Re: spoolsv.exe using all CPU cycles

From: Rock (rock_at_mail.nospam.net)
Date: 12/19/04


Date: Sun, 19 Dec 2004 10:43:12 -0800

Rich wrote:

> OK. . . I've now been researching this spoolsv.exe problem for over a week
> now and have yet to come across a definitive answer from anyone on how to fix
> it.
>
> Review: at startup (or shortly thereafter) spoolsv.exe starts running (in
> Task Manager - Processes) and utilizes 90%-100% of the CPU - bringing the
> entire system to a halt. Once you end the process the computer and any other
> programs that you may have been able to start beforehand, leap to life and
> work fine. . .for a few minutes until spoolsv.exe starts up again and brings
> your computer to it's knees. Ending the process one more time seems to shut
> it off for good - but you are no longer able to print.
>
> I have consulted numerous sites and forums and have heard lots of different
> stories and suggestions . . . none of them helpful. I have scoured Norton's
> and McAfee's sites, and while they all mention (in some detail) problems with
> trojans related to spoolsv.exe, (Backdoor, etc.) none have any practical
> solutions to fix the problem (beyond downloading their recent signature
> updates). I have had a McAfee VirusScan ASaP subscription for the past
> several years and I ALWAYS have the latest versions and signatures installed
> - and I have run complete scans several times recently. I also downloaded
> and ran Stinger (McAfee's cleaner). I have yet to have one of these programs
> actually find or clean anything.
>
> BTW, this problem just started happening out of the blue about 2 weeks ago.
> I don't recall loading any new software, drivers, updates, etc. Let me also
> say here that I'm running a P4 1.4Ghz, 384MB RAM, WXP Pro with SP2 and every
> critical update ever released. I have two printers hooked to my system, HP
> LaserJet 2100 and an HP Officjet G85xi (neither of which, I am convinced,
> have anything to do with this problem).
>
> As a temporary solution, I have removed the spoolsv.exe service in msconfig.
> It seems to keep the CPU problem from ocurring when rebooting, but needless
> to say, doesn't help me much when I want to print something.
>
> I am personally convinced, from all my research, that I have some sort of
> trojan or virus, but I cannont find where the offending file is and my virus
> scanner can't find or clean it. Both McAfee and Norton list several registry
> keys to check out to confirm infection. I have checked out most (if not all)
> of these, but I do not find any of the files that they have listed - where
> they should be listed.
>
> Maybe I've got a new variant that does not yet have a fix released, but like
> I said, I've had the problem for a couple weeks now. . . I would think that
> someone else would have come across this besides just me. Oh, and I should
> also mention that I haven't been on any P2P networks or any porno sites.
>
> So, in short, is there anyone out there that can tell me how to fix this
> problem one can for all? Help!

You might want to try some of the other online AV scanners and Trend
Micro's Sysclean. Make sure you do the scans in safe mode. For the
online scans boot into safe mode with networking. Make sure your
firewall program works in safe mode. If it doesn't use XP's built in
one which does.

For viruses, start with Trend Micro’s Sysclean. Download it and the
signature file. Turn off system restore, boot into safe mode and run
sysclean. Boot back into normal mode and run a full AV scan with your
normal AV program. Then turn system restore back on.

Trend Micro Sysclean
http://www.trendmicro.com/download/dcs.asp

Trend Micro Signature File
http://www.trendmicro.com/download/pattern.asp

Online and Downloadable Virus Scanning:

Panda ActiveScan
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Bit Defender Online Virus Scan:
http://www.bitdefender.com/scan/license.php

Symantec Online Virus and Security Scan:
http://security.symantec.com/ssc/home.asp

TrendMicro:
http://housecall.trendmicro.com/housecall/start_corp.asp

McAfee Online Virus Scan:
http://www.mcafee.com/myapps/mfs/default.asp

RAV AntiVirus - Scan Online
http://www.ravantivirus.com/scan/

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml



Relevant Pages

  • Re: error msg smsc.exe crashes
    ... Scan for malware in safe mode using a recent AV program with current ... firewall active at all times while online. ... Symantec Online Virus and Security Scan: ... Run these programs to check for spyware/malware. ...
    (microsoft.public.windowsxp.general)
  • Re: Cannot open system EXE files (Windows XP)
    ... I just want to express my thanks for providing me with a fix for this ... problem and some links to do an online virus check. ... >> mainly associated to EXE files. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Open Ports Killing Net Speed
    ... It came up with 270 connections to my computer. ... be active at all times when online. ... Symantec Online Virus and Security Scan: ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Open Ports Killing Net Speed
    ... > be active at all times when online. ... Then turn system restore back on. ... > Symantec Online Virus and Security Scan: ... > latest security patches from Windows Update too. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Open Ports Killing Net Speed
    ... It came up with 270 connections to my computer. ... be active at all times when online. ... Symantec Online Virus and Security Scan: ...
    (microsoft.public.windowsxp.general)