Results 1 to 8 of 8

Thread: why does spoolsv.exe try to go to Zonealarm site?

  1. #1
    wibi Guest

    Default why does spoolsv.exe try to go to Zonealarm site?

    Hi. Using the free Zonealarm. Every day, spoolsv.exe tries many times to go to a zonealarm site. (I can't find the actual address now, but I believe it starts with h2s or something like that). Why would it do this?
    I am blocking it, but I don't have a network printer, don't print or fax anything to the outside, and there should be no reason for spoolsv to even try to access the internet, but it does every day. Can anybody tell me why?
    thanks

    Operating System:Windows 2000 Pro
    Software Version:
    Product Name:ZoneAlarm (Free)

  2. #2
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: why does spoolsv.exe try to go to Zonealarm site?

    Remove the Internet Access and Internet Server for the spoolsv.exe in the ZA Program listing.
    Set the ZA updater to manual?

    Which version (release) are you using?

    Oldsod.
    Best regards.
    oldsod

  3. #3
    wibi Guest

    Default Re: why does spoolsv.exe try to go to Zonealarm site?

    Hi.Version 7.0.470.000"Remove access and server": already done"set update to manual": already doneYet it keeps trying to connect to this site (it's done it again, so now I have the exact site):208.185.174.66:53

    hs2.zonelabs.com
    It's now tried to connect to
    this site 18 times since I booted up again. Usually the count is 18 at once, for some reason.Does spoolsv.exe have something to do with automatic updating?Or is something collecting information and trying to send it to this site?
    thanks


  4. #4
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: why does spoolsv.exe try to go to Zonealarm site?

    spoolsv.exe is just for the printer in windows and has nothing to do with the ZA updating or it's update site.

    hs2.zonelabs.com is an update server for the ZA client. Normally one of the ZA components will connect to get the latest updates for it's client.

    Just block the site in the Zones. Try turning off the Smart Defense Advisor.

    Oldsod.
    Best regards.
    oldsod

  5. #5
    wibi Guest

    Default Re: why does spoolsv.exe try to go to Zonealarm site?

    Hi again,
    "spoolsv.exe is just for the printer in windows and has nothing to do with the ZA updating or it's update site": that's what I thought, which is why this is confusing.
    I understand that spoolsv can also be abused for collecting and sending information, which is why I am concerned about this.

    "hs2.zonelabs.com is an update server for the ZA client. Normally one of the ZA components will connect to get the latest updates for it's client": OK, well at least I know the site is safe. However, why would
    Zonealarm or something else
    be using spoolsv to go there?
    This seems strange, especially when I have already set updates to manual.
    "Just block the site in the Zones": I think you mean block the program (that's all that can be done on the free version)? In that case, I did that already, so I know it can't go there. It's just disconcerting that it keeps trying to go there anyway, for some unknown reason.
    "Try turning off the Smart Defense Advisor." Can't find one in the free version.
    Now, if somebody from Zonelabs can tell us why this is happening, it would help. Right now, I know how to stop it from going there, but I still don't know why it is happening.
    Thanks

  6. #6
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: why does spoolsv.exe try to go to Zonealarm site?

    I really cannot explain why the spoolsv.exe is getting hijacked by the ZA.
    I have seen this in the forum once or twice before concerning this.

    I have also seen other security applications including antiviruses hijack the spoolsv as well (mcafeee, nod32, etc).
    Again it is safe programs and going to their own sites.
    I think either the windows or the software has made a mistake somewhere. I really have no answer other than that it usually happens for updating and has no printer-related activity. Again not just the ZA, but other applications get into the picture.
    Usually an upgrade will seem to solve the problem for the software involved with the spoolsv hijacking.
    Again I do not know why this fixes the issue. Or why the ZA and other legitimate software will try to hijack the spoolsv.

    Browsers have been known to hijack the spoolsv too. Google maps or some online printer as seen by the browser with seize the spoolsv from time to time. Again if not printing on a web printer or using the web items to be printed, then deny the spoolsv action.
    Other programs will hijack it from time to time. But it is alwasy printer related.

    As for an answer from checkpoint, there are none here to be found at this forum.
    It is just a ZA users forum and there is no official representation or official support.

    Common servers used for the ZA are:[*]cm2.zonelabs.com assists in the functioning of various services including the AlertAdvisor, antivirus updates, and
    antivirus monitoring. [*]hs2.zonelabs.com helps your client keep its services up to date. [*]ls2.zonelabs.com manages information relating to program configuration. [*]pa2.zonelabs.com manages the Program Advisor functionality. [*]ps2.zonelabs.com helps with updates to services and client functionality. [*]update.zonelabs.com supports the "Check for Update" functionality. [*]egister.zonelabs.com handles product registration.


    The best advice I can give is either uninstall the ZA and move to another freeware software (there are many to select) or try an upgrade and see if the problem persists.

    Best regards.
    Oldsod.
    Best regards.
    oldsod

  7. #7
    wibi Guest

    Default Re: why does spoolsv.exe try to go to Zonealarm site?

    Hi again.
    I guess I'll just leave it the way it is, and keep using the free version. At least with the free version, I know that I can stop it from going there, even though I don't know why it's going there.
    As for upgrades, well, that's a big racket, isn't it. Make something that is broken, sell it as it is, and then get people to pay more money in the hope that it might get better next time. (Even if it does, it will be broken somewhere else :8})(Not particularly about Zonealarm, which I am grateful to have for free, but about the software world in general).
    Anyway, thanks very much for the feedback on this

  8. #8
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: why does spoolsv.exe try to go to Zonealarm site?



    Upgrading ....in some sense that is true.
    Often the new upgrade offers new features or fixes in the application to remove vulnerabilities, but very often the new upgrade only edits some files and nothing else.

    Far too often users rely 100% on the security and never on themsleves. They are like children relying on their milk for their diet. Security of a PC is not just the security appllications but also the user's safe hex. Probably something like 50 % security application and 50 % user's safe practises make up the total security of the computer. The very best security will still not protect a user if they are steadily trying to infect the computer or disallow the security warnings and methods.

    As far as firewalls go, the basics of the internet has not changed in years. The same reliable packet filtering application from years ago will still do the same security job for todays internet. What has changed in the past sevearl years with firewall is the new addition of malware scanners and complex windows/application control/security.

    Oldsod.
    Best regards.
    oldsod

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •