Placeshifter odd behavior on 2nd connect...

[hemicuda]

I finally got around to testing the parameters of the "failure."

I port forward through putty (SSH) to the server when I'm on the road. The first connection attempt works just fine. So, I close PS and give it a minute or 2 for any s/w to unload from memory. Open it back up and try to connect to the server again and PS goes to 100% CPU. After 2-3min I still have a blank PS window and have to close the app forcibly. The odd thing is that zonealarm picks up a program called "spoolsvc.exe" trying to access the net the 2nd time I try to use PS. I googled it and it appears to be some kind of trojan that hit the wild a few yrs ago. I have 2 AV programs running and neither raises a stink. Today it did the same thing except the file was "spoolsv.exe" which is supposed to be a legit M$ file. Both files show up as Spooler Subsystem in ZA. All subsequent PS connections to the server fail until I restart the service (except for last night I tried twice more and both connected).

I've checked up on removal of the 'trojan' and haven't found evidence in the registry of its tracks nor the common filenames it hides under. I don't understand why the Spooler Subsystem would be called by a PS session.

Any [constructive ] comments or suggestions are welcome and appreciated. I hate it when something that's supposed to be simple stumps me.

[hemicuda]

This is still happening with 6.3.x. spoolsv.exe tries to call out to the DNS server and if I block its access with zonealarm Placeshifter fails to connect to my server. I haven't seen this happen on the LAN, just on the VPN tunnel.

Darn strange that the only time a Printer app tries to call out to the world is when I'm running PS. I'm trying to get a packet log in wireshark, but I may have to reboot to reset the temporary ZA block.

[sainswor99]

Have you tried connecting without the VPN tunnel to see if you can replicate the behavior? Do you have any other client/server apps you can try to see if they create the same behavior?

I have a sneaking suspicion that it's the VPN tunnel, but not sure about that (nor do I have any idea why it could be acting that way).

[hemicuda]

well... tried it on the LAN and got the same behavior... spoolsv tried to hit a google server (216.239.51.91). PS gave the connecting screen then went back to the server list. lots of packets in wireshark though between here and the server. don't remember ever seeing spoolsv in ZA acexpt when trying to connect PS.

[sainswor99]

What's the path for spoolsv.exe? I'm sure you're aware that there is a trojan that masquerades as the print service. Not sure why it would be activating PlaceShifter is running...

Stu