Search filename

 
Home page
Download
File information
Helper forums

Database statistics
Total:  617,551
Whitelist:  174,970

Top process list
svchost.exe
iexplore.exe
csrss.exe
rundll32.exe
lsass.exe
alg.exe
wuauclt.exe
ccapp.exe
explorer.exe
ctfmon.exe
spoolsv.exe
services.exe
smss.exe
jusched.exe
winlogon.exe
mdm.exe
rthdcpl.exe
hkcmd.exe
msascui.exe
alcxmntr.exe

Spoolsv.exe

spoolsv.exe - Microsoft® Windows® Operating System - Microsoft Corporation
Run a Free Scan for SPOOLSV.EXE related errors

Spoolsv.exe file description
Spoolsv.exe with description spoolsv.exe is a process file from company Microsoft Corporation belonging to product Microsoft® Windows® Operating System.
In total there are 12 launchpoints for this file including "Running processes".
There are 15 different variations of the file in our database and the file is digitally signed from Microsoft Windows - Microsoft Time-Stamp Service
We do not recommend removing digitally signed files from Microsoft Windows

What is spoolsv.exe?
Spoolsv.exe is the Windows Print Spooler service. Its function is to manage spooled print jobs and handle the print queue.

This process is not essential to the operation of the system; however, if you use a printer, the Print Spooler service must be enabled and spoolsv.exe must be running. If you do not have a printer, it is safe to kill this process and disable the Print Spooler service.The screenshot below illustrates how it should appear in the task manager:



Notice that spoolsv.exe always runs as SYSTEM. A process with this name running as a different user may be indicative of a malware infection.

Dangers of spoolsv
As this is a ubiquitous system process that runs on most Windows machines, it is common for virus writers and spyware vendors to disguise their malware as the genuine one.

Some malicious files will have the same name but will be stored somewhere other than in %SystemRoot%\System32. Other malware will use a name that appears similar to it but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as the Print Spooler:
  • Backdoor.Ciadoor.B (%SystemRoot%)
    • This is a backdoor trojan horse that gives an attacker control of the system. It opens port 1987 to accept commands.
  • Troj/Bancban-NP (%ProgramFiles%\MSN Messenger)
  • Troj/Gunboun-A (%SystemRoot%)
  • W32.Rbot-AHP (%SystemRoot%)
    • This is a backdoor trojan that runs an IRC server to accept commands.
There will typically be only one copy of this process running at a given time on a system. If multiple copies are running, one or more of the instances may be malware.

Common problems
  • "Spoolsv.exe has encountered a problem and needs to close"
    • This is often caused by faulty printer drivers or third-party software. Ensure your printer drivers are up to date. If they are, try reinstalling them.
  • Spoolsv.exe wants access to port 1987
    • Your system is probably infected with Backdoor.Ciadoor.B. See Backdoor.Ciadoor.B above.
  • High CPU usage
    • This is often caused by print jobs being left in the spool. To remove them, disable the print spooler and then delete the contents of %SystemRoot%\System32\spool\PRINTERS\. Once the contents are deleted, restart the Print Spooler.
    • If the problem persists, ensure your printer drivers are up to date. If they already are, try reinstalling them.

Automatic startup locations
001 Running Processes
002 Autorun registry entries local machine
003 Autorun registry entries Current User
010 Installed services
034 Winlogon Shell
035 Active Setup Installed Components
065 Image File Execution Options (debugger)
073 %windir%\Tasks
135 Current User Runonce (+ subkeys)
139 Windows\load
166 HKCU Policies\Explorer\Run
167 HKLM Policies\Explorer\Run

File versions in our database
  Company  Version  Size 
n/a  n/a  4294967295 
Microsoft Corporation  5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)  4294967295 
Microsoft Corporation  5.1.2600.3311 (xpsp.080211-1047)  4294967295 
Microsoft Corporation  5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)  2952704 
mIRC Co. Ltd.  6.03  1790464 
Cat Soft  5.1.0.0  1043968 
BIOCAPSULACORP.3047.DC®  6.0.5492.5 (winmain_beta3.060802-1900)  378880 
n/a  n/a  365577 
n/a  n/a  359936 
BIOCAPSULACORP.3047.DC®  6.0.5492.5 (winmain_beta3.060802-1900)  353792 
Microsoft Corporation  6.1.7600.16385 (win7_rtm.090713-1255)  336384 
Microsoft Corporation  6.1.7100.0 (winmain_win7rc.090421-1700)  332800 
Microsoft Corporation  6.1.7100.0 (winmain_win7rc.090421-1700)  331264 
Microsoft Corporation  6.1.7100.0 (winmain_win7rc.090421-1700)  316416 
Microsoft Corporation  6.1.7127.0 (winmain.090507-1820)  316416 

Digital signatures found for this file
  Signer of certificate  Issuer of certificate 
Microsoft Windows  Microsoft Time-Stamp Service
Microsoft Windows  Microsoft Timestamping Service
Microsoft Windows  VeriSign Time Stamping Services Signer
Microsoft Windows 2000 Publisher  NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
Microsoft Windows 2000 Publisher  VeriSign Time Stamping Service
Microsoft Windows 2000 Publisher  VeriSign Time Stamping Services Signer
Microsoft Windows 2000 Publisher (Europe)  NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
Microsoft Windows Component Publisher  Microsoft Timestamping Service
Microsoft Windows Component Publisher  VeriSign Time Stamping Services Signer
Microsoft Windows Publisher  VeriSign Time Stamping Service
Microsoft Windows Publisher  VeriSign Time Stamping Services Signer
Microsoft Windows XP Publisher  VeriSign Time Stamping Service
Microsoft Windows XP Publisher  VeriSign Time Stamping Services Signer
Microsoft Windows XP Publisher (Europe)  VeriSign Time Stamping Service

MD5 security rating in our database
452 files (Not yet rated and not signed)
2 files (Not yet rated and digitally signed)
3 files (Safe and not signed)
222 files (Safe and digitally signed)
Some versions of this filename have not yet been checked for safety.
Fix spoolsv.exe application error:  Run a free registry scan
Warning: Some malware might rename itself to spoolsv.exe. Always make sure that your file is from a verified publisher.
User comments for Spoolsv.exe
There are no comments yet.


Please add your comments if you have more information about this file.


File rating :

Are you human? How much is 17+23:


Browse files by letter
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
More system processes
spoolsv32.exe spoolsvc.exe spoolsvd.exe
spoolsvr.exe spoolsvr32.exe spoolsvt.exe
spoolsvv.exe spoolus.exe spoolv.exe
spoolvnt.exe spoolw.exe Spoon-Sandbox.exe