Re: RPC Server is unavailable/Printer Spooler is not running

I have the same problem. I'm new here, so bear with me. This happened to me about a week ago, around 8/24 and it seems to have come in the aftermath of what I thought was a minor virus attack by a defender.exe virus:


I have Windows XP Pro. My printer simply stopped working 6 or 7 days ago. I did some online research:

I have gone through Run -> services.msc to the list of services.
Print Spooler had been set to "Manual" under Start-Up Type in this list when I checked it. I changed it to Automatic and set it to "started". The line for status will not remain set at "Started". Every time I turn off the machine, that line goes blank. So I accordingly reset the Remote Procedure Call and the Remote Procedure Call Locator, which also had mysteriously changed to "Manual". The "Log On As" setting I wasn't so sure about - this computer used to be networked at my former office, now it's a stand alone machine, so I changed those settings both ways, setting them one time to Networked, and the other time to Local Only, and neither setting seemed to make any difference - computer will not print or acknowledge a printer or add a printer.

After each of these changes, I rebooted the computer, the changes stay as I put them, except for the Print Spooler Status will not remain "Started" with each reboot - I have to manually change it to "Start" on the services list page, even though the "Start Up Type" does stay set to "Automatic". Each time services.msc is closed, the Print Spooler Status reverts from Started, to just blank. In any of these configurations, when I try to print, absolutely nothing happens.

I go to Printers and Faxes, hit "Install a printer" and get the dratted Warning message: "Print Spooler is not in service"

I did have a (seemingly) minor virus attack this machine early in the morning when this happened, a defender.exe. I hit rKill and stopped it, ran Malwarbytes right away, and I thought I had removed it with no trouble. Could there be a connection? The computer seems to be working fine since then, except this mysterious disappearance of a connection to my printer...

I tried to restore to a few days prior to the "attack" and the process goes and then the machine says "Windows cannot restore your computer to this date." No explanation given...

There has been no resurgence of what would appear to be viral activity since I cleared it out with rkill and Malwarebytes.


Any ideas will be appreciated.

 

I dont have XP to check as I run 7 but the RPC service on 7 is not configurable and should be set to Started and Automatic. In the properties of that service on the log on tab, it should be set to This Account. The account name should be Network Service with a prefilled password.

The RPC locator service by default should not be started and should be set to Manual as it is only started when called by another program or process that needs it. The log on tab of that service displays the same Network Service and prefilled password.

The print spooler service should be Started and set to Automatic. the log on tab in the properties of this service is set to the Local System Account with a checkmark in the sub option Allow service to interact with desktop.

Try to duplicate the above, power down the machine and power up.

*Please note, since I run 7, the info that I gave for XP may be wrong. Can someone with XP confirm.

 

Thanks techsent. I'm trying to make these changes but:

for the printer spooler : I try to change Log from "Local system" to "This Account". The name for This Account is blank and there is an approx. 10-digit password already logged there. If I write "Network Service" in the blank space for the account name, it beeps and says "please enter a valid password". If I go to Browse for the blank space, I get a button that says

Select This Object Type: and in that is one choice:

"User or Built in security-principal"...

Below that is a line that contains the following

"From this location:" and the only choice is:
VALENTE-05B865F [name of the computer maybe? From the office it came from, anyway]

And below that a blank box with a legend saying "enter the object name to select"

ADDED to this Reply - I looked at all the other services in the list marked "Network Service": all of the others have the Log On Name "NT AUTHORITY\NetworkService" So I copied that and put it in the space for the name of the one for the Print Spooler and it still gives me the beep, "enter valid password" The password is 12 dots long and is the same size as the password entered in all the other boxes for the other services. (I don't know what the password is and wonder how I might be able to find it out, if I'm going to have to reacquire it)...



I am stumped.
Got any ideas how to get it to say "Network Service" again?

I think your tips may help me get this thing set back like its supposed to be. Thanks a lot.

 

welcome.

the print spooler should be set to the local system account.

for the rpc locator, click the browse button again, click the advanced button, click the find now button. click on the network service entry in the list and then click ok 3 times.

 

Thanks Techsent. I tried those things, and for the RPC logon Network setting, I clicked OK three times, it mounted "Network Service" up onto the line, and then beeped and said "enter a valid password". The 12 black dots show up in the password line, and in the "confirm password" line below it. I have not changed or altered the password since beginning to tinker with this, so far as I am aware. I wonder what is wrong. The passwords in the other Network Services on the list have a password that is exactly the same number of dots, anyway. I wonder what password this is? Got any ideas? II mean I know you don't likely know what the password is, but I wonder who set it originally. I can get hold of the guy who set these machines up, but it was a long time ago...Thanks again.

 

the problem may be related to the windows permissions for your user account since you cant save any changes.

try creating a new administrator account. reboot, login and check the services.

____

clear out the password boxes and click ok.

 

Thanks Techsent. I'm going to display some of my vast wealth of computer ignorance here.

I talked to the "administrator" of this computer last night, the husband of a woman I used to work with. We got to that password part and he said he had no idea where those passwords came from or how they could be found...

Log In -> This Account -> Browse -> Select User ->Advanced-> Find Now

In Find Now there is a Box with these choices:

NAME (RDN)
Administrator
Guest
[My name]
LOCAL SERVICE
NETWORK SERVICE


NETWORK SERVICE selection puts the right ID in the Log In box for This Account, but the password is not good. If I use the one for my own name, is it likely to take my log-in password for the whole machine, do you think? Will it likely work if it's set up that way? I'm asking, because if I change that password, I may have no hope of getting back to the right one. I guess I'll try this and let you know what happens...

 

Techsent, I looked at your last message again - I tried "Log On" to the RPC Locator by simply erasing the password in both lines and it worked like a charm. The RPC is set to Auto and the RPC Locator is set to Manual, which is how the old administrator said his were set up when I spoke to him on the phone last night. The printer is working like a charm, so far. "Printers and Faxes" displays all the machines that are and were hooked up to this baby, so I'm back in business.

Thank you SO much for your advice with this. It saved me the trouble of disconnecting and hauling this big machine to a repair shop. I really appreciate it.

-eidolon.

 

np, welcome