firewall

I am rinning windows2000 and I have a net defense firewall installed. I also
run Bellsouth messenger. Recently I installed a lexmark/usb/printer/scanner.
When I give permission for the firewall to allow the spoolsv.exe to have
access, it disables my messenger. This also disables my firewall to the point
that I have to reinstall. can I block this exe. file from having access and
also what is the purpose of this file?I would appreciate any posssible
solution.

siljaline
Fri Nov 11 00:40:16 CST 2005

"Roger11" wrote:
>I am rinning windows2000 and I have a net defense firewall installed. I also
> run Bellsouth messenger. Recently I installed a lexmark/usb/printer/scanner.
> When I give permission for the firewall to allow the spoolsv.exe to have
> access, it disables my messenger. This also disables my firewall to the point
> that I have to reinstall. can I block this exe. file from having access and
> also what is the purpose of this file?I would appreciate any posssible
> solution.

While I'm concerned as to what the differences are between Bell's Messenger
and MSN Messenger, we'll leave that be for the moment.
The executable file for your printer - scanner, *should* be a legit file.
Your saying that your firewall is being asked by the file to access the Internet.
That should definitely not be happening or be allowed to happen.

Please browse this URL to see what this file can be modified by a virus, Spyware
etc - in the context that it will, hijacked, invade your PC and cause such a
problem.
http://castlecops.com/modules.php?name=StartupList&query=spoolsv

A fix and "canned" reply follows:
<paste>
Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/security)
(http://castlecops.com/forum67.html)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)
(http://forum.iamnotageek.com/f-130.html)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard/index.php?showforum=18)
</paste>

Please post back, to this thread, the URL where you posted your
HijackThis log for us to follow-up.

Good luck.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

Roger
Sat Nov 12 10:03:23 CST 2005

Well, I have a totally different response on part of this.

x:\WINDOWS\system32\spoolsv.exe
is the Print Spooler service.

If you do not use the local printer as an available resource
for other machines on your network, then there is no need
for your allowing this in the firewall. It is just trying to listen
so that the print part of "file and printer sharing" can happen.


"Roger11" <Roger11@discussions.microsoft.com> wrote in message
news:F9EEA895-0D09-454D-8AE3-65696E902506@microsoft.com...
>I am rinning windows2000 and I have a net defense firewall installed. I
>also
> run Bellsouth messenger. Recently I installed a
> lexmark/usb/printer/scanner.
> When I give permission for the firewall to allow the spoolsv.exe to have
> access, it disables my messenger. This also disables my firewall to the
> point
> that I have to reinstall. can I block this exe. file from having access
> and
> also what is the purpose of this file?I would appreciate any posssible
> solution.

charlie
Sun Nov 13 22:22:07 CST 2005


"Roger11" <Roger11@discussions.microsoft.com> wrote in message
news:F9EEA895-0D09-454D-8AE3-65696E902506@microsoft.com...
> I am rinning windows2000 and I have a net defense firewall
installed. I also
> run Bellsouth messenger. Recently I installed a
lexmark/usb/printer/scanner.
> When I give permission for the firewall to allow the spoolsv.exe to
have
> access, it disables my messenger. This also disables my firewall to
the point
> that I have to reinstall. can I block this exe. file from having
access and
> also what is the purpose of this file?I would appreciate any
posssible
> solution.

I have a Lexmark Z25 that has several files that ask permission to
access the internet every time I use the printer. I blocked them in
my ZoneAlarmPro Firewall, and put a stop to that. If I knew how to
disable File and Printer Sharing, I certainly would. Can't find a
setting for it in the interface. Spoolsv.exe still asks once in a
while. Persistent. I took it off the startup menu in Msconfig so it
wouldn't try all day long. Good printer otherwise.

charlie R

Frank
Mon Nov 14 06:30:32 CST 2005

"charlie R" <welpctSKIPME@psci.net> wrote in message
news:ObbbQHN6FHA.1148@tk2msftngp13.phx.gbl

> If I knew how to
> disable File and Printer Sharing, I certainly would. Can't find a
> setting for it in the interface. .
>
> charlie R

Windows version?

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

charlie
Mon Nov 14 11:45:21 CST 2005


"Frank Saunders, MS-MVP OE" <franksaunders@mvps.org> wrote in message
news:u0lu3cR6FHA.2524@TK2MSFTNGP10.phx.gbl...
> "charlie R" <welpctSKIPME@psci.net> wrote in message
> news:ObbbQHN6FHA.1148@tk2msftngp13.phx.gbl
>
> > If I knew how to
> > disable File and Printer Sharing, I certainly would. Can't find a
> > setting for it in the interface. .
> >
> > charlie R
>
> Windows version?
>
> --
> Frank Saunders, MS-MVP OE
> Please respond in Newsgroup. Do not send email
> http://www.fjsmjs.com
> Protect your PC
> http://www.microsoft.com/security/protect/

Sorry I didn't phrase that correctly. I was referring to File and
Printer sharing in the Lexmark Interface. Since my computer is not
on a network, the printer doesn't need to access the network. File
and Printer sharing is disabled in Win98. Thanks.

charlie R
>
>
>