What am I missing?
    Friday, October 29, 2010 2:29 PM
  • Open Windows Explorer, select organize at the top left, select file and folder options, select view tab, select show hidden files and folders, ok, close out and search again.
    Friday, October 29, 2010 4:12 PM
  • This was done when I got the computer. I checked it when I couldn't find the file and show hidden files is still selected.
    • Marked as answer by jctx2 Friday, October 29, 2010 6:06 PM
    • Unmarked as answer by jctx2 Friday, October 29, 2010 6:07 PM
    Friday, October 29, 2010 5:25 PM
  • Andre's advice started me thinking. I used Process Explorer to identify the troublesome thread. I then looked at the stack and found a looping dll - E_IUIC19SA.DLL. Th properties indicated it was opened by Adobe Reader which is strange since I don't think Adobe Reader can open a DLL. The properties indicated the DLL was a component of an Epson color printer driver. I renamed the file E_IUIC19SA.DUD and rebooted. Everything is now fine all my installed printers are back and working and I have no print spooler problems.

    Andre thank you for your assistance and patience. Could you have confused my etl file with another one.

    • Marked as answer by jctx2 Friday, October 29, 2010 6:23 PM
    Friday, October 29, 2010 6:22 PM
  • Could you have confused my etl file with another one.

    What do you mean?

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, October 29, 2010 10:06 PM
  • My computer does not have the DLL you showed in the trace. E_GU39SE.DLL. I did find the DLL that was causing my problem. E_IUIC19SA.DLL. I meant you may be looking at several etl files with similar problems and gave me the results from the wrong file.

    I don't know how to use the etl trace but I would like too. How do I find the section you referenced?

    Friday, October 29, 2010 10:44 PM
  • it was your etl. Do it like I wrote in the guide. Select an internal with high CPU usage, make a rightclick and select "copy selection" go to the diagram with the stackcount and click on Summary table. It will show you the same DLL.
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, October 29, 2010 10:53 PM
  • Yes, I see it but I don't understand it. That DLL ( E_GU39SE.DLL) is not on my machine. In any case getting rid of E_IUIC19SA.DLL fixed my problem. Everything is fine now.
    Saturday, October 30, 2010 1:46 AM