SPOOLSV.EXE connects to 74.54.130.66

[barbal]

Hi all,

My firewall (ZoneAlarm) detects that the process spoolsv.exe tries to communicate with the ip 74.54.130.66. If I look the domain name of this ip is a944sm.avast.com. Could you please confirm me that it is right that spoolsv.exe tries to contact with this server?

Thanks in advance

Lluís

[iRonzel]

Are not supposed to connect with the avast server.

This is a Printer Spooler Service. Information about spoolsv.exe

http://www.neuber.com/taskmanager/process/spoolsv.exe.html

 But in some case, it can be a malware. I recommend to find the application and upload to virustotal and put the results here. Is the letter "s" is uppercase, it is a malware.  

Check this:

http://www.symantec.com/security_response/writeup.jsp?docid=2003-112315-1255-99&tabid=2

[SafeSurf]

Hi Lluís,

According to WhoIs: http://tools.whois.net/whoisbyip/, enter the IP and you will find out more information about this.

Have you run any Avast scans since this incident?  If not, make sure your definitions are up to date and run a Full, and Boot-time (if you have a 32-bit) scan.

Then check your computer for malware with Malwarebytes’ Anti-Malware (MBAM).
·    Download free http://www.malwarebytes.org/ for an on-demand scanner.
·    Double Click mbam-setup.exe to install the application.
·    After install, click update so you have latest database before scanning.
·    Under Settings:
o    General: Automatically Save File After Scan Completes is checked off
o    Scanner Settings:  Check all boxes
o    Updater: Download and install update if available is checked off
·    Once the program has loaded, select "Perform FULL Scan", then click Scan.
·    The scan may take some time to finish, so please be patient.
·    When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
·    Click the “remove selected” button to quarantine anything found.  You will find the infection details under the Quarantine tab.
·    The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
·    Copy & Paste the entire report in your next reply.

Please let me know if you have any questions.  Thank you.