Had a PC at work that recently had been compromised. Someone downloaded various programs after hours. In the process of clean up noticed a process running “spoolsv.exe”. When I would stop process, and reboot it would come back, sometimes more than one entry.
Research showed it was located in C:\Windows folder, not system or system 32.
Virus related? Some sites said it was. Anyone see this?