Spoolsv.exe eating ram? Hijackthis logs attached

[TorturedChaos]

Yesterday, I was called up front at work to see why two of the computers up there were running really slow and crashing acrobat when anyone tried to print from acrobat. I took at look at what was happening, and when she tried to print from acrobat, it locked up. So I looked that what was running, and the memory usage. All programs are closed out, and its using 1.7gigs of memory!!!. So I try killing things associated with acrobat, wondering if any of those have a memory leak. Still 1.7gigs. So I try killing spoolsv.exe, bam down to ~250mb.....

Same thing happen on the other computer up front. I tried printing a couple things, and before you know its up to 750mb of memory being used while doing nothing, kill spoolsv.exe, back down the 250mb range.

So I tried running AVG free addition anti-virus on both machines, and it didn't find anything. Still having issues.

I attached the hijackthis logs fromt he two machines that are having the issue. The third machine up there is not having any issues, nor are the other 3 computers in the build or the one mac. If you need any more info let me know.

Thanks

 

[kimsland]

Uninstall the printer driver
Obtain the latest printer driver and install it.

Also confirm all security updates completed

Failing that:
Printer Model?
OS?

 

[TorturedChaos]

Windows xp sp2
Prints, are 3 xerox large format 8830, Xerox 4112, Xerox DC242, Canon IR105. I work in a print shop. All the machines are hooked up to a switch and printers are hooked up to a single switch.

I'll check if there are any updates for the drives. It seems to have the most issues printing to the large formats, but that might just be because a 24x36 takes up a lot more memory than an 8 1/2 x 11

 

[kimsland]

hooked up to a switch

And when you try individually directly to the computer??

Also does the switch have drivers too? (retorical question)

I'll leave it with you to test further, please reply back, with the results later on...

 

[TorturedChaos]

i dont know if the switch has any drivers, but i dont have any issue printing to any networked printer from any computer but those two up front, And they all hook into the same switch, and have the same drivers for all the prints, so im going to say its not an issue with the switch or the network.
The issue with the print spooler just started happening recently.

Also the computer seem to have the most up to date drivers for the 8830. I will check the xerox drivers next

 

[kimsland]

Also after all these driver updates

Please check individually connected to one computer (if possible, umm probably not I suppose, ie network)

 

[DelJo63]

ask yourself "What changed"? -- chase any/all of them for possible impact(s).

Does the spooler fail ONLY on the system that has the printer attached?

Have you tried printing any other acrobat file on the failing system?

Have you moved the file to another system and tried printing from there?

The object of all this is to isolate the System from the Data and to get a logical suspect

 

[TorturedChaos]

ask yourself "What changed"? -- chase any/all of them for possible impact(s).

Does the spooler fail ONLY on the system that has the printer attached?

None of our printers are directly attached, everything runs through a switch. All the printers are networked printers.

Have you tried printing any other acrobat file on the failing system?

ok, so i have tried several pdf files, and all of them seem to constanly increase the amount of memory used, but when i kill spoolsv.exe and restart the print spooler, the memory usage goes down to normal.

Although, it appears that print from other applications doesn't seem to screw it up. I tried print tiff's from acxess tools, and it doesn't seem to be eating up the ram, sitting steady at ~250mb.

Have you moved the file to another system and tried printing from there?

The files are stored on our local server, and print fine from other computes w/o screwing up the print spooler.

The object of all this is to isolate the System from the Data and to get a logical suspect

so im think acrobate is where the issue is, and im going to try re-installing it today.

thanks for the help so far.

 

[kimsland]

There were some MS articles on Server 2003 with high mem usage (only for the server itself though) the recommendation was to do all security updates

 

[DelJo63]

so im think acrobate is where the issue is, and im going to try re-installing it today.

From your reply, I would concur.

 

[TorturedChaos]

So i re-installed acrobat, and updated it. The issue is still occuring. They printed several pdf's while i was at lunch, came back using 1gig of memory, killed spoolsv.exe, went down to 200mb.....

So i went to the windows web site, check for updates, and there were no new updates...

So back to searching for a solution.

Any more idea's guys?

 

[DelJo63]

no matter how or where the printer is connected, every system using printer-A
needs the correct driver to facilitate using all of the features.

Using some generic print driver, especially in a hi-end publishing environment
would be a big mistake.

 

[TorturedChaos]

no matter how or where the printer is connected, every system using printer-A
needs the correct driver to facilitate using all of the features.

Using some generic print driver, especially in a hi-end publishing environment
would be a big mistake.

No everything has legit print drivers from the makers website. Those computers have had the legit print drivers since they were setup. And none of the computers just share the printer to the others, all the computers had there prints setup individually, and the drivers installed one each one.

I just cant think of what has changed recently that would cause this issue.

 

[DelJo63]

No everything has legit print drivers from the makers website. Those computers have had the legit print drivers since they were setup. And none of the computers just share the printer to the others, all the computers had there prints setup individually, and the drivers installed one each one.

websites ? Guess you mean the printer's manufacturer's site and downloaded the
drivers from there.

Yes, when the printer was 'mapped', the appropriate driver had to be loaded on every
system, even when a printer is locally attached to one system.

It looks to me that the document you are attempting to print is damaged.

Take something simple, like www.google.com and print it -- if that will not print,
then there's a major issue with the hardware?? Can you get the printer to
print its own Test Page?

 

[TorturedChaos]

No the files are not damaged, they print fine from other computers, and we have been printing copies of some of them over the last 6 months with no issues. The printers will do test pages. They will print pdf's, but only a a few of them, then the ram is filled up with crap (sitting at using ~1gig of memory after 4 to 10 pdf's depending on the size of the file, and number of pages) but killing spoolsv.exe puts the memory usage back down the the 250mb area, where normally is after the machine boots, and is just sitting idle with nothing extra running.

 

[kimsland]

Large PDF documents require sufficient memory in your printer in order to print correctly

From here Tips on Downloading and Printing Adobe Portable Document Format (PDF) Files

Is it possible one of the printer's memory is bad?
This would seem the issue, if it prints perfectly well with just text.

 

[DelJo63]

No the files are not damaged, they print fine from other computers, and we have been printing copies of some of them over the last 6 months with no issues. The printers will do test pages.

my my; I give up, sorry.

If you find a solution, please come back and post it to this thread!

 

[TorturedChaos]

From here Tips on Downloading and Printing Adobe Portable Document Format (PDF) Files

Is it possible one of the printer's memory is bad?
This would seem the issue, if it prints perfectly well with just text.

I dont think the printer memory is going bad, every machine but those two can print just fine to those machines.

my my; I give up, sorry.

If you find a solution, please come back and post it to this thread!

Well thanks for the help so far. My boss is going to see if he can get a hold of his son, he is the one that set up the network, but he would be able to until next week

Im still open to any suggestions though.