PC Review


Reply
Thread Tools Rate Thread

spoolsv.exe / 99% cpu

 
 
Shawn Modersohn
Guest
Posts: n/a
 
      18th Nov 2005
For some reason the print spooler is using 99% cpu on a xp sp2 machine.
As soon as I stop this service the computer runs as fast as would be
expected. I read that sometimes the Ciadoor.B trojan can register as
spoolsv.exe but I am confident this is not the case on this particular
machine. Anyone have any ideas? Thanks.
 
Reply With Quote
 
 
 
 
typical computer geek
Guest
Posts: n/a
 
      18th Nov 2005
how can you be so sure that this is not the case

"Shawn Modersohn" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> For some reason the print spooler is using 99% cpu on a xp sp2 machine. As
> soon as I stop this service the computer runs as fast as would be
> expected. I read that sometimes the Ciadoor.B trojan can register as
> spoolsv.exe but I am confident this is not the case on this particular
> machine. Anyone have any ideas? Thanks.



 
Reply With Quote
 
 
 
 
David H. Lipman
Guest
Posts: n/a
 
      18th Nov 2005
From: "Shawn Modersohn" <(E-Mail Removed)>

| For some reason the print spooler is using 99% cpu on a xp sp2 machine.
| As soon as I stop this service the computer runs as fast as would be
| expected. I read that sometimes the Ciadoor.B trojan can register as
| spoolsv.exe but I am confident this is not the case on this particular
| machine. Anyone have any ideas? Thanks.

You might be confident, but, you havent proven it isn't the "Backdoor.Ciadoor.B"

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


 
Reply With Quote
 
Shawn Modersohn
Guest
Posts: n/a
 
      18th Nov 2005
David H. Lipman wrote:
> From: "Shawn Modersohn" <(E-Mail Removed)>
>
> | For some reason the print spooler is using 99% cpu on a xp sp2 machine.
> | As soon as I stop this service the computer runs as fast as would be
> | expected. I read that sometimes the Ciadoor.B trojan can register as
> | spoolsv.exe but I am confident this is not the case on this particular
> | machine. Anyone have any ideas? Thanks.
>
> You might be confident, but, you havent proven it isn't the "Backdoor.Ciadoor.B"
>
> Download MULTI_AV.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> FireWall to allow it to download the needed AV vendor related files.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in Normal Mode.
> This way all the components can be downloaded from each AV vendor's web site.
> The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files or you can
> download the files and perform a scan in Normal Mode. Once you have downloaded the files
> needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
> file.
>
>
> * * * Please report back your results * * *
>
>


Panda didn't report anything (for whatever that is worth I know)and
netstat didn't show anything on the trojans default port. At any rate I
will try the multi_ave.exe utility and report the results. Thanks to
everyone for replying so far.
 
Reply With Quote
 
Dan Conrad
Guest
Posts: n/a
 
      19th Nov 2005
Shawn Modersohn wrote:
> For some reason the print spooler is using 99% cpu on a xp sp2 machine.
> As soon as I stop this service the computer runs as fast as would be
> expected. I read that sometimes the Ciadoor.B trojan can register as
> spoolsv.exe but I am confident this is not the case on this particular
> machine. Anyone have any ideas? Thanks.

I had the same issue and when I looked at the printers some microsoft
image documents were waiting to print -- deleted these and everything
was fine.
 
Reply With Quote
 
Shawn Modersohn
Guest
Posts: n/a
 
      21st Nov 2005
Shawn Modersohn wrote:
> For some reason the print spooler is using 99% cpu on a xp sp2 machine.
> As soon as I stop this service the computer runs as fast as would be
> expected. I read that sometimes the Ciadoor.B trojan can register as
> spoolsv.exe but I am confident this is not the case on this particular
> machine. Anyone have any ideas? Thanks.



It was not a virus at all, rather 25 added non existent printers each
with about 100 documents waiting to print. Thanks for all the
suggestions.
 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
CPU RUNNING SLOW! CPU USAGE 100% WHY????? =?Utf-8?B?dGVueGFkYXk=?= Windows XP Help 1 4th Jan 2005 06:19 PM
How to identify Athlon CPU? A7N8X-E Dlx having trouble with 3200+ CPU. CPU fraud? Erik Harris Asus Motherboards 18 18th Aug 2004 09:46 PM
is it possible to change my CPU in to english version? or buy a CPU of an english version? =?Utf-8?B?bWl5dWtp?= Windows XP Help 3 6th Apr 2004 12:56 PM
NEW CPU, CPU FAN, Motherboard needed psd99 Support 1 1st Dec 2003 05:48 PM
"System" CPU process using 60-99% CPU buster Windows XP Performance 0 12th Nov 2003 04:40 AM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 07:31 PM.