spoolss.exe causing a lot of network traffic?!

[Lancelot]

This morning when I checked my email I noticed zone-alarm's tray icon showing there's constant network activity going on. So I look in task-manager and find that spoolss.exe is taking upto 22% CPU and over 130MB of RAM so I ended this task and the network traffic was gone. I did a websearch and find that spoolss.exe handles printing tasks but I haven't printed anything for days! Unfortunatly it can also be misused for DOS-attacks and spy/adware activity. I have NAV2004pro and use various anti-adware/spyware scanners regularly so WTF is going on?!

[redduc900]

Which OS are you running (including SP version), and what make/model printer do you have installed (including driver version)?

[theMonster]

I've seen this before, it's spyware spoofing itself as the spoolss.exe file. Your best bet is to delete it and reinstall the right one off of your Windows CD.

[Lancelot]

I think 'monster' could be right cuz whenever I reboot it happens again straight away. I'll copy spoolss.exe from one of my other rigs and see what happens...

[theMonster]

You'll most likely need to remove some registry entries too.

[Lancelot]

yeah but which ones? for now I stopped it's activity by denying spoolss.exe any internet(work) access in zonealarm...