Re: Spooler subsystem app accessing DNS
From: Ellie (ACEHMP_at_aol.com)
Date: 05/30/03
- Next message: ryan: "Why Does't Windows Security Auditing include the IP?"
- Previous message: Terry Bailey: "Unauthorized to change password"
- In reply to: Boogie Woogie Flu: "Spooler subsystem app accessing DNS"
- Next in thread: Boogie Woogie Flu: "Re: Spooler subsystem app accessing DNS"
- Reply: Boogie Woogie Flu: "Re: Spooler subsystem app accessing DNS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 30 May 2003 09:34:47 -0700
"Boogie Woogie Flu" <spam@email.sux> wrote in message news:<%bSua.2630$Ws4.2165@nwrddc01.gnilink.net>...
> I'm running Windows 2000 Service Pack 3 on my home PC which is running
> ZoneAlarm Pro. ZoneAlarm controls both incoming and outgoing access. For
> some unknown reason, I keep getting ZoneAlarm alerts telling me that the
> Spooler subsystem app (spoolsv.exe) is attempting to access my ISP's DNS
> server. It only seems to happen whenever I launch Adobe Photoshop or
> Microsoft Photo Editor. Any ideas why Photoshop or Microsoft Photo Editor
> would need access to DNS? Thanks.
My guess is that ZA is simply alerting you to "conversation" occurring
between your computer's software and your net bios -- your basic I/O
system -- in other words internal communication. The programs are
looking for YOUR computer's DNS name (not your ISP's DNS). (In
addition to your [unique per session] IP, your computer has its own
[unique per session] DNS, and that's it's job -- coverts all your
"connection" decimal names to "short" names for speed.)
You obviously have some software coded to call up a spooler -- and it
is required to "get" your computer's short name squared away in
anticipation of a print command.
I'm no expert, but I use ZA and my computer is always talking to
itself. If you've any doubt -- check out the source DNS port and
destination info on the "technical" and "details" help screens ZA
offers for each alert. Check the source/destination sources against
your computer's current DNS (as listed in ipconfig and other places),
you'll probably see it starts and ends on your own desktop. (The
reason you're not "seeing" it connect or "do anything" is that all
it's doing is collecting your computer's short name. For instance, my
computer's "short" name is my first name.)
- Next message: ryan: "Why Does't Windows Security Auditing include the IP?"
- Previous message: Terry Bailey: "Unauthorized to change password"
- In reply to: Boogie Woogie Flu: "Spooler subsystem app accessing DNS"
- Next in thread: Boogie Woogie Flu: "Re: Spooler subsystem app accessing DNS"
- Reply: Boogie Woogie Flu: "Re: Spooler subsystem app accessing DNS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
