Tech: My Spools are Spinning!

Subject: Tech: My Spools are Spinning!
From: wysiwyg
Date: 05 Oct 07 - 09:26 AM

I'm going to be away from the puder most of the time between now and Tuesday, and then away again a few days after that, but can anyone tell me why spools.exe seems to eat up all my CPU mojo from time to time, and slows the works down to a crawl? What is spools.exe, and what do I need to look at to see what's hanging it up?

~Susan

Subject: RE: Tech: My Spools are Spinning!
From: MMario
Date: 05 Oct 07 - 09:34 AM

This from NOrton.


Description: File spools.exe is located in the folder C:\Windows. Known file sizes on Windows XP are 94208 bytes (75% of all occurrence), 94720 bytes.
The program has no visible window. File spools.exe is located in the Windows folder, but it is not a Windows core file. It is not a Windows system file. spools.exe is able to record inputs, hide itself, monitor applications. Therefore the technical security rating is 52% dangerous, however also read the users reviews.

If spools.exe is located in the folder C:\Windows\System32 then the security rating is 91% dangerous. File size is 2125312 bytes (75% of all occurrence), 260608 bytes. Program has no file description. The program is not visible. File spools.exe is located in the Windows folder, but it is not a Windows core file. The file is not a Windows system file. The process uses ports to connect to LAN or Internet. spools.exe is able to hide itself.

If spools.exe is located in a subfolder of "C:\Program Files" then the security rating is 74% dangerous. File size is 673792 bytes. The process has no file description. The program is not visible. It is not a Windows system file. The application uses ports to connect to LAN or Internet. spools.exe is able to hide itself.

If spools.exe is located in the folder C:\Windows\System32\drivers then the security rating is 90% dangerous. File size is 490496 bytes.

Subject: RE: Tech: My Spools are Spinning!
From: MMario
Date: 05 Oct 07 - 09:37 AM

and this:

The spools.exe file is installed and used by Win-Spy. This process silently works in background and performs harmful actions. It remains active while spools.exe is present in the system. Removing the file will immediately terminate spools.exe and prevent it from running later.

That is why you have to delete the spools.exe file. If you cannot erase it, consider using recommended spyware removers, which will get rid of spools.exe and associated parasites for you

Subject: RE: Tech: My Spools are Spinning!
From: Jeri
Date: 05 Oct 07 - 09:50 AM

Spools.exe is the program your computer uses to spool printing jobs. There are a couple of trojans that an infect it. I believe you need to fix the file rather than remove it.

W32/Kassbot-H
W32/Rbot-LD

Subject: RE: Tech: My Spools are Spinning!
From: JohnInKansas
Date: 05 Oct 07 - 10:24 AM

spools.exe is a component of a couple of virus/worm malware infections. The closest legitimate Windows files are spoolsv.exe and spoolse.dll.

The worms that include spools.exe are reported as attempting to disable common antivirus programs. A recommended procedure for worms of this kind, if they've gotten past your AV program, is that you go to one of the AV makers' sites and let the site do a remote scan of your computer. If the remote scan finds something that your installed AV didn't, you will need to get a clean copy (reinstall and update) of your own AV.

John

Subject: RE: Tech: My Spools are Spinning!
From: Jeri
Date: 05 Oct 07 - 10:47 AM

John, Microsoft seem to think it's a valid program. Bunch of threads related to 'spools.exe'

I've got it on my computer and I'm pretty sure other folks do too. Got a firewall, spyware programs and anti-virus updated daily.

Subject: RE: Tech: My Spools are Spinning!
From: Jeri
Date: 05 Oct 07 - 10:57 AM

I've got a 'spools.exe' process running, but no such file is on my computer. The process may be named differently than the .exe file? Dunno, but I need to run scans for everything anyway.

Subject: RE: Tech: My Spools are Spinning!
From: wysiwyg
Date: 05 Oct 07 - 04:42 PM

Hm, I see you've all been hard at work on this while I've been off running around. Seems consensus may not yet have happened, but I'll try a remote scan and some de-spywaring. I do have NAV (recent version) and Live Update just ran today, and I scan twice a week plus firewall stufferoonies.

~S~

Subject: RE: Tech: My Spools are Spinning!
From: wysiwyg
Date: 05 Oct 07 - 05:01 PM

I should mention that I also often seem to have a lot of mojo going to svchost.exe, System Idle Process, and CCAPP.EXE.

That is, according to Windows Task Manager.

The spools I see running now (just picked up the new glasses) is sppoolsv.exe, though.

But my favorite acronym in there is devldr32.exe. I suppose it means device loader or some such, but I always see it as Devil Drive.

~S~

Subject: RE: Tech: My Spools are Spinning!
From: IvanB
Date: 05 Oct 07 - 05:22 PM

The threads to which Jeri refers seem to all involve either NT 4.0 or Windows 2000, both OS's which I doubt many MudCatters use. A check of my computer shows no existence of any spools.exe file under either WinXP or Vista.

For those of you who have references to the spools.exe file but cannot find it, is "Show hidden files and folders" checked and "Hide protected system files" unchecked under Tools/Folder Options/View? If either of the above ar untrue, this may be the reason for the file not showing.

Ma Microsoft recommends against the above settings but I want to see ALL my files when I do a directory listing so I reject her maternalism. Just be careful not to delete any critical files if you use these settings.

Subject: RE: Tech: My Spools are Spinning!
From: JohnInKansas
Date: 05 Oct 07 - 06:05 PM

WYS -

The "System Idle Processes" is sort of a puzzle to many. It quite frequently shows 100% of processor cycles being used there, but you should note that often when the system is idle there aren't many cycles doing anything.

I found one reference citing spools.exe as an existing file that malware could modify, but as noted it doesn't appear on my machines, or in the CAB files on the machines as anything that could be installed as part of the Windows versions I have.

If your file is the spoolsv.exe, I've found no references to it being affected by the worms mentioned. If it's the real file, it may be subject to the "Idle" feature that, even though it's not doing very much of anything, that's a large percentage of what's happening. The 100% of processor that you're likely to see doesn't necessarily mean 100% of available processor.

If you click the "Performance" tab in Task Manager, you may get a clearer view of "how busy" the machine is. Between typing here, my Task Manager Process tab is showing "Idles" at 98% (of cycles used), but Performance tab shows CPU usage flitting between zero and about 4%. My spoolsv.exe is hogging about 14.5 MB of memory (i.e. it's loaded) but it isn't doing anything at all.

For an even better view in WinXP (maybe in others) you can open Control Panel, click Administrative Tools, and open the "Performance" window. I won't promise it will be particularly helpful, but it may let you think you know more than you did(?). (That's about all it does for me.)

John

Subject: RE: Tech: My Spools are Spinning!
From: katlaughing
Date: 05 Oct 07 - 07:27 PM

John, in my WinXP, it's Control Panel>Performance>Administrative Tools.:-)

I don't see any spools anything in my Task Mgr. nor in poking around in my Control Panel stuff. I noticed even if I untick the "don't show hidden files' my Search dog still says he is not searching hidden files,so how would I know if spools.exe is on my system. just curious. I don't think it is, but would like to check for sure. I do have AdAware and Spybot set up to scan weekly. I will go try a remote scan anyway.

Thanks!

Subject: RE: Tech: My Spools are Spinning!
From: katlaughing
Date: 05 Oct 07 - 07:37 PM

While we are at it...anyone know of a remote scan which works with Mozilla? I've tried Symantec's, but it always says it won't work without using IE OR Netscape. I tried with my almost latest version of Netscape and it still said it wouldn't work. When I checked to see whether my version of Netscape was updated enough, which it was, I saw it was "based on Mozilla" so I guess that was it?!

Subject: RE: Tech: My Spools are Spinning!
From: IvanB
Date: 05 Oct 07 - 08:12 PM

kat, I'm using Vista, which has a radically different search window, but I distinctly remember there was a way to force WinXP and previous Windows versions to include hidden and system files in a search. Just can't remember the mechanics now.

Does your search dialog have an "Advanced" options box? If so, try clicking that.

Subject: RE: Tech: My Spools are Spinning!
From: Jeri
Date: 05 Oct 07 - 09:22 PM

In Windows XP:

Tools>Folder Options>View (tab)

Files and Folders,
--Hidden files and folders,
---'Show hidden files and folders' marked

Mines always been 'show'.

Now I can't say whether I was being stupid or something changed (my money's on the former) but now the process is the one with the 'v'. I swear it didn't have a v before, but I got a cell phone yesterday and I think it sucked out some smart thingies... IQ whatsits. It's got texting, and now I can also drive and talk on the phone like everybody else. Sorry. I just did a complete, and I mean COMPLETE virus scan, and I got bupkis. Which is good, but it means I'm stoopider than I thought.

Subject: RE: Tech: My Spools are Spinning!
From: The Fooles Troupe
Date: 06 Oct 07 - 07:24 AM

From basic computing theory, when a computer OS is doing 'nothing' the process that allocates tasks allocates a 'process' called 'idle' to run, so that the computer doesn't lock up! The processor is either 'working on a task' or 'stopped waiting a task to run'.

Usually it does 'nothing', but on big grunt boxes, it can be organised to do 'useful things' like calculate Pi to 1 million decimal places, etc.

Now a 'spooler' is a process that waits for input from something and queues it up to feed it somewhere, usually things like gathering output from 'printing jobs' and feeding it to a 'printer device'.

Malware can infect many things, and pretend to be 'normal processes' - they can infect you by means of 'trojans' and 'worms', etc.

If you run the various scan things and have a firewall, and do the necessary things that stop malware form getting your system, then the processes should be 'standard' - the fact that an 'idle process' show a high usage while 'nothing else is running' is not of itself a cause for worry.

As for 'spoolers' - the Win9x systems used to have a way of NOT running things like spoolers until they were 'needed'. That said, you need some sort of 'monitor process' running that can detect the need to start such other processes.

Subject: RE: Tech: My Spools are Spinning!
From: JohnInKansas
Date: 06 Oct 07 - 02:45 PM

In Windows Explorer for WinXP there are some differences between WinXP Pro and WinXP Home with respect to the layout and location of the Search and Tools utilities. Menus and options may vary some.

When you select Search there are choices for the kind of things you want to search for, so that you can accept Microsoft's contention that you're an idiot and don't know what's a picture, video, or music file unless they "help" you. Unless you have a particular reason for using one of the other options, I suggest always using the "all files and folders" option. With that option, there should be a place to put in what you want to search for, either all or part of the filename or something in the file.

There should be options to search by file size or by when the file was accessed/modified, and an "Advanced" button/arrow that rolls down some additional options, with (at least in my WinXP Pro) a place there to tell it whether to include hidden and system files, and whether to search in subfolders.

If you choose the option there to include hidden and system files, they usually (probably always) will be found and displayed in the search results regardless of whether you've used the "Tools" options to display them; but I suggest turning on the views in Tools if that's what you're looking for as the display of results may have some "mildly confusing effects" if they're not turned on before you search.

If you know the filename that you want to look for, and really want to be sure¹ if it's there or not, I'd suggest using the "Command Prompt" window (also called, not too accurately, the "DOS Window") and search using both the "DIR" and "ATTRIB" commands, each in turn, from the C:\> folder. (Don't forget the "/S" switch in both.)

Re browsers: Internet Explorer also is "Mozilla Based," although I'm not sure why that's of much significance where it was mentioned(?).

¹ "sure" = "as sure as you can reasonably be"

John

Subject: RE: Tech: My Spools are Spinning!
From: JohnInKansas
Date: 06 Oct 07 - 02:47 PM

Subject: RE: Tech: My Spools are Spinning!
From: JohnInKansas
Date: 06 Oct 07 - 02:51 PM

I have no explanation for why the 'cat decided to post the "blank" post following the last one I wrote. Both appeared on one "Submit Message" click. Maybe it's an apology for the rare ones that "went up in smoke" on some prior "Submits."

John