PC Pitstop is the undisputed leader in PC diagnostics. Our running process library is culled from our database of over 100 million PC diagnostics and scans.

Tip from the PitCrew

Every process running on your computer takes up CPU cycles and valuable memory. For optimal PC performance and resource utilization, you should be aware of every process on your computer. PC Pitstop designed this process library to help you know which processes are worthwhile and others that slow system performance.

Furthermore, perhaps the quickest and most straight forward method to detect malware is through a running process analysis.

Process Library

  

More than one possible match was found; all matches are listed below in order of their prevalence. This only tells you what the file and the correct action might be.

To understand which possibility is actually running on your own system, perform an Overdrive test and then look at the Software|Processes tab.


Match #1

spoolsv.exe (Print spooler)

Percentage of recently scanned PC's with this process running: 42.23%
Average CPU use for this program: 0%
Average RAM for this program: 5 MB


PC Pitstop Analysis

spoolsv.exe is the Print spooler for Windows 2000/XP. Leave this service running unless you never do any printing. If spoolsv.exe is not running, the Add Printer function will not work properly and no printers will be available.


Recommendation

Win Patrol

spoolsv.exe is required by third-party software or hardware and should not disabled.

PC Pitstop recommends WinPatrol Plus for monitoring all of the background activity on your PC. WinPatrol Plus provides a easy to understand descriptions of over 15,000 processes and programs.



Identification

In addition to the file name, spoolsv.exe, the following version information is used to identify the file. If the file does not match this information, it may be a different file. To ensure the file is absolutely correct, run a free and comprehensive scan.

Vendor contains:Microsoft
Product contains:Windows
File name contains:\system32\

To view version information with Windows Explorer, right-click the file and click Properties, Version.


MD5 Hashes

MD5 hashes is the way that computers can define the uniqueness of a file. Anti malware vendors frequently use this technique to detect and clean malware. It is common for a program to have multiple MD5 hashes as the developers create newer versions of the program. For the program called spoolsv.exe, we have detected more than 20 different MD5 hashes. Click on a hash to research the hash in Google.
MD5 Report Summary
Program NameMD5 Count
spoolsv.exe> 20
#MD5Size
10xad3d9d191aea7b5445fe1d82ffbb478857856 bytes
20xfacfb75ecc070103619fa044e0b210d347376 bytes
30x1c97a84d6940a56eae099ec61bb15e4357856 bytes
40x8c4629915454de274e5e41536058886656320 bytes
50x3dd9e31f36863665a4ec59fcd96901df235486 bytes
60xd31d094b0944867ddf32cfd2bfc7213251200 bytes
70xd8e5194c9693a9147f08b87e1a6d2cc894720 bytes
80x92677c2329b8ccd0ca1307ce0b90b09e45328 bytes
90x07763dfe5ea3c14946d4052c56ba377d57856 bytes
100xbbeba855260ac789fed1e110327ab376121616 bytes
110x2350b26893114d9ffb2bf519b812269860928 bytes
120x6d461954fe3bb34d3386b31d0f4dc80357856 bytes
130x987daf317b917cfc973de8364d62a76c45328 bytes
140xa0c616ac4fb80d46000b62a417549bd845328 bytes
150x0dd64932b9a6394b53222b7fd294d12a57856 bytes
160x27b7ac05859d8340afa925bc731f761b51200 bytes
170x216f8454a9415dd3e451b169dc3121c457856 bytes
180x1cf5af263287cf6febf31539833eaf4a57856 bytes
190xda81ec57acd4cdc3d4c51cf3d409af9f57856 bytes
200xf9ac415ac49b6d5f78b8aa377a5ce42f60928 bytes

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. spoolsv.exe (Print spooler) has been seen on 42.23% of systems tested at PC Pitstop. As a point of comparison, it is rare for a particular malicious program (virus or spyware) to be seen on more than one or two percent of all systems tested. The average RAM memory usage for this process was 5 MB. The average CPU load for this program was 0%.


Vendor or Distributor's Web Site

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q314876


Match #2

spoolsv.exe (Win32.Rbot.WO)

This program has not been seen on any systems tested at PC Pitstop in the past week.


PC Pitstop Analysis

spoolsv.exe, when associated with the product name of mIRC, may likely be part of the Win32.Rbot.WO virus. According to CA:

"Win32.Rbot.WO is an IRC controlled backdoor (or "bot") that can be used to gain unauthorized access to a victim's machine. It can also exhibit worm-like functionality by exploiting weak passwords on administrative shares and by exploiting many different software vulnerabilities, as well as backdoors created by other malware. There are many variants of Rbot, and more are discovered regularly. Rbot is highly configurable, and is being very actively developed, however the core functionality is quite consistent between variants."


Recommendation

CA AntiVirus

spoolsv.exe is a VIRUS. Stop all work until the virus is removed or you run the risk of spreading the virus to other people. Worse yet, the virus may be doing harm to your computer and your information.

spoolsv.exe is a virus and should be removed immediately to avoid doing further harm. PC Pitstop recommends CA Antivirus in these types of situations.



Identification

In addition to the file name, spoolsv.exe, the following version information is used to identify the file. If the file does not match this information, it may be a different file. To ensure the file is absolutely correct, run a free and comprehensive scan.

Vendor is not specified
Product contains:mIRC

To view version information with Windows Explorer, right-click the file and click Properties, Version.


MD5 Hashes

MD5 hashes is the way that computers can define the uniqueness of a file. Anti malware vendors frequently use this technique to detect and clean malware. It is common for a program to have multiple MD5 hashes as the developers create newer versions of the program. For the program called spoolsv.exe, we have detected 1 different MD5 hashes. Click on a hash to research the hash in Google.
MD5 Report Summary
Program NameMD5 Count
spoolsv.exe1
#MD5Size
10xb766003f431cad186bd115f5761592d11790464 bytes

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. This program has not been seen on any systems tested at PC Pitstop in the past week.


Vendor or Distributor's Web Site

http://search.ca.com/search/ca?charset=utf-8&qt=spoolsv.exe&rq=0&la=en&oq=spoolsv.exe&Submit=Search

Detailed Description and/or Removal Instructions

http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=44554


Match #3

spoolsv.exe (Possible Virus ** Read **)

This program has not been seen on any systems tested at PC Pitstop in the past week.


PC Pitstop Analysis

spoolsv.exe is a file name that some malwares use, look into Site URL.
spoolsv.exe is the Print spooler for Windows 2000/XP. Leave this service running unless you never do any printing. If spoolsv.exe is not running, the Add Printer function will not work properly and no printers will be available.
However USUALLY spoolsv.exe has in Vendor field "Microsoft" just like Product has "windows", was detected that this file has no vendor or product information which makes it just suspicious.
Was found a virus/trojan with the same name, run a virus scan to be sure that is not the case.


Recommendation

CA AntiVirus

spoolsv.exe is a VIRUS. Stop all work until the virus is removed or you run the risk of spreading the virus to other people. Worse yet, the virus may be doing harm to your computer and your information.

spoolsv.exe is a virus and should be removed immediately to avoid doing further harm. PC Pitstop recommends CA Antivirus in these types of situations.



Identification

The file name alone identifies this program.


MD5 Hashes

MD5 hashes is the way that computers can define the uniqueness of a file. Anti malware vendors frequently use this technique to detect and clean malware. It is common for a program to have multiple MD5 hashes as the developers create newer versions of the program. For the program called spoolsv.exe, we have detected more than 20 different MD5 hashes. Click on a hash to research the hash in Google.
MD5 Report Summary
Program NameMD5 Count
spoolsv.exe> 20
#MD5Size
10xfa1536c397ed6e65ec1b5b30dfa7a86d68902 bytes
20x344b6196ffea97b99cb6f45009201d40345253 bytes
30x902767a520affa75da6ba637e684120256320 bytes
40xc665a55e56966c44171d9c8900fbb52947616 bytes
50x141ca8d0cff160b6f472d6b3605a6572345600 bytes
60x48ad40d34282e624147070ef67a5e557336896 bytes
70x9d2d0e0a940a3166dca7cb651d13c12d35401 bytes
80xff3a38bb093e617adc220a48cda45ff681920 bytes
90xb4ca137dcb9b82a588124a1ea16c543c81920 bytes
100x68ccbd4b806a24a04492b55c863a670b336896 bytes
110x8d9a5228f5f94d90b3fccace66446551370176 bytes
120x32fdcb403b2f70403d0d1b44b0ce95cf77824 bytes
130x6159772059b9e4c9286fa52f56b1d223217600 bytes
140xc0bb27cbf8e2b6d2677052d8519b654249152 bytes
150x87f63e9c0566c477c13e7d9f2bef81f436363 bytes
160xa62f1b6dad3de338c0aebb18bdd46b2016389 bytes
170xc6cb0c82b3f11ef26538f7507d9739ed16453 bytes
180xf182c381c6121672e315c9a40409718457856 bytes
190x2705073467c0d7d55e116e6b7a9994f922532 bytes
200xdebf9d9847fb676e896ef47c2c431810215552 bytes

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. This program has not been seen on any systems tested at PC Pitstop in the past week.


Detailed Description and/or Removal Instructions

http://search.ca.com/search/ca?style=en&search_button=Search&qt=spoolsv.exe&col=

Important note: A file name alone may not be enough for positive identification. PC Pitstop's Overdrive tests and spyware scan use information such as the company name, product name, or install directory. If you are unable to identify a file, ask about it in our forums after running our full tests.