[Raistlin]

Originally Posted by Mike

services.exe

Windows NT4/2000/XP/2003 only. This is the Services Control Manager which is responsible for starting, stopping, and interacting with system services. Itâ₠¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s full path is either C:\WINNT\System32\Services.exe in Windows NT4/2000, or C:\Windows\System32\Services.exe in Windows XP/2003.
Recommendation :
An integral part of the operating system, leave alone.

If this appears in any other path on your machine it is likely that you have a virus, do a search of your machine for the filename and see where it is lurking - post back here when you've done that for some more advice.

Originally Posted by Mike

spoolsv.exe

Windows 2000/XP/2003 only. This is the Spooler service which manages spooled fax and print jobs.

Recommendation :
An integral part of the operating system, leave alone.

ZA is probably picking this up as it is trying to print through the localhost part of the network. Have a look at the IP address it is trying to connect to - it's probably something like 127.0.0.0

Originally Posted by Mike

wcescomm.exe

Microsoft ActiveSync Connection Manager. ActiveSync is Microsoftâ₠¬â„¢s free Synchronization manager which enables you to synchronize your Windows CE based handheld/palm-size PC with your desktop PC. You can synchronize documents but also e-mail and calendaring items. WCESCOMM starts whenever the PC boots up and runs in the background in the System Tray until it detects that a Pocket PC has been connected to your PC, at which points it shows up to begin the synchronization process.
Recommendation :
One of the most common problems with ActiveSync is the WCESCOMM process hanging because ActiveSync encountered problems during synchronization. When that happens the user often has no option but to shutdown and restart his PC before ActiveSync will again recognize his Pocket PC. Another issue is WCESCOMM interfering with your connection to a network, or preventing the user from using some of his serial or USB ports with other software. Finally, when not in use, WCESCOMM can often still consume up to 10% of CPU processing time !

Looks ok, provided you're running a device as described above.

Post back once you've done a bit more digging and we'll take another look. Provided the path for the first one is correct you can probably allow it, provided the second one isn't trying to connect to anywhere strange it should be ok to allow, and providing that you have a device as described in the third one it should be safe.

All definitions from: http://www.answersthatwork.com/Taskl...s/tasklist.htm

__________________

Originally Posted by maxtoralias

services.exe is a part of the Microsoft Windows Operating System and manages the operation of starting and stopping services. <Snip>

Need to check the path that it is running from though.

Originally Posted by maxtoralias

Note: spoolsv.exe is also a process which is registered as the Backdoor.Ciadoor.B Trojan. This Trojan allows attackers to access your computer, stealing passwords and personal data.

Wasn't aware of that one, nice one. I presume that if this is the legitimate version of the file it will be running from Windows\System ?

Originally Posted by maxtoralias

Wcescomm.exe

Snap

Nice post