What is spoolsv.exe?

Some users have been wondering the spoolsv.exe process is indeed legitimate or if it merits additional investigations in order to exclude it as a malware threat. Most users come around discovering the spoolsv.exe ( Print Spooler under Spooler SubSystem App) in Task Manager or after encountering an error associated with the process.

While the process is most likely legitimate, users are strongly encouraged to conduct additional verifications if they observe that spoolsv.exe is consistently using a large number of system resources.

What is spoolsv.exe?

SpoolSv stands for Spooler Service. Spoolsv.exe is the main executable file responsible for running the Print Spooler Service – the process tasked with caching printing jobs into the system memory as image files. This is necessary because most printers are not equipped to analyze and decipher graphics and fonts.

The typical behavior for the spoolsv.exe process is to have system resources spikes when having to process different file formats into suitable images. Depending on the computer and its capabilities, this might end up taking quite a lot of time and resources.

Potential security threat?

If you’re consistently noticing high-resource usage caused by the spoolsv.exe process, you might actually be dealing with a malicious executable parading as a legitimate system process.

Keep in mind that discussing malware processes as system files is a very common practice among malware writers because it makes them harder to detect by security checks. The following six entries are virus variations that are known to camouflage as the Spoolsv.exe executable:

• Win32:Malware-gen
• Win32:Rootkit-gen
• Trojan.Generic.2882490
• Trojan.Generic.8524276
• CIADOOR.B 
• CIADOOR.121

Now that we know the most common threats associated with spoolsv.exe, let’s take the appropriate steps in order to make sure that you’re not dealing with virus threat. One of the easiest ways to do this is by viewing the executable’s location. To do this, open Task Manager (Ctrl + Shift+Esc) and locate the spoolsv.exe process in the Processes tab.

Once you locate the spoolsv.exe process, right-click on it and choose Open File Location. If the revealed location is different than C:\ Windows \ System 32, you’re most likely dealing with a malicious executable. You can be extra sure by uploading the executable in question to VirusTotal for analysis.

Note: C:\ Windows \System32 \drivers,  C:\ Program Files, and the temp folders are common locations for camouflaging malware.

If you’ve come to suspect that you’re dealing with a malicious process, we highly recommend that you scan your computer with a powerful anti-malware scanner. If you don’t have a security scan at the ready, you can use our in-depth article (here) to learn how to install, configure and use Malwarebytes to remove any malware from your system.

Should I disable spoolsv.exe?

Disabling the genuine spoolsv.exe is not advisable regardless of the circumstances. Keep in mind that given the fact that spoolsv.exe is a core process, force stopping it from Task Manager or from the Services screen might result in a critical failure that will crash your PC.

A better solution would be to just turn your printer off when you don’t use it. This way, the spoolsv.exe will not be called to do any spooling that will affect your CPU and RAM.

If you’re consistently noticing high CPU usage caused by the spoolsv.exe and you previously determined that the process is legitimate, running the Windows printing troubleshooter might just pay off:

• On Windows 10: Press Windows key + R to open un a run window. Then, type “ms-settings:troubleshoot” and hit Enter to open Windows Troubleshooter. Finally, click on Printer > Run the troubleshooter, then follow the on-screen prompts to apply the suggested fixes.
  
• On Windows 7 and Windows 8: Press Windows key + R to open un a run window. Then, type “control.exe /name Microsoft.Troubleshooting” and hit Enter to open Windows Troubleshooter. Then, click on Printer troubleshooter and follow the on-screen prompts to automatically find and fix any printing-related problem.

How to disable the spoolsv.exe process

However, if you’re keen on disabling this process, you can do it via the Services screen without causing your PC to crash. To do this, open a Run Window (Windows key + R), type “services.msc” and hit Enter to open the Services window.
In the Services screen, scroll down through the local Services list, right-click on Print Spooler and choose Properties.

In the Print Spooler Properties screen, go to the General tab and change the Startup type from Automatic to Disabled and hit Apply to save your changes.

This will prevent the spooler service (spoolsv.exe) from starting automatically the next time you start your PC. If you want the changes to become noticeable, simply reboot your PC.

Note: Keep in mind that while spoolsv.exe is disabled your computer will not be able to print, fax or discover new printers. If you ever decide to re-enable service (spoolsv.exe), follow the steps above once again and change the Startup type back to Automatic.