Print Spool Missing after rootkit and malware was deleted

Discussion in 'Software' started by jdmcgowa, Jan 3, 2012.

  1. jdmcgowa

    jdmcgowa Private E-2

    Greetings! Thanks for anyone who can help. I am working on a windows XP 2002 professional service pack 3 computer which I recently ran Hitman Pro to get rid of a root kit and malware issue. The only problem seems to be the printer driver no longer works. I have copied a version of spoolsvc.exe from the system 32 folder in Windows 7 but it does not seem to correct this issue. I have gone through services.msc to make sure it has been started and I get an Error 1075: dependency service does not exist or has been marked for deletion. I am running a small SOHO with 12 user stations and I do have access to another workstation with windows XP for system files. How should I approach this issue? I am looking for an easy way or a better understanding of the issue before i attempt to do something that takes much longer or involve a system restore. I am cannot find any XP OS discs as well. I remember could restart in safe mode and roll back drivers but when they are deleted or corrupt in System 32 does this still work? Thanks for the direction!
     
  2. tgell

    tgell Major Geek Extraordinaire

  3. jdmcgowa

    jdmcgowa Private E-2

    The Microsoft Run It does not seem to correct the issue. I have gone throught the support forums there as well. I do know there was no longer this spoolsvc in System32, I have replaced it with a .dll and .exe of spoolsvc (from windows 7) but without any luck. I could try and grab the spoolsvc from the windows XP of a working computer I have, i just did not think the versions were different.
     
  4. tgell

    tgell Major Geek Extraordinaire

    The registry may be corrupted. Look at this key,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler and compare it to your other XP computer. Do the keys match?

    Edit: I am not sure if spoolsvc.exe from XP matches the one from Windows 7. I would think not. You may be able to find that file in C:\Windows\ServicePackFiles\I386
     
  5. jdmcgowa

    jdmcgowa Private E-2

    Tgell: Thank you for your help. I have replaced the spool folder in System32 with one from a working XP computer as well as replaced the spoolsv.exe with an XP version just in case. I have compared the registry folder and the only thing that differs is [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Security]. Overall, there is one binary key in this Security Subdirectory which the binary data differs. I still am not able to start the print spool from services.msc.
     
  6. tgell

    tgell Major Geek Extraordinaire

    When you right click on the spooler service. Select the Dependencies tab. It should say RPC (Remote Procedure Call) service. Is that service started and set to automatic.
     
  7. jdmcgowa

    jdmcgowa Private E-2

    It is and set to auto
     
  8. tgell

    tgell Major Geek Extraordinaire

    Can you post screen shots of the the General Tab and the Logon Tab of the RPC service?

    I am running out of ideas. It must be something a lot deeper that is involved.
     
  9. tgell

    tgell Major Geek Extraordinaire

    On the printer spooler service, there was only one dependency, RPC, correct?

    If there was. I only have one more idea left. Download the Tweaking.com Windows Repair and select Repair WMI.

    http://majorgeeks.com/download.php?det=7141

    Edit: the general tab and logon tab look okay.
     
  10. jdmcgowa

    jdmcgowa Private E-2

    Tgell: I am running out of ideas as well. Rebuilding the WMI did not work and I do not have a System Restore of XP. I have been marked as the IT guy of this old SOHO. If I get the error 1075 that the Print Spooler dependency has been marked for deletion is there a way to reinstall or rebuild the Remote Procedure Call? Or perhaps check the path to the executable?

    C:\WINDOWS\system32\svchost -k rpcss

    Edit: svchost is there but I do not know the attribute -k and what it may mean.

    Is there another direction I can go in or get an image of the System Recovery cd?

    Jessica Brown: It is quite hard to know the context of your sentence without further detail. Have you read through the other forums as well? I would first check your services.msc to see if your printer spool it set to auto. That means go to Start> Run> and type "services.msc". Click ok and you will find the Print Spooler and see if it is on and set to auto. [Refer to images in this thread for the settings] It might be best to start another thread or read through related ones if you get the chance to.
     
  11. jdmcgowa

    jdmcgowa Private E-2

    I FIXED IT!!!!! Whew :cool

    Tgell you were correct in thinking it was a registry issue. It almost just had to be. Thank you for your time.

    Action taken for those who read this in the future:

    1. Click on Start > and type regedit.exe in search bar and hit enter.
    2. Go back to the registry key: HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Spooler
    3. Double-click the DependOnService value found in the Spooler folder
    4. Delete the data present, and then type RPCSS
    5. Restart the computer.
    6. Click on Start > and type services.msc. Go to RPC and start manually (if already started go no worries) then go to the Print Spooler and start the service.
    7. Click on Add Pinter /Fax located under the start menu and you should find all your drivers back there again.
     
  12. tgell

    tgell Major Geek Extraordinaire

    Nice Work! I am sure other people will find what you did useful and thank your for the feedback. :)
     
  13. datauk

    datauk Private E-2


    i tried all that and there is NO print spooler on my pc not in registry i have been online and can't find anywhere to download it and Microsoft want to charge me £69 TO "TRY" and fix it i turned them down they said it was a malware problem but i have scanned it with three different scanners and they say there is NO malware is there any one that can help my OS is win7 home premium x64 please help !!
     
  14. plodr

    plodr Major Geek Super Extraordinaire

    datauk, welcome to Major Geeks. You need to start a new thread with your problem. You do not dredge up a post from 11 months ago and you do not put your problem in someone else's thread.
    Go here: http://forums.majorgeeks.com/forumdisplay.php?f=21 and click the New Thread button near the top left.

    In addition to what you tried and your mention of the version of windows you are running, you need to mention the brand and model of printer involved.
    and those would be?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds