Spoolsv.exe virus?

[NeilMazza]

Hi,

My spoolsv.exe is trying to send out data to umpteen i.p addresses on the net. Luckly zonealrm is blocking it, could this be a virus? How can get rid of it?

Mazza

 

[Grenage]

well Bugbear was noted to send out rubbish to printers, but I don't know the workings of it I'm afraid.

Regardless, forum760 would be a good forum to try for anything Virus related.

 

[Gphys]

I just loaded zonealarm and it too is blocking dozens of attempts by spoolsv.exe to get server status. Did you ever find out what is going on ??

 

[SgtB]

Another spoolsv.exe thread.....
Will this one have 50 repies to it too????
j/k
No hostility from me I just had to say something....
________________________________________
Check out

http://www.security-forums.com

 

[SgtB]

Oh I feel bad now for not helping....

Make sure windows is up to date, and make sure you've done a full virus scan using latest defs. Stop your spooler service prior to the scan as well.

As an experiment, do the packets continue if the spooler is stopped?

I'm with Grenage though, my first thoughts point to bugbear. ________________________________________
Check out

http://www.security-forums.com

 

[KiwiOne]

Hi,

I just rebooted - I do not do this often but when I did ZA informed me that it had an update available so I got it and had to reboot again after installing it. I accepted my current settings for it as I was happy with them but checked them anyway.

SpoolerVE.EXE then asked for premission to send stuff so I denied it then searched for it on Google - that is how I found this forum and I have read lots about concerns about why this prog is sending data but so far nothing that says how to determine if it is a virus or not. I did do a security update to Windows yesterday and not ZA today.

I have denied it access and things are still working. I do not run a network (well, nothing is connected to the network) and printer and sharing is disabled.

AVG has picked up nothing. The reason I rebooted was cos my system got VERY SLOW.

It has only made two attempts to send data that ZA has stopped.

Can someone come up with an answer to this spoolersv.exe issue?

 

[dakpoole]

I found tek-tips trying to solve the same ZoneAlarm alert situation. I have completely reloaded and updated Win 2000 Pro, setup a new small Netgear network with ADSL access (including a print server and 2 printers), run Norton anti-virus (up to date) and have added Zonealarm Pro. In the first few hours running, ZA has blocked 6 attempts by spoolsv.exe to access an IP identified as my ISP (PIPEX). Printing seems to work ok. I still have to completely reload, set up and connect the other 2 PCs that will be on my network (Windows ME and HP), and will be interested to see if they experience the same problem.
Any answers will be welcome.