Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Spoolsv.exe


  • Please log in to reply
4 replies to this topic

#1 Daboa

Daboa

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:57 AM

Posted 19 July 2008 - 10:53 AM

I found this process running and I don't know what it is. After looking on the internet, spoolsv.exe seems to be either malicious or a trouble-making printer-related process. I don't have a printer or scanner or anything like that. Should I remove this and how? Do I just find it and delete it or what?

P.S. I just found TkBellexe on my startup list and bleepingcomputer says it's dangerous http://www.bleepingcomputer.com/startups/T...xe...-6668.html .
Other sites say it comes with RealOne Player. I don't really use Real Player, so do I disable this or do I remove it. (again, I don't know the proper way to remove dangerous files).

Edited by Daboa, 19 July 2008 - 11:10 AM.


BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,912 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:57 AM

Posted 22 July 2008 - 06:02 PM

Hello Daboa,

One of the important considerations in determining whether a file is good or bad is the specific location. Can you please provide the complete file path for the file in question? Also, please doublecheck the spelling. A single letter difference can mean the difference between a good file and a malicious file.

What is your operating system: Windows XP, Vista, etc.?

What security programs do you have installed? Please name them.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 Daboa

Daboa
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:57 AM

Posted 23 July 2008 - 12:48 PM

spoolsv.exe is in C:\Windows\System32 and is 123 KB. I am certain of the file name. I run Vista and I have Avast antivirus, Spybot Search & Destroy, and Windows Defender.

#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,912 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:57 AM

Posted 23 July 2008 - 09:38 PM

Hello Daboa,

Your file spoolsv.exe is in the appropriate folder and appears to be legitimate. It is part of the Service Pack 2 files for Windows XP. You can read more about it here: http://www.bleepingcomputer.com/filedb/spoolsv.exe-2726.html Searching a number of topics in the Microsoft forums about Vista and spoolsv.exe and reading between the lines, it appears that the file is legitimate for Vista systems as well.

I just found TkBellexe on my startup list


Once again, a complete file path is necessary. Also double-check spelling and punctuation. For example, should there be a . between Bell and exe?

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#5 Daboa

Daboa
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:57 AM

Posted 24 July 2008 - 04:40 AM

Ok thanks. That's good to know. As for TkBellExe, I can no longer find it under startup in msconfig or services.msc or anything like that. The only place I see it is in SpyBot's startup list, where it's unchecked and it's file path is C:\ProgramFiles\CommonFiles\Real\Update_OB\realsched.exe . So it looks like an updater from RealPlayer or something like that. So I'm not longer worried, unless you give me reason to be. Thanks for your help.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users