CPU at 100% during the night, spool service is causing it.

[tomviv]

I have a very strange situation where the CPU on our print server runs at 100% for most of the night. During the day it backs down to normal levels. It started when we installed new printers. It is the spooler service that is causing it, at least according to the logs. I have removed all old drivers and installed the latest ones for the new printers. I have started a scheduled job to kill the process and restart it again each night. This temporarily brings the CPU back again but with in 1/2 to 1 hr it's back up again. Nothing shows up on AV software scans although it does feel like some malware is at work but I cannot track it down.

Any advice/pointers would very welcome.

Thanks in advance, Tom.

[dapaulio]

Any third party apps?

 

Eg papercut is a common one on print server which can do some processing out of hour. Database backup etc

[tomviv]

Any third party apps?

 

Eg papercut is a common one on print server which can do some processing out of hour. Database backup etc

 

Papercut is not installed and the server backup schedule does not correspond with the times the cpu spikes.

Thx.

[free780]

I have a very strange situation where the CPU on our print server runs at 100% for most of the night. During the day it backs down to normal levels. It started when we installed new printers. It is the spooler service that is causing it, at least according to the logs. I have removed all old drivers and installed the latest ones for the new printers. I have started a scheduled job to kill the process and restart it again each night. This temporarily brings the CPU back again but with in 1/2 to 1 hr it's back up again. Nothing shows up on AV software scans although it does feel like some malware is at work but I cannot track it down.

Any advice/pointers would very welcome.

Thanks in advance, Tom.

 

Run process explorer and check running processes against virus total. Check any scheduled tasks. Check for any new local admins and/or services. You could leave procmon running over night to see what the spooler service is doing overnight.