What is the "spoolsv.exe" process on windows 7? Is the "spoolsv.exe" process a virus? Can I terminate the "spoolsv.exe" process?

"spoolsv.exe" process represents "Spooler SubSystem App" program. "spoolsv.exe" process is created by the "Print Spooler" service.

"spoolsv.exe" process is normally running under the parent process "services" as shown in the process tree below:

Boot
   wininit
      services
         spoolsv

On the Processes tab of "Task Manager", "spoolsv.exe" process may be listed as:

Image Name                 Memory   Description
--------------------   ----------   -----------
spoolsv.exe              13,108 K   Spooler SubSystem App

Additional information about "spoolsv.exe" process:

Command line:
   C:\windows\System32\spoolsv.exe

Programe file information:
   Name: spoolsv.exe
   Location: C:\windows\System32\spoolsv.exe
   Description: Spooler SubSystem App
   Version: 6.1.7600.16385 (win7_rtm.090713-1255)
   Size: 559104 bytes
   Last modified: 2/11/2012 1:36:02 AM
   Company Name: Microsoft Corporation
   
Some data files used:
C:\Windows\System32
C:\Windows\System32\en-US\spoolsv.exe.mui
C:\Windows\System32\en-US\setupapi.dll.mui
C:\Windows\System32\en-US\localspl.dll.mui
C:\Windows\System32\en-US\KernelBase.dll.mui
C:\Windows\System32\en-US\WSDMon.dll.mui
C:\Windows\System32\en-US\win32spl.dll.mui
C:\Windows\System32\en-US\inetpp.dll.mui
C:\Windows\System32\win32spl.dll

Some registry keys used:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
HKLM\SYSTEM\ControlSet001\Control\SESSION MANAGER
HKU\.DEFAULT\Control Panel\International
HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5
HKLM\SYSTEM\ControlSet001\Control\Print
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers
HKLM\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port
HKLM\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor

Some DLL libraries used:
C:\windows\SYSTEM32\ntdll.dll
C:\windows\system32\kernel32.dll
C:\windows\system32\KERNELBASE.dll
C:\windows\system32\msvcrt.dll
C:\windows\SYSTEM32\sechost.dll
C:\windows\system32\RPCRT4.dll
C:\windows\system32\USER32.dll
C:\windows\system32\GDI32.dll
C:\windows\system32\LPK.dll
C:\windows\system32\USP10.dll

"spoolsv.exe" process is not a virus. You can disable the "Print Spooler" service to stop the "spoolsv.exe" process, if you are not using any printers. Terminating the "spoolsv.exe" process should not cause any issues when running Windows 7 system.

 

⇒System Service Processes on Windows 7

⇒⇒Windows 7 Processes Tutorials