Assistance Needed : XP and spoolsv.exe 100% CPU

[Richard Futrell]

I have run into an issue that I have done many hours of research on. I have
a XP Pro box that was running great until all of the sudden it started
getting slow. When I looked into why, the file spoolsv.exe was at 99% CPU
usage and would not release. I found a post that said disable your print
spooler in Service.mcs but that will kill all printing from this computer. I
have not found any way of fixing this issue. If anyone has any information
please email me. I am still awaiting a replay from Microsoft but I have been
waiting for that for 4 days. Any help would be most appreciated.

Thank You In Advance!
Richard Futrell
World Hosting Central

 

[R. McCarty]

It may not be the Spoolsv service, but the disk/folder location where
your print sessions are spooled to. In most printers in advanced options
there is a field where you can direct the spooling directory. Perhaps
you should purge/change that location to another folder or disk & see
if the CPU "Lock" goes away. Also, be sure to click your printer icon
and make sure that no Misqueued print jobs are being held. On some
models a printer check operation runs just prior to actually printing the
job.

 

[Evan]

stopping spooler services shouldn't disable printing. it should just send
the print job directly to the printer instead of proccessing on your pc
first. alternately, you could go to your printer properties and disable
spooling there. that way, you're disabling spooling 'locally' instead of
'globally.' check the 'advanced' tab in your printer properties.

good luck.

 

[black]

I have run into an issue that I have done many hours of research on.
I have a XP Pro box that was running great until all of the sudden it
started getting slow. When I looked into why, the file spoolsv.exe
was at 99% CPU usage and would not release.

There is a trojan that spoofs the real windows file.
"Troj/Graybird-A copies itself to the Windows system folder with the
filename spoolsv.exe and sets the following registry entries so that the
Trojan is run when Windows starts up:"

See http://www.sophos.com/virusinfo/analyses/trojgraybirda.html for further
description and removal.