spoolsv.exe
 

Does anyone know how to check if this process is a dangerous or not? My Zonealarm notified me of its attempt to access the internet and I denied it. This was particularly strange because I have no printer and fax and the spool.exe is supposed to be used for printers and fax machines. I've been Googling around and have found that this process can be a cover for a virus or trojan. How can I know for absolute sure whether or not this is a threat to my security?

Thanks and have a nice weekend TFPers :)

Absolutely? Get a packet sniffer, and let it connect out. Then you can see exactly what it is sending and to where.

Packet sniffer, eh? Do you have any recommendations?

Ethereal


although if you dont know much about packet sniffing, its pretty pointless. It will be all giberish Hex do you anyway.

Are there perhaps other ways to check this thing then?

You can try getting the full path of the executable and verifying that it is the one distributed with Windows. Not sure if there's a way to get the full path with something you would have installed, but I wrote a program that will find it if you want to use it. Then to verify the file, I suppose you could check the last modified date and size and compare them with a known good version. (Not exactly the most reliable way to check file integrity but I think it will suffice)

he could install Process Explorer.
Great little freeware app that is loads better than taskman.

:)

Sin thanks for that link, I really like that a lot and will be using it regularly from here on out.

Kill the proccess and see if it restarts.
SpoolsV.exe is used by the system regardless of if there is a printer or not. The reasons are many, but among them are virtual printing. For example, doi you have acrobat installed? Then you needs this process running as it is used to turn your word file into a PDF. SpoolsV also monitors the parralell and usb ports constantly for a printer that has been connected.
Windows will restart the proccess, I don't know if a trojan would.
Windows often has 3-5 spollsV's running at once, and they are a needed program.
http://www.liutilities.com/products/...brary/spoolsv/

Also, run HiJack this and see where SpoolsV.exe is being called from. That is the only way to see if the proccess is windows based or a trojan.
(But for the love of god be carefull running it as you can delete some important files!)

Sin, thanks for the link. I'm liking this program a lot.

arch13, how to I find out where spoolsv.exe is being called from using HiJack this?

Thanks a lot :)