Zone Alarm Alerts

[Mike]

Hi all

Any ideas on these what these are and waht I should allow / Deny within ZA

services.exe
spoolsv.exe
wcescomm.exe

Thanks

Mike

[maxtoralias]

Hope this helps

services.exe is a part of the Microsoft Windows Operating System and manages the operation of starting and stopping services. This process also deals with the automatic starting of services during the computers boot-up and the stopping of servicse during shut-down. This program is important for the stable and secure running of your computer and should not be terminated.

spoolsv.exe is a Microsoft Windows system executable which handles the printing process to your local printers
Note: spoolsv.exe is also a process which is registered as the Backdoor.Ciadoor.B Trojan. This Trojan allows attackers to access your computer, stealing passwords and personal data.

As a precaution, do not allow this service via zonealarm

Wcescomm.exe is the Windows synchronization manager for Windows CE-based handhelds. It is used to synchronize the content on your handheld with your PC. Stopping this process when your PC is connected to your handheld may cause errors.

[Raistlin]

Originally Posted by Mike

services.exe

Windows NT4/2000/XP/2003 only. This is the Services Control Manager which is responsible for starting, stopping, and interacting with system services. Itâ₠¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s full path is either C:\WINNT\System32\Services.exe in Windows NT4/2000, or C:\Windows\System32\Services.exe in Windows XP/2003.
Recommendation :
An integral part of the operating system, leave alone.

If this appears in any other path on your machine it is likely that you have a virus, do a search of your machine for the filename and see where it is lurking - post back here when you've done that for some more advice.

Originally Posted by Mike

spoolsv.exe

Windows 2000/XP/2003 only. This is the Spooler service which manages spooled fax and print jobs.

Recommendation :
An integral part of the operating system, leave alone.

ZA is probably picking this up as it is trying to print through the localhost part of the network. Have a look at the IP address it is trying to connect to - it's probably something like 127.0.0.0

Originally Posted by Mike

wcescomm.exe

Microsoft ActiveSync Connection Manager. ActiveSync is Microsoftâ₠¬â„¢s free Synchronization manager which enables you to synchronize your Windows CE based handheld/palm-size PC with your desktop PC. You can synchronize documents but also e-mail and calendaring items. WCESCOMM starts whenever the PC boots up and runs in the background in the System Tray until it detects that a Pocket PC has been connected to your PC, at which points it shows up to begin the synchronization process.
Recommendation :
One of the most common problems with ActiveSync is the WCESCOMM process hanging because ActiveSync encountered problems during synchronization. When that happens the user often has no option but to shutdown and restart his PC before ActiveSync will again recognize his Pocket PC. Another issue is WCESCOMM interfering with your connection to a network, or preventing the user from using some of his serial or USB ports with other software. Finally, when not in use, WCESCOMM can often still consume up to 10% of CPU processing time !

Looks ok, provided you're running a device as described above.

Post back once you've done a bit more digging and we'll take another look. Provided the path for the first one is correct you can probably allow it, provided the second one isn't trying to connect to anywhere strange it should be ok to allow, and providing that you have a device as described in the third one it should be safe.

All definitions from: http://www.answersthatwork.com/Taskl...s/tasklist.htm

__________________

Originally Posted by maxtoralias

services.exe is a part of the Microsoft Windows Operating System and manages the operation of starting and stopping services. <Snip>

Need to check the path that it is running from though.

Originally Posted by maxtoralias

Note: spoolsv.exe is also a process which is registered as the Backdoor.Ciadoor.B Trojan. This Trojan allows attackers to access your computer, stealing passwords and personal data.

Wasn't aware of that one, nice one. I presume that if this is the legitimate version of the file it will be running from Windows\System ?

Originally Posted by maxtoralias

Wcescomm.exe

Snap

Nice post

[tabatha]

From a "google" it would appear that the first two are virus/spyware...
The third one appears to be also...but not to clear...too me.
Suggest you " google" and decide...At the moment do not allow any...

Originally Posted by tabatha

From a "google" it would appear that the first two are virus/spyware...
The third one appears to be also...but not to clear...too me.
Suggest you " google" and decide...At the moment do not allow any...

they are legitimate windows system files, which are sometimes substituted by trojans - hence Raistlins excellent advice to check the path they are running from.

fwiw I have both services.exe & spoolsv.exe as 'allowed' in ZA, with no problems.

[Raistlin]

Originally Posted by tabatha

From a "google" it would appear that the first two are virus/spyware...
The third one appears to be also...but not to clear...too me.
Suggest you " google" and decide...At the moment do not allow any...

The problem is that many "nasties" have the same, or at least similar, names as legitimate services/programs.

It's always wise to check the path that the connection/program is runnuing from to ascertain if it is a legitimate source for that service/program. It's also a good idea to do a "Find Files & Folders" search (with the option to show hidden files turned on) for a specific file name, this way you can see if it is living anywhere that it shouldn't

Sound advice though, and worth remembering - If you're not sure say "No", do some research, and then make an informed decision. If anything that should work suddenly stops you might have said no to the wrong thing. Easier to fix something like that than it is to completely rebuild the machine

[maxtoralias]

Originally Posted by Raistlin

Wasn't aware of that one, nice one. I presume that if this is the legitimate version of the file it will be running from Windows\System ?

Good advice Raistlin - al;ways makes sense to check the path to the system folder as appropriate. As an added bonus, Spoolsv.exe can also mask the following viruses

Hacktool.Privshell - Symantec Corporation
VBS.Masscal.Worm (vbs) - Symantec Corporation
Graybird-A @ Sophos

I also run Zonealarm Security suite and block Spoolsve.exe as a precaution

[Raistlin]

Originally Posted by maxtoralias

As an added bonus, Spoolsv.exe can also mask the following viruses

How kind of MicroSnot to give us all those free toys to play with

[Mike]

Had a search

The service.exe came up 3 times all in c\WINNT

ServicePackfiles/i386
System32
SoftwareDistribution/downlaod/103acef429fdt59029b7b8e36fbb968

?????????????????

Mike

[tabatha]

Thanks for the replies..Homealone/Raistlin...
Always wary of trying to give "advice"...

[Raistlin]

Originally Posted by tabatha

Thanks for the replies..Homealone/Raistlin...
Always wary of trying to give "advice"...

Don't worry about it, the key is to temper advice with caution and always add:

"But if it goes wrong don't blame me!"

[Mike]

Originally Posted by Mike

Had a search

The service.exe came up 3 times all in c\WINNT

ServicePackfiles/i386
System32
SoftwareDistribution/downlaod/103acef429fdt59029b7b8e36fbb968

?????????????????

Mike

Still well confused ???

[marky]

if not sure deny it but dont click the allways box

if that stops you with what you want to do then next time click allow
a pattern will emerge
then you can click allways for allow or deny
wish i had a screen shot

[Raistlin]

Originally Posted by Mike

Still well confused ???

Mike,

The three folders you have said that the file appears in all appear to be legitimate Windows folders, and they're all places that you might reasonably expect to find that File:

ServicePackFiles/i386 - This is the folder used to hold the SP2 files prior to installation, it should not be deleted but I would expect to see a copy of the services.exe file in there.

System32 - This folder is the usual place that you would expect to see this file.

SoftwareDistribution/downlaod/103acef429fdt59029b7b8e36fbb968 - This folder also appears to be connected to either the SP2 install or other MS updates. It's highly possible that the services.exe file could have been updated as part of any (or indeed all) of the updates and therefore this is probably a legitimate location for the file to exist in.


Just by looking at the above I would suggest that you are safe to allow this file access to go about its business.

What is the IP address that service.exe is trying to connect to? This may resolve to an ISP/server that you recognise (that of your ISP for example).

I would strongly suggest that you run an up to date virus sweep, and a sweep for spyware/malware, if there are any nasties on your system this should find them - hopefully that will set your mind at ease a little bit more with regards to this program (and the other 2).

If you need anything further please post back, also post back with the IP address that services.exe is connecting to.