Google Answers Logo
View Question
Q: spoolsv.exe & spoolvse.exe ( Answered,   1 Comment )
Subject: spoolsv.exe & spoolvse.exe
Category: Computers > Security
Asked by: feldmo-ga
List Price: $15.00
Posted: 14 Jan 2005 02:54 PST
Expires: 13 Feb 2005 02:54 PST
Question ID: 457101
I have a problem with two processes which are running in my pc. I
tried to stop them with antivirus software like symantec antivirus
2005  & search and destroy , but i didnt suceed. My upload its always
working when im connected in internet.
I formated my Pc and whithin 1h. the virus got activated again :(. How
can i stop them and protect my PC from further atacks ? Any1 has info
about this virus. I tried searching in google but didnt find anything.
Subject: Re: spoolsv.exe & spoolvse.exe
Answered By: pcrobin-ga on 27 Jan 2005 20:14 PST
Hi there,
Let me tell you what I was able to dig up on spoolsv.exe and
spollvse.exe and then talk about how to get rid of them.

Spoolsv.exe is Microsoft's Printer Spooler Service. This is a legit
and harmless file. Unfortunately it's often overwritten by the
Backdoor Ciadoor.B Trojan. This trojan sets itself up to run on system
startup. It also adds these lines to your win.ini file:
This Trojan then makes it possible for a remote user to access your
system. This user could download, install, run or delete files. He can
also take screen shots and log keystrokes that you type at your
keyboard. This is generally done in the hope of capturing passwords or
credit card information.
Additional background information and removal instructions for
Backdoor.Ciadoor.B can be found at

Spoolvse.exe installs with WORM_SDBOT.AJJ. You'll find it in your
Windows\System or System32 folder and you may see it described as
"Start Extracting". This worm spreads across weakly protected
networks. It takes advantage of RPC and DCOM security holes in
Microsoft Windows. More info can be found at and
a security update/patch is available at
This worm also allows a remote user access to your computer. Users
also report that it can terminate running processes, including
antivirus and anti-spyware programs. Additional background information
and removal instructions can be found here:

The links above show you had to edit your registry to remove
references to these files. If you do opt to give it a try, please make
a backup of your registry first. To do this, go to your START menu,
click on RUN. Type "Regedit". A new window will open. Click "File"
click "Export" type a name (I usually use the date) and click SAVE.

If you don't want to mess with your Windows registry, hopefully we can
automate the removal process. When spoolvse.exe is in memory, your
antivirus program (Norton Antivirus 2005) may not work right. If you
got NAV 2005 on a CD, put that CD in the drive and reboot your system.
As long as the disk is in the drive and it's a fairly new system, it
should boot from the Norton CD Rom. This way you'll be able to scan
your system without having the virus related files in memory. Run a
full scan and let it clean whatever it finds.

If you don't have the NAV CD available, try the free web-based scan at Again, let it clean whatever it

Next, boot your system into Safe mode. 
Restart the computer. The computer begins processing a set of
instructions known as the Basic Input/Output System (BIOS). What is
displayed depends on the BIOS manufacturer. Some computers display a
progress bar that refers to the word BIOS, while others may not
display any indication that this process is happening.
As soon as the BIOS has finished loading, begin tapping the F8 key on
your keyboard. Continue to do so until the Windows Advanced Options
menu appears. If you begin tapping the F8 key too soon, some computers
display a "keyboard error" message. To resolve this, restart the
computer and try again.
Using the arrow keys on the keyboard, scroll to and select the Safe
mode menu item, and then press Enter.
Click Start > Search > Files or Folders. Enter spoolvse.exe. When found, delete it.

If you'd done this and the virus (or viruses) still come back, they
could be hiding in System restore. Try disabling System Restore and
repeat the removal process:

If you need anything, just <a href="">email</a> me!
Subject: Re: spoolsv.exe & spoolvse.exe
From: calboater-ga on 14 Jan 2005 16:21 PST
go to Norton online security check
 and you will find there server can check your HDD for bugs
its the only way I could rid my PC of similar problems

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  

Google Home - Answers FAQ - Terms of Service - Privacy Policy