spoolsv.exe Accessing the Internet

During startup, ZoneAlarm tells me that spoolsv.exe is trying to access the
Internet. After researching this, I understand that spoolsv.exe in the
C:\WINDOWS\system32 folder is acceptable, but a virus also uses this file
name and puts the file in other folders. I have spoolsv.exe in three other
locations:
(1) C:\WINDOWS\ServicePackFiles\i386
(2)C:\WINDOWS\SoftwareDistribution\Download\0fd33c 77398fa2b50df56456525ef5c3\sp2gdr
(3)C:\WINDOWS\SoftwareDistribution\Download\0fd33c 77398fa2b50df56456525ef5c3\sp2qfe

Two questions:
(1) are the other three locations valid or should I be concerned about a virus
(2) why is spoolsv.exe trying to access the Internet on startup?

Thank you for your assistance.

Sid wrote:

During startup, ZoneAlarm tells me that spoolsv.exe is trying to access the
Internet. After researching this, I understand that spoolsv.exe in the
C:\WINDOWS\system32 folder is acceptable, but a virus also uses this file
name and puts the file in other folders. I have spoolsv.exe in three other
locations:
(1) C:\WINDOWS\ServicePackFiles\i386
(2)C:\WINDOWS\SoftwareDistribution\Download\0fd33c 77398fa2b50df56456525ef5c3\sp2gdr
(3)C:\WINDOWS\SoftwareDistribution\Download\0fd33c 77398fa2b50df56456525ef5c3\sp2qfe

Two questions:
(1) are the other three locations valid or should I be concerned about a virus
(2) why is spoolsv.exe trying to access the Internet on startup?

Thank you for your assistance.

The other locations seem fine. Note: you can delete the contents of the
C:\Windows\SoftwareDistribution\Download folder after the updates have
been installed. Can't answer your second question.

--
Rock
MS MVP Windows - Shell/User

"Rock" wrote in message
...
Sid wrote:

During startup, ZoneAlarm tells me that spoolsv.exe is trying to access
the Internet. After researching this, I understand that spoolsv.exe in
the C:\WINDOWS\system32 folder is acceptable, but a virus also uses this
file name and puts the file in other folders. I have spoolsv.exe in
three other locations:
(1) C:\WINDOWS\ServicePackFiles\i386
(2)C:\WINDOWS\SoftwareDistribution\Download\0fd33c 77398fa2b50df56456525ef5c3\sp2gdr
(3)C:\WINDOWS\SoftwareDistribution\Download\0fd33c 77398fa2b50df56456525ef5c3\sp2qfe

Two questions:
(1) are the other three locations valid or should I be concerned about a
virus
(2) why is spoolsv.exe trying to access the Internet on startup?

Thank you for your assistance.

The other locations seem fine. Note: you can delete the contents of the
C:\Windows\SoftwareDistribution\Download folder after the updates have
been installed. Can't answer your second question.

--
Rock
MS MVP Windows - Shell/User

As you have found out spoolsv.exe "can" be a virus, if you are 100%
sure this is not the case do you have something like Epson's print
to web installed ?, either way if it concerns you it is safe to block
web access for it.

rgds
Roberto