RE: spoolsv.exe
From: Curtis Koenig [MSFT] (curtisko_at_online.microsoft.com)
Date: 02/21/05
- Next message: Curtis Koenig [MSFT]: "RE: help to reenable program that I accidentally blocked"
- Previous message: Cudedog: "Problems after configuring custom Security Templates"
- In reply to: John Barley: "spoolsv.exe"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 21 Feb 2005 22:03:41 GMT
Hi John,
These are all normal locations for the spoolsv.exe to reside. It is alos
somewhat normal for the spoolsv.exe process to make requests of the
netwrok, especially when network printers are used. The best course of
action is to check the digital signature of the files and use the
PortReporter (available on the MS download site) to monitor your traffic
patterns from this computer to get a better idea of if the behavior is
truely normal.
-- Curtis Koenig Security Support Engineer Product Support Services, Security Team MCSE, MCSES, CISSP This posting is provided "AS IS" with no warranties and confers no rights. Please reply to the newsgroup so that others may benefit. Thanks! -------------------- >From: "=?Utf-8?B?Sm9obiBCYXJsZXk=?=" <John Barley@discussions.microsoft.com> >Subject: spoolsv.exe >Date: Sun, 20 Feb 2005 19:21:03 -0800 > >Hi, > >I know that some trojans present themselves as "spoolsv.exe." My firewall >very frequently asks if I want "spoolsv.exe" to access the internet. If this >is used to spool things out to the printer, is it supposed to access the >internet? > >I have four instances of this file; I'd like to know what I should have >under SP2. Here are my files which I discovered: > >C:\\windows\$ntservicePacUninstall$ >C:\\windows\prefetch\spoolsv.exe-282f76a >C:\\windows\system32 >C:windows\ServicePackFiles\i386 > >Is this normal? My AV does not find these files problematic... > >Thanks >
- Next message: Curtis Koenig [MSFT]: "RE: help to reenable program that I accidentally blocked"
- Previous message: Cudedog: "Problems after configuring custom Security Templates"
- In reply to: John Barley: "spoolsv.exe"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
