PDA

View Full Version : spoolsv.exe accessing internet?


MDA
19-01-2004, 19:56:28
My firewall blocks spoolsv.exe from accessing the net.

It shouldn't need the net, and I know it could indicate one of the many "graybird" trojans out there, but I don't pick up anything with a virus scan, nor do I open odd links or attachments in my email.

So does spoolsv.exe have any reason to access the internet under normal circumstances?

google was only of limited use. I now know there are spoolsv trojans loose out there, and I know I can't find any of those on my system.

Its been attempting this for ages without any problems, I just keep blocking it, but I was curious.

Sir Penguin
19-01-2004, 21:26:18
I think it's fine. It's probably just trying to send everything you've printed to Microsoft.

SP

TV4Fun
20-01-2004, 05:53:32
There's a very nasty trojan out there called Windows.

MDA
20-01-2004, 19:56:11
I think I have that one.

SP, :lol:, but seriously, Windows could be sending *something* to Microsoft, no surprise, but using spoosv.exe?

zmama
20-01-2004, 20:08:22
Yeah, but it could also be an HP printer trying to use TCP/IP...some try, especially if print and file sharing is turned on.
Or a trojan or a windows "feature" or, or

Sir Penguin
20-01-2004, 20:39:42
They could use spoolsv, MDA, but they probably wouldn't. There are paranoid people out there who would check what spoolsv was sending out, and MS probably wouldn't risk the bad publicity if it got out. It would be sneaky and underhanded to do that, and poor software engineering, and they could get more respect and legitimacy by using a separate program to spy on their customers.

SP

MDA
20-01-2004, 21:43:17
Hmm. File sharing was enabled on my work connections. I don't even have network access on this computer, just internet, so it was pointless to have it on. File sharing isn't permitted over the work net anyhow. We have separate User and Temp (public) network drives for that.

That damn setting should be off by default. :mad: at myself.