soma

Does anyone know how to check if this process is a dangerous or not? My Zonealarm notified me of its attempt to access the internet and I denied it. This was particularly strange because I have no printer and fax and the spool.exe is supposed to be used for printers and fax machines. I've been Googling around and have found that this process can be a cover for a virus or trojan. How can I know for absolute sure whether or not this is a threat to my security?

Thanks and have a nice weekend TFPers

phukraut

Absolutely? Get a packet sniffer, and let it connect out. Then you can see exactly what it is sending and to where.

soma

Packet sniffer, eh? Do you have any recommendations?

Everytime

Ethereal


although if you dont know much about packet sniffing, its pretty pointless. It will be all giberish Hex do you anyway.

soma

Are there perhaps other ways to check this thing then?

n0nsensical

You can try getting the full path of the executable and verifying that it is the one distributed with Windows. Not sure if there's a way to get the full path with something you would have installed, but I wrote a program that will find it if you want to use it. Then to verify the file, I suppose you could check the last modified date and size and compare them with a known good version. (Not exactly the most reliable way to check file integrity but I think it will suffice)

__________________
"Prohibition will work great injury to the cause of temperance. It is a species of intemperance within itself, for it goes beyond the bounds of reason in that it attempts to control a man's appetite by legislation, and makes a crime out of things that are not crimes. A Prohibition law strikes a blow at the very principles upon which our government was founded." --Abraham Lincoln

SiN

he could install Process Explorer.
Great little freeware app that is loads better than taskman.

__________________

MontanaXVI

Sin thanks for that link, I really like that a lot and will be using it regularly from here on out.

__________________
Spank you very much

arch13

Kill the proccess and see if it restarts.
SpoolsV.exe is used by the system regardless of if there is a printer or not. The reasons are many, but among them are virtual printing. For example, doi you have acrobat installed? Then you needs this process running as it is used to turn your word file into a PDF. SpoolsV also monitors the parralell and usb ports constantly for a printer that has been connected.
Windows will restart the proccess, I don't know if a trojan would.
Windows often has 3-5 spollsV's running at once, and they are a needed program.
http://www.liutilities.com/products/...brary/spoolsv/

Also, run HiJack this and see where SpoolsV.exe is being called from. That is the only way to see if the proccess is windows based or a trojan.
(But for the love of god be carefull running it as you can delete some important files!)

__________________
Seen on an employer evaluation:

"The wheel is turning but the hamsters dead"
____________________________
Is arch13 really a porn diety ? find out after the film at 11.
-Nanofever

soma

Sin, thanks for the link. I'm liking this program a lot.

arch13, how to I find out where spoolsv.exe is being called from using HiJack this?

Thanks a lot