Spool

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	AdobeReaderPro	spoolss.exe	"Added by the SDBOT-AKZ WORM!"
U	ATSpooler	AppsTraka.exe	"DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself!"
X	autoload	spooll.exe	"Added by the SILLYFDC WORM!"
X	autoload	spool.exe	"Added by the AGENT-GSG TROJAN!"
X	dumprep	spoolc.exe	"Detected by Kaspersky as a variant of the AGENT.CXF TROJAN!"
X	firewall	spoolsv.exe	"Added by the DIZAN.F VIRUS!"
X	IPC Spool Manager	wnmgre.exe	"Added by the SDBOT-ZC WORM!"
X	IPC Spool Manager	winspec.exe	"Added by the SDBOT-BLU WORM!"
X	LaserJet	spoolvs.exe	"Added by the DLOADER.PFR TROJAN! This is not the file of the same name from older versions of MS Office - see the link for the location"
X	load=	Spoolsv.exe	"Added by the CIADOOR.B TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X	Micrcoft Exploerer	spoolsal.exe	"Added by the RBOT-AKK WORM!"
X	Micrcoft Updat	spoolsae.exe	"Added by the RBOT-AIB WORM!"
X	Micrcoft Updat	spoolsaex.exe	"Added by the RBOT-AJM WORM!"
X	Microft Exploerer	spoolsac.exe	"Added by the RBOT-AMD WORM!"
X	Microsoft Client Pc	spoolsrv.exe	"Added by the RBOT-AQM WORM!"
X	Microsoft DirectX	Spoolserv.exe	"Added by the DINFOR WORM!"
X	Microsoft MSUPDATE	SpoolSvc.exe	"Added by the SXTB-A TROJAN!"
X	Microsoft Spool ** Service	spool**.exe	"Added by a variant of the IRCBOT TROJAN - where ** represents a 2 digit number"
X	Microsoft Spool Server for Win32	spoolsrv.exe	"Added by the RANDEX.H WORM!"
X	Microsoft Spool Svc	spoolsvc32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Spooler Services	Spoolsv.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Task Manager Daemon	spoolsrv.exe	"Added by the SDBOT.FLL WORM!"
X	Microsoft Update	spool.exe	"Added by the AGENT-GJC TROJAN!"
X	Microsoft Update 23	spoolvs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	spoolvs.exe	"Added by the RBOT-BBQ WORM!"
X	Microsoft Update Machine	spoolserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	MicrosoftPersonalFirewall	spoolsrv.exe	"Added by the WOOTBOT.DO BACKDOOR!"
X	MicrosoftSys	SPOOLSYS.exe	"Added by the TARNO.N TROJAN!"
X	ms spool service	msspooler.exe	"Added by a variant of the RBOT WORM!"
X	Ms Spool32	MS SPOOL32.EXE	"Added by the ASASSIN TROJAN!"
X	NT Printing Service	spoolsc.exe	"Added by the BUZUS-K WORM!"
X	NTSpool	NTSpool.exe	"Added by the AGENT-GPY TROJAN!"
X	ntuser	spool.exe	"Added by the DLOADER.DYA TROJAN!"
X	ntuser	spools.exe	"Added by the AGENT-GRO TROJAN!"
X	PolicyRun	spoolsv32.exe	"Added by the BACKDOOR-DNV TROJAN!"
X	Print Spooler	Spoolsv.exe	"Added by the CIADOOR.B TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X	Print Spooler	spoolsvc32.exe	"Added by the SDBOT.BB TROJAN!"
X	Print Spooler	spools.exe	"Added by the RBOT-LD WORM!"
X	Print Spooler	spool.exe	"Added by the BDOOR-IS BACKDOOR!"
X	Print Spooler	spoolsv32.exe	"Added by the RBOT.SW WORM!"
X	Printer Services	spool.exe	"Added by the RBOT-Y WORM!"
X	Printer Spool	updater.exe	"Added by a variant of the RBOT WORM!"
X	Printer spool Service	spool.exe	"Added by the RBOT-ACP WORM!"
X	printer spooler	commonaccess.exe	"Added by the DELF-LB TROJAN!"
X	Printer Spooler	spooler.exe	"Added by the DELF-JJ TROJAN!"
X	Printer Spooler Subsystem	spoolss.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Windows spoolss.exe process which is always located in %System% and should not figure in Msconfig/Startup!"
X	PrinterSpool	[path] RESTORE.EXE [path] SPOOL.EXE	"Added by the ALADINZ.K TROJAN!"
U	PrintSpooler	lass.exe	"Win-Spy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	PrintSpoolSv	System.exe	"Added by the BDOOR-S BACKDOOR!"
X	reggsdg	spoolserv.exe	"Added by the SDBOT-MS WORM!"
X	reggsdg	spoolsrv.exe	"Added by the SDBOT-DI WORM!"
X	rpc Win32	spoolscv.exe	"Added by a variant of the RBOT WORM!"
X	Run Services as Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Service Host	spoolxx.exe	"Added by the TORVEL WORM!"
X	Service Host Process	spoolsvc.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	Services Administrator	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Shellspl	spools.exe	"Added by the PROXAGE-A TROJAN!"
X	Sistem Services	syspool.exe	"Added by the AGOBOT-GF WORM!"
X	software	spools.exe	"Added by the AUTORUN-CS WORM!"
X	Spool	[path to trojan]	"Added by the RANKY.R TROJAN!"
X	Spool	wys.exe	"WhileUSurf adware"
X	Spool	static.exe	"Added by an unidentified WORM or TROJAN! Located in the Root folder (C:\)
X	SPOOL Configuration	spoolsvc.exe	"Added by the SDBOT-KD WORM!"
X	Spool Loader	spool.exe	"Added by a variant of the RBOT WORM!"
X	Spool LoadKIt	spoolv.exe	"Added by a variant of the RBOT WORM!"
X	Spool lptt01	spool.exe	"RapidBlaster variant (in a ""spool"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spool Manager	spoolsrv.exe	"Added by the BANKER-FR TROJAN!"
X	Spool ml097e	spool.exe	"RapidBlaster variant (in a ""spool"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spool32	pool32.exe	"Added by the ASSASIN-F TROJAN!"
X	spoolax	[path to trojan]	"Added by the PERDA-D TROJAN!"
X	Spooler de Impress	services.exe	"Added by the AGENT-NEX TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %User%"
X	Spooler Host	smhost.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Spooler Service	Spoolsrv.exe	"Added by the JOINER.C1 TROJAN!"
X	Spooler Subsystem	spoolsub.exe	"Added by the SDBOT-ABG TROJAN!"
X	Spooler SubSystem App	spoolsvc.exe	"Added by the POEBOT-J WORM!"
X	Spooler SubSystem App	spooIsv.exe	"Added by the LINKBOT.M WORM!"
X	Spooler SubSystem App	spoolv.exe	"Added by the SDBOT-BN WORM!"
X	Spooler SubSystem Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler Subsystem Application	smss.exe	"Added by the IRCBOT-ZO TROJAN! Note - the legitimate smss.exe process should not normally figure in Msconfig/Startup!"
X	Spooler Subsytem App	spoolsvc.exe	"Added by the SDBOT-MM WORM!"
X	SpoolerSubSystemProcess	SpooI32.exe	"Added by the EHKS.21 keylogger! Note - the ""I"" between ""o"" and ""3"" is a capital ""i"" not a lower case ""L"""
X	spoolms	spoolms.exe	"Added by the LEGMIR-ARO TROJAN!"
X	Spools Service Controller	spools.exe	"Added by the KASSBOT-C WORM!"
X	spoolserv	spoolserv.exe	"Added by the SDBOT-PN WORM!"
X	SpoolService	spolsv.exe	"Added by the AGOBOT-CS WORM!"
X	spoolsrv.exe	spoolsrv.exe	Added by an unidentified WORM or TROJAN! Located in %System%
X	Spoolsv	Spoolsv.exe	"Added by the CIADOOR.121 VIRUS! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X	spoolsv	scvhosts.exe	"Added by the SMALL-AW TROJAN!"
X	spoolsv	svchost.exe	"Added by the DLOADER-FI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\HELP"
X	spoolsv	spoclsv.exe	"Added by the FUJACKS-M WORM!"
X	spoolsv	spoolsv.exe	"Added by the ZAPCHAS-EE TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%\Temp\spoolsv"
X	spoolsv	spoolvs.exe	"Added by the AGENT-HNV TROJAN!"
X	spoolsv	spoolsv.exe	"Added by the ANTINNY-BH WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\Messenger"
X	spoolsv	spoolsv.exe	"Added by the OURXIN.C TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in a ""spoolsv"" subfolder"
X	Spoolsv	spoolsv.exe	"Added by the ANTINNY.F WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Program Files%\Lotus"
X	spoolsv manager	SpoolMgr.exe	"Added by the ASSIRAL WORM!"
X	spoolsv service	spoolsv32.exe	"Added by the RBOT-AHP WORM!"
X	spoolsv.exe	[random filename]	"Added by the RBOT-JB WORM!"
X	SPOOLSV32	SPOOLSV32.EXE	"Added by the CWS-I or HAZIF-B TROJANS!"
X	SPOOLSV32.exe	SPOOLSV32.exe	"Added by the STARTPAGE.O TROJAN!"
X	spoolsvc	spoolsvc.exe	"Added by the DROPPER-AT TROJAN!"
X	spoolsvr	SPOOLSVR.EXE	"Added by the RAYROB.A TROJAN!"
X	spoolsvr32	csmss.exe	"Added by the AGENT-AU TROJAN!"
X	spoolsvr32	csmss32.exe	"Added by a variant of the AGENT-AU TROJAN!"
X	spoolsvs	wintre.exe	"Added by the SDBOT.EGQ WORM!"
X	spoolsvs	wincfy.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	spoolsvs.exe	spoolsvs.exe	"Added by the DLOADER-RK TROJAN!"
X	SPOOLSVU	SPOOLSVU.EXE	"Added by the STARTPAGE.K hijacker"
X	spoolsvv	spoolsvv.exe	"Searchcentrix hijacker"
X	Spoolvs	spoolvs.exe	"Added by the SDBOT.AUS WORM!"
X	Srv32 spool service	runsrv32.exe	"Topantispyware.com malware - detected by Kaspersky as the SPYRE.B TROJAN!"
X	Srv32 spool service	spoolsrv32.exe	"Added by the SPYRE-B TROJAN!"
X	Srv32 spool service	[path to trojan]	"Added by the DLOADER-LB TROJAN!"
X	start extracting	spoolvse.exe	"Added by the RBOT-XF WORM!"
X	start extracting	spoolvs.exe	"Added by the RBOT.BAN WORM!"
X	Start Upping	spoolnt.exe	"Added by the RBOT-TM WORM!"
X	SunJavaUpdatSched	spoolsv.exe	"Added by the BANCBAN-NP TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\MSN Messenger"
X	SVCHOST	SPOOLSV.EXE	"Added by the BAITAP-A WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
Y	SysPool	Mssvc.exe	"StealthDisk - hides folders
X	SysPool	MSSVC32.EXE	"Added by the BANCBAN-IO TROJAN!"
X	System	SPOOLSU.EXE	"Added by the BANKER-FC TROJAN!"
X	system service	spoolcrv.cpl	Added by the INSPIR.11 TROJAN!
X	system spool	syspools.exe	"Added by the DREF-T WORM/VIRUS!"
X	System Spooler Subsystem	lssas.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System Tray Services	spooles32.exe	"Added by the AGOBOT.ZH WORM!"
X	System Update2	winspool.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System32 Spool	winint.exe	"Added by the FORBOT-N WORM!"
X	Systems	spoolsvc.exe	"Added by the DLOADR-SW TROJAN!"
X	Tcp Application Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Vital Load Process	Spoolsvr.exe	"Added by the RBOT.AIF WORM!"
X	vscanner	spooll32.exe	"Added by the OPTIXPRO.10 TROJAN!"
X	WCESMngr	spoolsb.exe	"Added by the AGOBOT-QZ WORM!"
X	Win32 System Spool	spoolsvc.exe	"Added by the SDBOT.UK WORM!"
X	Windows (ICS) Spooler	crtss.exe	"Added by a variant of the RBOT WORM!"
X	Windows .Net Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows DLL Tracker	spoolsrv.exe	"Added by a variant of the WOOTBOT WORM!"
X	Windows Local Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Spooler	lssas.exe	"Added by the RBOT.BXQ WORM!"
?	Windows Print Spooler	SCVHOSTS.EXE	"Suspicious due to the similarity to the valid ""svchost.exe"" file"
X	Windows Print Spooler	NavAgent32.exe	"Added by an unidentified VIRUS
X	Windows Print Spooler	SVEHOST.EXE	"Added by the SPYBOT.H WORM!"
X	Windows Printing Driver	WinSpooler.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	Windows Service Agent	spoolvs.exe	"Added by the RBOT-GXI WORM!"
X	Windows Service Agent	spools.exe	"Added by the AGENT-GJF TROJAN!"
X	Windows Service Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Services	spoolsvc.exe	"Added by the SDBOT.CPZ WORM!"
X	Windows Spool	winspool.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Spool Server	spoolsrv.exe	"Added by the SDBOT-ACT WORM!"
X	Windows SpoolaPrint Service	spoolasrv.exe	"Added by the SDBOT-AYD WORM!"
X	Windows Spooler	SPOOLSRV.EXE	"Added by the SPYBOT.P WORM!"
X	Windows Spooler	spoolsv32.exe	Added by an unidentified WORM or TROJAN!
X	Windows Spooler	winsplr.exe	"Added by the SHEUR.ANX TROJAN!"
X	Windows Spooler Control Service	qwidh.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Spooler Services	spool.exe	"Added by the AGOBOT-AMO WORM!"
X	Windows SpoolPrint Service	spoolersrv.exe	"Added by the SDBOT-ZT WORM!"
X	Windows Spools SV	winsv.exe	"Added by the RBOT-AUQ WORM!"
X	Windows spoolservr Service	spoolservr.exe	"Added by the SDBOT-AAN WORM!"
X	Windows Spoolsre Service	spoolsre.exe	"Added by the SDBOT-AAE WORM!"
X	Windows Spoolsrv Service	spoolmsv.exe	"Added by the SDBOT-ZS WORM!"
X	windows spoolsrv service	spoolssv.exe	"Added by the SDBOT-AWV WORM!"
X	Windows Spoolsurf Service	spoolsurf.exe	"Added by the SDBOT-ZZ WORM!"
X	Windows SpooltPrint Service	spooltsrv.exe	"Added by the SDBOT-AYE WORM!"
X	Windows Spoolvvv Service	spoolvvv.exe	"Added by the SDBOT-AAW WORM!"
X	WINDOWS SYSTEM DNSPOOL	hbmail.exe	"Added by the MYTOB.FW WORM!"
X	Windows System Gateway	SPOOLER.EXE	"Added by a variant of the RBOT WORM!"
X	WINDOWS SYSTEM MANAGER	spoolsvc.exe	"Added by the MYTOB-LY WORM!"
X	Windows SYStry	spoolsvr.exe	"Added by the SDBOT.GN BACKDOOR!"
X	Windows Updated	spoolsae.exe	"Added by the RBOT-APM WORM!"
X	Windows Web Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Zero Spooler	nmvcs.exe	"Added by the SLENFBOT.JQ WORM!"
X	WindowsXp Security	spool.exe	"Added by the RBOT-GRK WORM!"
X	Winspool	spoolsvr.exe	"Added by a variant of the SDBOT WORM!"
X	win_spool2	win_spool2.exe	"Added by the SCKEYLOG.B TROJAN!"
X	wnxpupdate	spvspool.exe	"Added by the DABORA.B WORM!"
X	WSConfiguration	spoolsc.exe	"Added by the AGOBOT-HY WORM!"
U	ZingSpooler	ZingSpooler.exe	Was used for a drag and drop program to upload pictures to www.zing.com but Zing has gone out of business. Now used for Sony ImageStation's upload photos to online albums
X	[random name]	spoolsv.exe	"PurityScan adware. Note - this is not the legitimate spoolsv.exe which is always located in %System%"
X	[random name]	w?nspool.exe	"PurityScan adware"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.