Spoolsv.exe trying to access the internet

"Jim" wrote in news: snipped-for-privacy@individual.net:

Well, let it connect and see what happens if anything. Then you'll know for sure.

You can use the tools in the link like Process Explorer and Active Ports and see if you come up with anything.

The usual complaint with the REAL spoolsv.exe after a crash is that it starts running away with the cpu utilization. It's part of yuor print spooler system.

You should find the real exe in c:\\winnt\\system32. If you find it in c:\\winnt or c:\\windows then you are probably looking at one of the many backdoor.ciadoor trojans, for which Symantec has a nice writeup at:

regards,

mungo

You wrote:

Also, to add to these comments, if this is trying to make a socket connection or is listening for socket connections, you'll see it and it's path using Active Ports.