spoolsv.exe (Win32.Rbot.WO)

PC Pitstop Analysis

spoolsv.exe, when associated with the product name of mIRC, may likely be part of the Win32.Rbot.WO virus. According to CA:

"Win32.Rbot.WO is an IRC controlled backdoor (or "bot") that can be used to gain unauthorized access to a victim's machine. It can also exhibit worm-like functionality by exploiting weak passwords on administrative shares and by exploiting many different software vulnerabilities, as well as backdoors created by other malware. There are many variants of Rbot, and more are discovered regularly. Rbot is highly configurable, and is being very actively developed, however the core functionality is quite consistent between variants."

Recommendation

spoolsv.exe is a VIRUS. Stop all work until the virus is removed or you run the risk of spreading the virus to other people. Worse yet, the virus may be doing harm to your computer and your information.

spoolsv.exe is a virus and should be removed immediately to avoid doing further harm. PC Pitstop recommends CA Antivirus in these types of situations.

Identification

In addition to the file name, spoolsv.exe, the following version information is used to identify the file. If the file does not match this information, it may be a different file. To ensure the file is absolutely correct, run a free and comprehensive scan.

Vendor is not specified
Product contains:	mIRC

To view version information with Windows Explorer, right-click the file and click Properties, Version.

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. spoolsv.exe (Win32.Rbot.WO) has been seen on 0.00% of systems tested at PC Pitstop. As a point of comparison, it is rare for a particular malicious program (virus or spyware) to be seen on more than one or two percent of all systems tested.

PCs running this program did not have a high average CPU load during testing, which indicates it does not consume a great deal of CPU time on most systems.

Vendor or Distributor's Web Site

http://search.ca.com/search/ca?charset=utf-8&qt=spoolsv.exe&rq=0&la=en&oq=spoolsv.exe&Submit=Search

Detailed Description and/or Removal Instructions

http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=44554

Match #2

spoolsv.exe (Possible Virus Read)

PC Pitstop Analysis

spoolsv.exe is a file name that some malwares use, look into Site URL.
spoolsv.exe is the Print spooler for Windows 2000/XP. Leave this service running unless you never do any printing. If spoolsv.exe is not running, the Add Printer function will not work properly and no printers will be available.
However USUALLY spoolsv.exe has in Vendor field "Microsoft" just like Product has "windows", was detected that this file has no vendor or product information which makes it just suspicious.
Was found a virus/trojan with the same name, run a virus scan to be sure that is not the case.

Recommendation

spoolsv.exe is a virus and should be removed immediately to avoid doing further harm. PC Pitstop recommends CA Antivirus in these types of situations.

Identification

The file name alone identifies this program.

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. This program has not been seen on any systems tested at PC Pitstop in the past week.

Detailed Description and/or Removal Instructions

http://search.ca.com/search/ca?style=en&search_button=Search&qt=spoolsv.exe&col=

Match #3

spoolsv.exe (Print spooler)

PC Pitstop Analysis

spoolsv.exe is the Print spooler for Windows 2000/XP. Leave this service running unless you never do any printing. If spoolsv.exe is not running, the Add Printer function will not work properly and no printers will be available.

Recommendation

spoolsv.exe is required by third-party software or hardware and should not disabled.

spoolsv.exe is a virus and should be removed immediately to avoid doing further harm. PC Pitstop recommends CA Antivirus in these types of situations.

Identification

Vendor contains:	Microsoft
Product contains:	Windows
File name contains:	\system32\

To view version information with Windows Explorer, right-click the file and click Properties, Version.

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. spoolsv.exe (Print spooler) has been seen on 81.45% of systems tested at PC Pitstop. As a point of comparison, it is rare for a particular malicious program (virus or spyware) to be seen on more than one or two percent of all systems tested.

PCs running this program did not have a high average CPU load during testing, which indicates it does not consume a great deal of CPU time on most systems.

Vendor or Distributor's Web Site

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q314876

Important note: A file name alone may not be enough for positive identification. PC Pitstop's full tests and spyware scan use information such as the company name, product name, or install directory. If you are unable to identify a file, ask about it in our forums after running our full tests.