Data Execution Prevention causes Spoolsv.exe to close

Well isn’t that annoying!

Root cause: incorrect printer driver for your OS (in my case, HP Network Printer Installer selected the Vista HP LaserJet 6M driver for my HP LaserJet 5M on the computer running Windows XP Pro)

Resolution:

I started with this page: http://support.microsoft.com/default.aspx?scid=kb;en-us;312052 but it seemed a little drastic.  I dug deeper and found http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm which was also a big help.

I also started with the knowledge that it WASN’T a virus, or spyware, or adware.  I knew this because this problem started immediately after I had reinstalled my network printer using the HP Network Printer Installer.  I noticed that it had selected the wrong driver, but I didn’t realize how wrong it was.

To summarize (You can only follow these steps if you have administrative rights and are running Windows XP Professional or Vista Business or higher; you will need to be able to run regedit and go into Services.  If you can’t do that, find someone who can.):

1. Remove all printers.  (In retrospect, I should have just removed the HP one to start)  To remove printers, right-click on the printer in the Printers window and select Delete.  Click Yes to confirm.
2. In the Printers window, go to File and click Server Properties.
3. On the Drivers tab of the Properties window, remove all the installed printer drivers.  (note to self: make sure you can reinstall all the printers again after you do this.  Grumble grumble where is that stupid O2K3 disc?)  To remove the driver, click Remove and then Yes to confirm.

Now it’s time for some registry editing.  You made a backup, right?

Start Regedit.

• Delete any items listed under these keys (do NOT delete the keys themselves)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows NT x86\Drivers\Version-2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows NT x86\Drivers\Version-3

• Check the following keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors

And delete any items that are not on this list:

1. AppleTalk Printing Devices (When Services for Macintosh is installed)
2. BJ Language Monitor
3. Local Port
4. PJL Language Monitor
5. Standard TCP/IP Port
6. USB Monitor
7. Windows NT Fax Monitor (When a Fax Modem is installed)

Exit Regedit.

Now for the final phase of cleanup:

1. Go to Services (Control Panel > Administrative Tools > Services) and stop the Print Spooler service.
2. Go to C:\Windows\system32\spool\printers\ and delete everything in there (not the folder itself).
3. Go to C:\Windows\system32\spool\drivers\w32x86.  If you see any folders with 2 or 3 in the name, delete them.  If you see any folders starting with the name of your printer manufacturer(s), delete those too.  Don’t delete the default windows printer stuff.  You’re looking for stuff like “hpprint” or “hewlett_packard” or “lex_” or “lexmark” blah blah blah.
4. Restart your machine.

You should no longer get the Data Execution Prevention error.

You will now have to reinstall your printers.  This time, use the printer driver from Windows if possible, and then manually go to the manufacturer’s website for an upgrade.  Make sure you get one that is appropriate for your printer and your OS.

Voilà !