What is Spoolsv.exe

Print Spooler - Microsoft® Windows® Operating System - Microsoft Corporation

File description

Spoolsv.exe with description Print Spooler is a process file from company Microsoft Corporation belonging to product Microsoft® Windows® Operating System.
The file is digitally signed from Microsoft Windows Component Publisher - Microsoft Timestamping Service
We do not recommend removing digitally signed files from Microsoft Windows Component Publisher

What is spoolsv.exe?
Spoolsv.exe is the Windows Print Spooler service. Its function is to manage spooled print jobs and handle the print queue.

This process is not essential to the operation of the system; however, if you use a printer, the Print Spooler service must be enabled and spoolsv.exe must be running. If you do not have a printer, it is safe to kill this process and disable the Print Spooler service.The screenshot below illustrates how it should appear in the task manager:



Notice that spoolsv.exe always runs as SYSTEM. A process with this name running as a different user may be indicative of a malware infection.

Dangers of spoolsv
As this is a ubiquitous system process that runs on most Windows machines, it is common for virus writers and spyware vendors to disguise their malware as the genuine one.

Some malicious files will have the same name but will be stored somewhere other than in %SystemRoot%\System32. Other malware will use a name that appears similar to it but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as the Print Spooler:
  • Backdoor.Ciadoor.B (%SystemRoot%)
    • This is a backdoor trojan horse that gives an attacker control of the system. It opens port 1987 to accept commands.
  • Troj/Bancban-NP (%ProgramFiles%\MSN Messenger)
  • Troj/Gunboun-A (%SystemRoot%)
  • W32.Rbot-AHP (%SystemRoot%)
    • This is a backdoor trojan that runs an IRC server to accept commands.
There will typically be only one copy of this process running at a given time on a system. If multiple copies are running, one or more of the instances may be malware.

Common problems
  • "Spoolsv.exe has encountered a problem and needs to close"
    • This is often caused by faulty printer drivers or third-party software. Ensure your printer drivers are up to date. If they are, try reinstalling them.
  • Spoolsv.exe wants access to port 1987
    • Your system is probably infected with Backdoor.Ciadoor.B. See Backdoor.Ciadoor.B above.
  • High CPU usage
    • This is often caused by print jobs being left in the spool. To remove them, disable the print spooler and then delete the contents of %SystemRoot%\System32\spool\PRINTERS\. Once the contents are deleted, restart the Print Spooler.
    • If the problem persists, ensure your printer drivers are up to date. If they already are, try reinstalling them.

Automatic startup locations

001 Running Processes
002 Autorun registry entries local machine
003 Autorun registry entries Current User
010 Installed services
033 Winlogon Userinit
034 Winlogon Shell
035 Active Setup Installed Components
065 Image File Execution Options (debugger)
073 %windir%\Tasks
135 Current User Runonce (+ subkeys)
139 Windows\load
166 HKCU Policies\Explorer\Run
167 HKLM Policies\Explorer\Run

Digital signatures found for this file

    Certificate 
65 Microsoft Windows Component Publisher - Microsoft Timestamping Service
64 Microsoft Windows - Microsoft Time-Stamp Service
45 Microsoft Windows Publisher - VeriSign Time Stamping Services Signer
20 Microsoft Windows Component Publisher - Microsoft Time-Stamp Service
17 Microsoft Windows XP Publisher - VeriSign Time Stamping Service
16 Microsoft Windows 2000 Publisher - VeriSign Time Stamping Service
7 Microsoft Windows - Microsoft Timestamping Service
7 Microsoft Windows Publisher - VeriSign Time Stamping Service
5 Microsoft Windows XP Publisher (Europe) - VeriSign Time Stamping Service
3 Microsoft Windows - VeriSign Time Stamping Services Signer
3 Microsoft Windows Component Publisher - VeriSign Time Stamping Services Signer
2 Microsoft Windows 2000 Publisher - VeriSign Time Stamping Services Signer
1 Microsoft Windows XP Publisher - VeriSign Time Stamping Services Signer
1 Microsoft Windows 2000 Publisher (Europe) - VeriSign Time Stamping Service CA SW1
1 Microsoft Windows 2000 Publisher (Europe) - NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.

MD5 security rating in our database

830 files (Not yet rated and not signed)
8 files (Not yet rated and digitally signed)
10 files (Safe and not signed)
278 files (Safe and digitally signed)
Some versions of this filename have not yet been checked for safety.
Warning: Some malware might rename itself to spoolsv.exe. Always make sure that your file is from a verified publisher.

User ratings for this file

File rating: Average rating of spoolsv.exe: by 1126 files and users.

Application errors

Fix spoolsv.exe application error:  Run a FREE registry scan

User comments

Print Process - under the C:\Windows\System32


Please add your comments if you have more information about this file or if you know how to solve spoolsv.exe application errors.


File safety :

File security rating :

Are you human? How much is 16+18:


Like this page?

Please support this free service by giving us a Google+1


Browse files by letter

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

More system processes

spoolsv32.exe spoolsvc.exe spoolsvd.exe
spoolsvr.exe spoolsvr32.exe spoolsvt.exe
spoolsvv.exe spoolus.exe spoolv.exe
spoolvnt.exe spoolw.exe Spoon-Sandbox.exe

Lansweeper computer inventory From the creator of Runscanner:

Lansweeper
is an automated IT asset management tool. It can quickly scan your computers and has over 250 default reports available.

There is no need to install any agents on the scanned computers, all hardware and software inventory scanning is done by standard build-in functionality.