spoolsv.exe - Printing Queue Service
The Microsoft Windows printing subsystem uses the spoolsv.exe process when managing in-process documents. The "spool" component of the name refers to the concept of "spooling" a document to a printer (a printer queue is often referred to as a "spool"). This is a legitimate Windows component, and is should be visible in Task Manager if you have any printers defined on your machine.In certain cases, spoolsv.exe can use a great deal of CPU time and memory. Large, complex printing jobs can easily trigger significant growth in the size of this process. Generally this memory should be freed once the job completes.
In cases where spoolsv.exe continually uses a large percentage of free CPU time (e.g. 90% or more), the problem may be related to a faulty or outdated printer driver. In this case, delete one printer at a time from your system until the process stops using excessive CPU time. Once the problematic device has been identified, obtain and install a newer printer driver to see if the behavior changes. If it does, contact the printer vendor for further assistance.
The spoolsv.exe process should always run under the SYSTEM user ID. If you note any copies of this process running under a different user ID, it probably represents a malware application of some type that's infesting your PC.
The legitimate copy of spoolsv.exe resides in the C:\windows\system32 directory. Other copies are almost certainly malware attempting to conceal themselves from virus scanning processes. Many malware applications have attempted to hijack the spoolsv.exe file name. These include the viruses designated Backdoor.Ciadoor.B, VBS.Masscal.Worm (vbs), and Hacktool.Privshell by Symantec. Others may make use of the same file name.
As always, if you suspect a malware infestation you should download and run a current copy of an antivirus/malware scanner in order to isolate and remove the offending application. Be sure to obtain the most recent definition files, since these are critical to the removal of current malware variants.
windowshelp.net