Thunking spooler - the return

[rjpwp001]

I've seen many issues regarding the "thunking spooler" stopping unexpectedly, which was apparently fixed with SP1. However, I have a different issue.

When I tried to open an Office 2007 PowerPoint file from work (created on an XP machine) on my Vista 64 laptop, hundreds of thunking spooler processes started opening, and eventually used up all of my RAM, at which point I had to do a hard shutdown (holding the power button down) because nothing was able to run anymore.

I tried a couple more times and the same thing happened. I watched the number of processes tick up by the hundreds in the Task Manager. I can't seem to find any way to stop it, and I have not been able to find anyone else having this same issue.

If anyone can help out I would greatly appreciate it.

 

[H2SO4]

"Thunking" is the act of converting data so that it can traverse the interface between 16 and 32-bit code, or in your case the 64-bit OS and (very likely) a 32-bit user-mode printer driver.

The fact that the spooler is having issues "thunking" suggests to me that you've got a buggy printer driver.

If you can find updated, 64-bit drivers for your printer(s), these issues will probably go away.

 

[rjpwp001]

Thanks. My laptop is brand new and I actually have not even installed a printer driver yet, so that might be the issue. I believe the only "printer driver" available is the Microsoft XPS document writer, which might be causing the issue.

 

[H2SO4]

No, it wouldn't be a lack of printer drivers or the "XPS document writer". Gazillions of machines are in that state without experiencing your somewhat exotic symptom, so I'm afraid that you've got the distinction of being somehow special

What are the exact error messages you see, if any?

What's the name of the process listed in task manager?

What is the title of all the windows that pop up?

Is this issue specific to one PPT document? Can you successfully create PPTs on your machine and open them without this symptom? What about if you create another brand new (and mostly empty) PPT at work and then bring it home - same problem?

 

[rjpwp001]

I tried opening a blank PowerPoint on my laptop (so, taking work out of the equation) and opened the Task Manager. I cut and pasted multiple blank slides. Each time I pasted, the number of Thunking Spooler processes started ticking up. I then started pasting empty text boxes. Sure enough, several more Thunking processes opened up with each new object. The PPT from work was pretty complicated, so I can see why all of my RAM was eventually used.

No additional windows pop up, but I have attached a screenshot of my Task Manager.

 

[delphin]

I tried opening a blank PowerPoint on my laptop (so, taking work out of the equation) and opened the Task Manager. I cut and pasted multiple blank slides. Each time I pasted, the number of Thunking Spooler processes started ticking up. I then started pasting empty text boxes. Sure enough, several more Thunking processes opened up with each new object. The PPT from work was pretty complicated, so I can see why all of my RAM was eventually used.

No additional windows pop up, but I have attached a screenshot of my Task Manager.

try to open the power point in safe mode by typing powerpnt.exe /safe in run. Is this happening in safe mode also?

 

[rjpwp001]

Yes, I just tried it. Safe mode has no effect. The Thunking Spooler processes are started as they did before.

 

[H2SO4]

Very interesting. Can you try typing this into a CMD prompt after you've got a few instances of splwow64.exe running and then pasting back the output? I'm interested to see what DLLs are loaded into the POWERPNT and SPLWOW64 processes.

tasklist /m /fi "imagename eq powerpnt.exe"

tasklist /m /fi "imagename eq splwow64.exe"

 

[rjpwp001]

Sure thing. Here's the output:

tasklist /m /fi "imagename eq powerpnt.exe"

Image Name PID Modules
========================= ======== ============================================
POWERPNT.EXE 2728 ntdll.dll, wow64.dll, wow64win.dll,
wow64cpu.dll


tasklist /m /fi "imagename eq splwow64.exe"

Image Name PID Modules
========================= ======== ====================================
splwow64.exe 2940 N/A
splwow64.exe 4812 N/A
splwow64.exe 3444 N/A
splwow64.exe 3964 N/A
splwow64.exe 3816 N/A
splwow64.exe 604 N/A
splwow64.exe 2772 N/A
splwow64.exe 2776 N/A
splwow64.exe 4776 N/A
splwow64.exe 2404 N/A
splwow64.exe 3868 N/A
splwow64.exe 3092 N/A
splwow64.exe 3740 N/A
splwow64.exe 4844 N/A
splwow64.exe 4920 N/A
splwow64.exe 776 N/A
splwow64.exe 4924 N/A
splwow64.exe 4288 N/A
splwow64.exe 3424 N/A
splwow64.exe 3196 N/A
splwow64.exe 4304 N/A
splwow64.exe 3352 N/A
splwow64.exe 2972 N/A
splwow64.exe 2408 N/A
splwow64.exe 1364 N/A
splwow64.exe 3736 N/A
splwow64.exe 4152 N/A
splwow64.exe 4916 N/A
splwow64.exe 5088 N/A
splwow64.exe 2632 N/A
splwow64.exe 576 N/A
splwow64.exe 2456 N/A
splwow64.exe 632 N/A
splwow64.exe 4196 N/A
splwow64.exe 4616 N/A
splwow64.exe 2496 N/A
splwow64.exe 532 N/A
splwow64.exe 1632 N/A
splwow64.exe 1972 N/A
splwow64.exe 1548 N/A
splwow64.exe 2700 N/A
splwow64.exe 2572 N/A
splwow64.exe 3648 N/A
splwow64.exe 3548 N/A
splwow64.exe 1072 N/A
splwow64.exe 5068 N/A
splwow64.exe 2312 N/A
splwow64.exe 2032 N/A
splwow64.exe 2620 N/A
splwow64.exe 2708 N/A
splwow64.exe 4868 N/A
splwow64.exe 1688 N/A
splwow64.exe 5084 N/A
splwow64.exe 1660 N/A
splwow64.exe 2712 N/A
splwow64.exe 2124 N/A
splwow64.exe 4316 N/A
splwow64.exe 4708 N/A
splwow64.exe 3412 N/A
splwow64.exe 1404 N/A
splwow64.exe 4068 N/A
splwow64.exe 1288 N/A

 

[delphin]

Sure thing. Here's the output:

tasklist /m /fi "imagename eq powerpnt.exe"

Image Name PID Modules
========================= ======== ============================================
POWERPNT.EXE 2728 ntdll.dll, wow64.dll, wow64win.dll,
wow64cpu.dll


tasklist /m /fi "imagename eq splwow64.exe"

Image Name PID Modules
========================= ======== ====================================
splwow64.exe 2940 N/A
splwow64.exe 4812 N/A
splwow64.exe 3444 N/A
splwow64.exe 3964 N/A
splwow64.exe 3816 N/A
splwow64.exe 604 N/A
splwow64.exe 2772 N/A
splwow64.exe 2776 N/A
splwow64.exe 4776 N/A
splwow64.exe 2404 N/A
splwow64.exe 3868 N/A
splwow64.exe 3092 N/A
splwow64.exe 3740 N/A
splwow64.exe 4844 N/A
splwow64.exe 4920 N/A
splwow64.exe 776 N/A
splwow64.exe 4924 N/A
splwow64.exe 4288 N/A
splwow64.exe 3424 N/A
splwow64.exe 3196 N/A
splwow64.exe 4304 N/A
splwow64.exe 3352 N/A
splwow64.exe 2972 N/A
splwow64.exe 2408 N/A
splwow64.exe 1364 N/A
splwow64.exe 3736 N/A
splwow64.exe 4152 N/A
splwow64.exe 4916 N/A
splwow64.exe 5088 N/A
splwow64.exe 2632 N/A
splwow64.exe 576 N/A
splwow64.exe 2456 N/A
splwow64.exe 632 N/A
splwow64.exe 4196 N/A
splwow64.exe 4616 N/A
splwow64.exe 2496 N/A
splwow64.exe 532 N/A
splwow64.exe 1632 N/A
splwow64.exe 1972 N/A
splwow64.exe 1548 N/A
splwow64.exe 2700 N/A
splwow64.exe 2572 N/A
splwow64.exe 3648 N/A
splwow64.exe 3548 N/A
splwow64.exe 1072 N/A
splwow64.exe 5068 N/A
splwow64.exe 2312 N/A
splwow64.exe 2032 N/A
splwow64.exe 2620 N/A
splwow64.exe 2708 N/A
splwow64.exe 4868 N/A
splwow64.exe 1688 N/A
splwow64.exe 5084 N/A
splwow64.exe 1660 N/A
splwow64.exe 2712 N/A
splwow64.exe 2124 N/A
splwow64.exe 4316 N/A
splwow64.exe 4708 N/A
splwow64.exe 3412 N/A
splwow64.exe 1404 N/A
splwow64.exe 4068 N/A
splwow64.exe 1288 N/A

Make a copy of wow64win.dll, wow64cpu.dll, rename these two dlls and try. i never seen these two dlls in my directory.

those dlls will be located in c:\windows\system32\.

Let me know he result

 

[H2SO4]

Wow, it looks like the many instances of the SPLWOW64 process are being "zombified" on termination somehow. No DLLs loaded in the process, and yet the process image is still active - many times over.

By comparison, here's what a "healthy" running SPLWOW64 process normally contains in terms of DLLs:

C:\Windows\system32>tasklist /m /fi "imagename eq splwow64.exe"
Image Name PID Modules
========================= ======== ============================================
splwow64.exe 4080 ntdll.dll, kernel32.dll, ADVAPI32.dll,
RPCRT4.dll, USER32.dll, GDI32.dll,
msvcrt.dll, WINSPOOL.DRV, IMM32.DLL,
MSCTF.dll, LPK.DLL, USP10.dll, secur32.dll,
credssp.dll, CRYPT32.dll, MSASN1.dll,
USERENV.dll, schannel.dll, NETAPI32.dll,
PSAPI.DLL, unidrvui.dll, ole32.dll,
VERSION.dll, OLEAUT32.dll, mxdwdrv.dll,
FontSub.dll

Since tasklist believes that all of your SPLWOW64 instances are effectively empty, something may be interferring during process initialisation or termination. Since no response is received, more instances of SPLWOW64 are started. Once more they're all unresponsive, so more are started...

What AV are you using? Can you test what happens with AV completely deactivated?

In Task Manager, if you click "View | select columns", then add the "memory - commit size" counter, what are the approximate commit sizes of each of those SPLWOW64 processes?

 

[H2SO4]

Those two DLLs are there because POWERPNT.EXE is a 32-bit process running on a 64-bit OS. That's perfectly normal.

 

[rjpwp001]

I'm using Eset NOD32 as my AV. I disabled everything and it didn't seem to have any effect.

I have attached a screen showing the process commit sizes.

Also, I wonder why this problem is isolated to PowerPoint. If I open up an instance of Word, 7 thunking processes are started, and if I add text and other objects no additional ones show up. If I start an instance of Excel, I get no additional new thunking processes.

At the same time, doing anything in PowerPoint opens new ones up like crazy, hundreds at a time when I create a new slide or add a text box, etc.

 

[H2SO4]

Fascinating. All of those splwow64 instances are almost literally empty. No wonder tasklist says they're devoid of DLLs. (By comparison, my single splwow64 instance on this box has a 2.8MB commit size, and that's as small as it's ever going to get, given it's doing nothing whatsoever now).

My theory is that process initialisation is being hampered by something, and each of those splwow64 instances is only a "zombie" stub that does no useful work and does not respond to requests. That's why more and more of them are being started - because it looks like there isn't an active splwow64.

What about if you start Windows itself in safe mode (hold F8 during startup) and run PowerPoint from there? Same symptom?

 

[rjpwp001]

I started up in Safe mode. PowerPoint ran and no Thunking Spooler processes were started at all; however, I could not open up the original PowerPoint I was editing and other strange things were happening (I could not, for example, display the Open File dialog - the error was something like "PowerPoint encountered an error that could not be corrected.")

But, I was able to create objects and copy slides with no problems.

 

[H2SO4]

OK, the better behaviour in safe mode is significant. Two distinct ways you can go about this now, assuming you want to troubleshoot further:

1) Use MSCONFIG or "Autoruns" (www.microsoft.com/sysinternals) to disable components configured to start in normal mode but not safe mode. Presumably, one of them is the culprit.

2) Let me talk you through playing with debuggers to try to deterministically analyse what's zombifying the splwow64 process in normal mode.

The second one will be painful so I'd suggest you begin by using MSCONFIG to test what happens when you use "diagnostic startup" mode.

 

[rjpwp001]

It's been a while since I returned to this thread but I wanted to thank everyone for providing direction on this issue. Ultimately I was not able to figure out a solution in Vista - however installing Windows 7 seems to have stopped this problem from occurring. It may have been a bizarre problem that was isolated to my specific machine.