Search filename

 
Home page
Download
File information

Database statistics
Total:  809,521
Whitelist:  252,181

Top process list
svchost.exe
iexplore.exe
csrss.exe
rundll32.exe
lsass.exe
alg.exe
wuauclt.exe
ccapp.exe
explorer.exe
ctfmon.exe
spoolsv.exe
services.exe
smss.exe
jusched.exe
winlogon.exe
mdm.exe
rthdcpl.exe
hkcmd.exe
msascui.exe
alcxmntr.exe

What is Spoolsv.exe

spoolsv.exe - Microsoft® Windows® Operating System - Microsoft Corporation
Run a Free Scan for SPOOLSV.EXE related errors

File description
Spoolsv.exe with description spoolsv.exe is a process file from company Microsoft Corporation belonging to product Microsoft® Windows® Operating System.
The file is digitally signed from Microsoft Windows - Microsoft Time-Stamp Service
We do not recommend removing digitally signed files from Microsoft Windows

What is spoolsv.exe?
Spoolsv.exe is the Windows Print Spooler service. Its function is to manage spooled print jobs and handle the print queue.

This process is not essential to the operation of the system; however, if you use a printer, the Print Spooler service must be enabled and spoolsv.exe must be running. If you do not have a printer, it is safe to kill this process and disable the Print Spooler service.The screenshot below illustrates how it should appear in the task manager:



Notice that spoolsv.exe always runs as SYSTEM. A process with this name running as a different user may be indicative of a malware infection.

Dangers of spoolsv
As this is a ubiquitous system process that runs on most Windows machines, it is common for virus writers and spyware vendors to disguise their malware as the genuine one.

Some malicious files will have the same name but will be stored somewhere other than in %SystemRoot%\System32. Other malware will use a name that appears similar to it but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as the Print Spooler:
  • Backdoor.Ciadoor.B (%SystemRoot%)
    • This is a backdoor trojan horse that gives an attacker control of the system. It opens port 1987 to accept commands.
  • Troj/Bancban-NP (%ProgramFiles%\MSN Messenger)
  • Troj/Gunboun-A (%SystemRoot%)
  • W32.Rbot-AHP (%SystemRoot%)
    • This is a backdoor trojan that runs an IRC server to accept commands.
There will typically be only one copy of this process running at a given time on a system. If multiple copies are running, one or more of the instances may be malware.

Common problems
  • "Spoolsv.exe has encountered a problem and needs to close"
    • This is often caused by faulty printer drivers or third-party software. Ensure your printer drivers are up to date. If they are, try reinstalling them.
  • Spoolsv.exe wants access to port 1987
    • Your system is probably infected with Backdoor.Ciadoor.B. See Backdoor.Ciadoor.B above.
  • High CPU usage
    • This is often caused by print jobs being left in the spool. To remove them, disable the print spooler and then delete the contents of %SystemRoot%\System32\spool\PRINTERS\. Once the contents are deleted, restart the Print Spooler.
    • If the problem persists, ensure your printer drivers are up to date. If they already are, try reinstalling them.

Automatic startup locations
001 Running Processes
002 Autorun registry entries local machine
003 Autorun registry entries Current User
010 Installed services
033 Winlogon Userinit
035 Active Setup Installed Components
065 Image File Execution Options (debugger)
073 %windir%\Tasks
135 Current User Runonce (+ subkeys)
139 Windows\load
166 HKCU Policies\Explorer\Run
167 HKLM Policies\Explorer\Run

Digital signatures found for this file
  Signer of certificate  Issuer of certificate 
Microsoft Windows  Microsoft Time-Stamp Service
Microsoft Windows  Microsoft Timestamping Service
Microsoft Windows  VeriSign Time Stamping Services Signer
Microsoft Windows 2000 Publisher  VeriSign Time Stamping Service
Microsoft Windows 2000 Publisher  VeriSign Time Stamping Services Signer
Microsoft Windows 2000 Publisher (Europe)  NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
Microsoft Windows 2000 Publisher (Europe)  VeriSign Time Stamping Service CA SW1
Microsoft Windows Component Publisher  Microsoft Time-Stamp Service
Microsoft Windows Component Publisher  Microsoft Timestamping Service
Microsoft Windows Component Publisher  VeriSign Time Stamping Services Signer
Microsoft Windows Publisher  VeriSign Time Stamping Service
Microsoft Windows Publisher  VeriSign Time Stamping Services Signer
Microsoft Windows XP Publisher  VeriSign Time Stamping Service
Microsoft Windows XP Publisher  VeriSign Time Stamping Services Signer
Microsoft Windows XP Publisher (Europe)  VeriSign Time Stamping Service

MD5 security rating in our database
570 files (Not yet rated and not signed)
2 files (Not yet rated and digitally signed)
6 files (Safe and not signed)
261 files (Safe and digitally signed)
Some versions of this filename have not yet been checked for safety.
Warning: Some malware might rename itself to spoolsv.exe. Always make sure that your file is from a verified publisher.

Application errors
Fix spoolsv.exe application error:  Run a FREE registry scan
User comments.
Print Process - under the C:\Windows\System32


Please add your comments if you have more information about this file or if you know how to solve spoolsv.exe application errors.


File rating :

Are you human? How much is 6+11:


Browse files by letter
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
More system processes
spoolsv32.exe spoolsvc.exe spoolsvd.exe
spoolsvr.exe spoolsvr32.exe spoolsvt.exe
spoolsvv.exe spoolus.exe spoolv.exe
spoolvnt.exe spoolw.exe Spoon-Sandbox.exe

Free inventory software