From: Jeff Shultz 

I did some updating today at work - Microsoft Office updating. I went to
the Office Update and started downloading what they told me to - it ended
up being Office 2k SP-something for Disk 2 and Office XP SP1 & SP2 +
hotfixes.

And then the weirdness started... after a little while I noticed my
computer was acting sluggish, very sluggish. And there was this tiny window
down in the lower right hand corner of my screen, barely big enough to
contain the "X" close button that it had in it. I think there
might have been an "M" as the first letter on the title bar
behind it. I could sorta select it, I couldn't move it, make it larger,
restore it or close it. It just sat there. And the machine was still
sluggish.

Okay, C-A-D and pull up Task Manager... after a couple of tries it actually
came up (whoa, something is really hogging the cycles!). Nothing weird in
the Programs tab - everything there I expected to be there. Go over the
Processes tab... okay, why is spoolsv.exe taking up 95-99% of the CPU?
Couldn't kill it, couldn't touch it... it resembled the little box in a lot
of ways. Finally got a shutdown to start taking... but had to hit the
button to finally shut it off and restart it.

After it reboots everything is fine and dandy for awhile... and then in the
middle of a customer call I notice it's acting sluggish again... and the
little box is back... and spoolsv.exe has taken over the CPU again. Run
Adware - nothing. Try to run Norton AV (corp ed.) and it takes 6 minutes to
get through two files before I kill it. Pull the network cable from the
wall. Time to try to reboot again... kill everything off, hoping that one
of the running programs is causing the print spool (for that is what
spoolsv.exe is) to go nuts (I hadn't printed nor tried to print anything
btw). No luck. Right before everything goes blue (not the BSOD, just the
blank background) Win2k (SP4 if I haven'b mentioned it) admits that it's
closing something called "Messagebouncer". Hmmm. Have to use the
power switch again.

Boot up, start hunting for Messagebouncer - ends up it's in a Real One .dll
- goodbye Real. Go in and turn of a bunch of services (something I probably
should have done awhile ago). spoolsv.exe just sits there at 0%. Go looking
through the registry..... no real luck. Run Norton... this time it at least
runs, and was still running when I left. spoolsv.exe was still just sitting
there at 0%.

Any ideas what the heck happened? And how to stop it from happening again?
Other than not attempting Office Update that is...... BTW, spoolsv.exe is
45k in size and I think the date was 6/19/2003. It was sitting in both the
system32 and the servicepack/i386 folders.

--
Jeff Shultz

--- BBBS/NT v4.01 Flag-5