spoolsv.exe / 99% cpu

[Shawn Modersohn]

For some reason the print spooler is using 99% cpu on a xp sp2 machine.
As soon as I stop this service the computer runs as fast as would be
expected. I read that sometimes the Ciadoor.B trojan can register as
spoolsv.exe but I am confident this is not the case on this particular
machine. Anyone have any ideas? Thanks.

 

[typical computer geek]

how can you be so sure that this is not the case

 

[David H. Lipman]

From: "Shawn Modersohn" <[email protected]>

| For some reason the print spooler is using 99% cpu on a xp sp2 machine.
| As soon as I stop this service the computer runs as fast as would be
| expected. I read that sometimes the Ciadoor.B trojan can register as
| spoolsv.exe but I am confident this is not the case on this particular
| machine. Anyone have any ideas? Thanks.

You might be confident, but, you havent proven it isn't the "Backdoor.Ciadoor.B"

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.


* * * Please report back your results * * *

 

[Shawn Modersohn]

From: "Shawn Modersohn" <[email protected]>

| For some reason the print spooler is using 99% cpu on a xp sp2 machine.
| As soon as I stop this service the computer runs as fast as would be
| expected. I read that sometimes the Ciadoor.B trojan can register as
| spoolsv.exe but I am confident this is not the case on this particular
| machine. Anyone have any ideas? Thanks.

You might be confident, but, you havent proven it isn't the "Backdoor.Ciadoor.B"

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.


* * * Please report back your results * * *

Panda didn't report anything (for whatever that is worth I know)and
netstat didn't show anything on the trojans default port. At any rate I
will try the multi_ave.exe utility and report the results. Thanks to
everyone for replying so far.

 

[Dan Conrad]

For some reason the print spooler is using 99% cpu on a xp sp2 machine.
As soon as I stop this service the computer runs as fast as would be
expected. I read that sometimes the Ciadoor.B trojan can register as
spoolsv.exe but I am confident this is not the case on this particular
machine. Anyone have any ideas? Thanks.

I had the same issue and when I looked at the printers some microsoft
image documents were waiting to print -- deleted these and everything
was fine.

 

[Shawn Modersohn]

For some reason the print spooler is using 99% cpu on a xp sp2 machine.
As soon as I stop this service the computer runs as fast as would be
expected. I read that sometimes the Ciadoor.B trojan can register as
spoolsv.exe but I am confident this is not the case on this particular
machine. Anyone have any ideas? Thanks.

It was not a virus at all, rather 25 added non existent printers each
with about 100 documents waiting to print. Thanks for all the
suggestions.