Print Spooler Problem

After installing NOD32 on several work stations in the office, about 3 of them have now exhibited a problem with the print spooler service.

All systems have a printer installed as a local printer on a standard tcp/ip port.

The systems in question, when all printer drivers are removed, will function normally. You can add regular local printers all day long. As soon as you try to add back the network printer (local printer, standard tcp/ip port). The spooler service app errors.

These systems are running on the same OS version and printer driver versions as systems that have no issues:

Problem System Example:

Error:
Spooler SubSystem App has encountered a problem and needs to close. We are sorry for the inconvenience.
Error Details:
szAppName : spoolsv.exe szAppVer : 5.1.2600.2696 szModName : imon.dll
szModVer : 2.51.26.0 offset : 0000f259

NOD32 antivirus system information
Virus signature database version: 1.1809 (2006101
Dated: Wednesday, October 18, 2006
Virus signature database build: 8202

Information on other scanner support parts
Advanced heuristics module version: 1.037 (20060926)
Advanced heuristics module build: 1122
Internet filter version: 1.002 (2004070
Internet filter build: 1013
Archive support module version: 1.050 (20060926)
Archive support module build version: 1176

Information about installed components
NOD32 for Windows NT/2000/XP/2003/x64 - Base
Version: 2.51.26
NOD32 for Windows NT/2000/XP/2003/x64 - Internet support
Version: 2.51.26
NOD32 for Windows NT/2000/XP/2003/x64 - Standard component
Version: 2.51.26

Operating system information
Platform: Windows XP
Version: 5.1.2600 Service Pack 2
Version of common control components: 5.82.2900
RAM: 383 MB
Processor: x86 Family 6 Model 8 Stepping 3 (803 MHz)


One of the non-problematic systems has the exact same version of XP, and the exact same printer driver installed.

The only work around so far is to share the printer on a working system and connect the non-working system to this printer via the network share. This works fine, but is not optimal. I have also tried to disable the imon module on a whim as that is the dll that appears to be related to the problem, no luck.

Any ideas anyone? I have submitted a similar request for support to eset, but I thought I would go ahead and post here too, if they get back to me first I will post their answer in case it can help someone here out.

 

Quick response from ESet:

Hello,
Please click on the NOD32 icon on the bottom right corner of the screen next to the clock.

When the Control Center opens, click on IMON.

In the Window to the right, click on the "Setup" button.

Now click on the "HTTP" tab at the top.

UN-check "Automatically detect communications on other ports"

Click 'Ok'



----

Unfortunately, this has not solved the problem.

 

Another quick response has directed us to "quit" the IMON module on affected machines.

This allows us to use the printer properly on the problematic machines, but is simply a work around.

I will keep posting as the situation develops, hopefully a "solution" will come of this eventually. A solution being something that allows us to keep using IMON on those machines while still allowing us to print..

 

I would try THIS

Cheers

 

Blackspear: Thanks for the info, however I've received a better explanation from ESet regarding the issue..

Msg From ESet:
----
This issue so far has been the only one of its kind. IMON will no longer be in the product in Version 3.0.

In the "http" tab of IMON ports can be added so programs can continue, however, Microsoft wrote the printer drivers to which change the port number each and every time a print job is sent. If ports 1 thru 65,535 were added it would be like IMON is off anyway since there is no way to tell what port(s) will be used to send a print job.

If something was downloaded that had malicious content AMON would be the one to catch it regardless.
----

So, I s'pose it won't really matter if I have to disable IMON as it'll be gone sometime soon anyhow

 

spareparts, thanks for the updates, it will no doubt help someone in the future. I offered the Winsock Repair advice as I have come across a similar issue before and it resolved it.

Cheers

 

Hello,

My experience with printing to network-attached printers is limited to a few HP and Lexmark models, but I have not experienced nor can I recall any compatibility issues between IMON and specific drivers.

Can you tell us the brand and model of the printer(s) involved and the version(s) of the device drivers used with it/them?

Regards,

Aryeh Goretsky

 

The printer is a konica 7150 (printer/copier) using the konica 7060/ip-302 post script drivers. We connect to it using a standard tcp/ip port. Only some systems have the problem and nothing is apparently different in the system configuration of the problematic systems versus the systems that work correctly.

 

Are the computers all trying to connect to the same remote port on the Konica? If so, what is the port number?

 

Shoot, I don't even know the port number, but here's the steps we go through to add the printer and what I mean by a standard tcp/ip port..

From printers and faxes click Add a printer:
Click next on the first page of the wizard..

Then:
http://ntadmin.reachone.net/nod32/1.jpg
Then:
http://ntadmin.reachone.net/nod32/2.jpg
Then:
http://ntadmin.reachone.net/nod32/3.jpg

From this point you click next and choose the driver/etc..

 

OK, gotcha. That is pretty much the same procedure we use to set up our network printers over here. No problems with IMON, though.

Here is something you can try. In Windows, go to the Printers folder. Right-click on the white background and choose Server Properties. Go to the Ports tab, select the printer port (IP_10.180.55.100, judging from your screenshots), and choose Configure Port....

Verify whether the settings are the same for all the machines, or if some them are different.

 

Aha! That's where the port number is.. Yeah, they all are configured for RAW and port 9100.. I could probably play with IMON and try and open up that port or something, but I'm not really too concerned with making IMON work as it'll be going away soon anyhow. Now if I run into trouble with their new firewall product when that comes out, then I'll dig deeper.

 

OK, now I am mystified. Those are the same settings we use.

I was going to suggest a Winsock Repair, but I see that Blackspear has already done so. I suppose you could try setting up an IMON exclusion (IMON --> Setup --> Miscellaneous --> Exclusion --> Edit...) for the Windows Print Spooler executable (C:\Windows\System32\spoolsv.exe).

As you say, IMON will be going away in the future, but if this problem does turn up with a firewall, this will give you something to try.