printer not working

[Geometrikz]

When i try to install a printer i always get

printer driver was not installed. operation could not be completed (error 0x0000007c)

Does anyone know how to fix this?

 

[cluberti]

That error means "ERROR_INVALID_LEVEL", which is *really* odd for a printer driver. Is this specific to one specific driver, or does any driver cause this? Which drivers have you tried if the latter is the case?

 

[Geometrikz]

i have two printers but both of them have the same error

Dell Colour printer 1320c
Canon MF4380dn

i had this before and i reinstalled windows but now its happening again but i dont know why

 

[cluberti]

Here's what I need then - download and extract procdump.exe from here to a temporary folder (C:\TEMP, for example), and also download and extract procmon.exe from here to a temporary folder (again, C:\TEMP).

Next, run procmon.exe to start logging. Then, as quickly as is possible, install one of the two drivers you mentioned again to reproduce the error. Once the error occurs (do NOT close or dismiss the error - leave it up on-screen!), as quickly as is possible click File > Save in the process monitor window. Click OK to save the file (the "Path" box will show you where the .pml file will be saved), and then close the process monitor window to stop the logging.

Next, open an elevated cmd prompt to C:\TEMP and run this command:
procdump -accepteula -mp spoolsv.exe

Once you have executed the above command and a .dmp file is created in the temporary folder, you can close the error.

Lastly, ZIP or RAR the resulting .dmp file and .pml file you just created, upload them somewhere, and provide a link so we can download and analyze.

 

[Geometrikz]

i got this out of memory thing from procmon.exe

 

[cluberti]

I edited my post - please re-read (I changed the steps a bit and added the links). I clicked the "Post" button on accident a bit too quickly first .

 

[Geometrikz]

Got out of memory unable to allocate a memory blocksize of __________

 

[cluberti]

You got that error... when?

 

[Geometrikz]

when i opened process monitor

i know my computer is messed up

 

[cluberti]

Yeah. See if you can at least do step 2 and get the .dmp file from procdump. Installing printer drivers is likely the least of your problems, though.

 

[Geometrikz]

How do you change it to C:\TEMP

Sorry not really good at CMD

 

[cluberti]

No worries - once you open an elevated cmd prompt (start, type in "cmd", right click on the cmd.exe item in the start menu list and select "Run as Administrator'), you change directories with the "cd" command. So, "cd C:\temp" will change the directory to C:\temp.

 

[Geometrikz]

spoolsv_110107_112406.dmp

 

[cluberti]

Headed out for food, but I'll take a look later this evening.

 

[Geometrikz]

Thank you =D

I think im getting a new computer in 6 months if i do good in my tests but i need the printers for my schoolwork and its so annoying spending a whole day reinstalling windows

 

[cluberti]

Well, if you did what I said and dumped the spoolsv.exe process with the error on-screen, the error is most definitely not coming from the print spooler service itself. Very odd, but the dump doesn't lie.

Can you post a screenshot of your desktop with the error displayed?

 

[Geometrikz]

There its in the attachments

il try to do the dump again

http://www.mediafire.com/file/d37dk9u84i7c8tt/spoolsv_110107_140002.dmp

 

[cluberti]

Well, that's the print error from the add printer dialog. This is usually caused by an installed driver loaded into the spooler that is not running properly once installed, so in looking again at your print spooler dump I did notice this:

0:006> kn
 # ChildEBP RetAddr  
00 0210f82c 779b8f8f ntdll!KiFastSystemCallRet
01 0210f830 779b8fc2 user32!NtUserGetMessage+0xc
02 0210f84c 014c231b user32!GetMessageW+0x33
WARNING: Stack unwind information not available. Following frames may be wrong.
03 0210fa78 77321194 CNAS0MMK+0x231b
04 0210fa84 77bcb495 kernel32!BaseThreadInitThunk+0xe
05 0210fac4 77bcb468 ntdll!__RtlUserThreadStart+0x70
06 0210fadc 00000000 ntdll!_RtlUserThreadStart+0x1b
 
0:014> lmvm cnas0mmk
start    end        module name
014c0000 014d2000   CNAS0MMK T (no symbols)           
    Loaded symbol image file: CNAS0MMK.DLL
    Image path: C:\Windows\System32\CNAS0MMK.DLL
    Image name: CNAS0MMK.DLL
    Timestamp:        Wed Apr 18 04:13:58 2007 (4625D346)
    CheckSum:         0001F2E0
    ImageSize:        00012000
    File version:     1.2.0.0
    Product version:  1.2.0.0
    File flags:       0 (Mask 3F)
    File OS:          10004 DOS Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

This .dll is using one of the many filenames that the win32.banker.xjh worm is known to use, and I believe this machine is likely infected by this (very old, but very serious) trojan given you mentioned earlier that you knew that your PC was already "messed up", you couldn't run process monitor, etc - all telltale signs of an infection given what I've just found running on your PC. I think it might be best right now to stop worrying about your printers, and start worrying about the security of your PC (especially if you do any internet banking, as this particular nasty is specifically designed to watch for such activity and report it to whomever it is configured to upload the data to).

 

[Geometrikz]

i dont do any internet banking and how can i get rid of it?

 

[cluberti]

Read the link. You can download Microsoft Security Essentials (MSE), update it, and then try to use it to clean the system. Not sure if it will work, but it's worth a try. Whatever you're using as an antivirus solution may not be good enough, assuming you are keeping it updated regularly.