Kspoold.exe, eat your document files and flooding network

Just a few days ago I found this virus process on my computer server, it’s make my server running slowly and make my server as boot flooding zombie. I know it after dal.net autokill my IP address with reason flooding network.

Kspoold.exe virus is not totally broken your computer and very easy to remove I rate it as low risk virus, but.. if you let it stay for a days the virus will checking for any shared folders on your network and make clone on other computer in same network. And the bad news… This virus will change all yours office document files with extension .DOC .XLS .MDB .PPT and you can’t get your document back without this 3rd party tolls, if you’re in big company this is serious problem.

How to remove manually Kspoold.exe virus

First This virus have to be shutting down, Kspoold.exe is running as windows service.

  • Open service manager by click Start -> Run, type: services.msc, then enter.
  • Find service with name K Print Spooler, Watch out for Print Spooler service do not wrong.
  • Images 1
  • Double click on that service . The new window will open with label : K Print Spooler Properties (Local Computer)
  • Click on tab Log On
  • Images 2
  • Click option This Account, type username .\Guest, without password (let it blank)
  • Click Disable button to stop virus process running on computer background.
  • Click Apply button, then click OK.
  • Click on tab General.
  • Stop proses by click Stop button.
  • Images 3

And this virus now not running on your computer. Last step is going to your %SYSTEMROOT%\system32\ and find file with name kspoold.exe delete it.

Optionally you don’t need to remove this line from your registry to stop the virus infected your system in the future.

  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kspooldaemon
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\kspooldaemon
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

Similar Posts:


Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.