SysChat

SysChat (http://www.syschat.com/forum.php)
-   Computer Security (http://www.syschat.com/software-support/computer-security/)
-   -   spoolsv.exe trying to access internet (http://www.syschat.com/spoolsv-exe-trying-to-access-internet-6924.html)

RalphyG 08-31-2011 09:37 AM

spoolsv.exe trying to access internet
 
Hello All
Could someone tell me why "spoolsv.exe"
would need to access the internet.
This is the information AVG is giving me:
Application: Spooler SubSystem
Full Path: C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
Company: Microsoft Corporation
Local Address: Local computer : 49155
Remote address: 10.0.0.65 : 58902
Connection: TCP
Direction: Incoming
Process ID: 1228

Any help will be appreciated

DominicD 09-03-2011 01:49 PM

hello,

spoolsv.exe is supposed to be the program that handles the printer spooling. in some firewall discussions like zonealarm, they have also encountered this scenario. the common suggestion is that spoolsv.exe checks to see / thinks it may be a network printer so it attempts to check the network.

on suggestion is to turn of windows file and printer sharing. you normally dont have to change this setting as it provides more convenience for home networking and printing.

however, in our office, we specifically choose to turn this option off. the reason for this is to prevent our employees from freely sharing files and folders on the office network. we turn off the windows file and printer sharing mainly for tighter security measures.


http://i53.tinypic.com/2wqdeuu.jpg
The Windows File and Printer Sharing setting is specific to each network adapter. If you wish to turn this off, you have to set each of your wireless and wired network adapters and uncheck this option.

======================

one more thing you can investigate upon, is to double check that it is the genuine and not spyware spoolsv.exe.

update your antivirus program, and manually locate and scan spoolsv.exe.
http://i53.tinypic.com/51q3ix.jpg

you may want to use Virus Total Online Scanner http://www.virustotal.com
its a good online scanner that will upload your suspected file and test it against many other antivirus programs and report the diagnosis of each

this is a sample of me scanning the spoolsv.exe

http://i55.tinypic.com/5214ww.jpg

Virustotal says that i have an exact same copy of spoolsv.exe that has been first uploaded and checked on their database since 2009 September.. Virustotal assures me that the file has not been altered or changed and is not a clone spyware.

http://i52.tinypic.com/ws4vht.jpg

RalphyG 09-03-2011 03:33 PM

Thank You for the reply I was really stumpedon
this one. As always you come through.

Thanks again

RalpG:)


All times are GMT -4. The time now is 05:25 AM.


Copyright © 2005-2013 SysChat.com


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54