Can services.exe, svchost.exe, spoolsv.exe or tar.exe be viruses?

[Macro2]

Zone alarm catches spoolsv.exe, svchost.exe and services.exe wanting to connect to the internet on boot up of w2k. "The cleaner" found tar.exe as a trojan. Norton did not.

Trouble is that I'm getting bombed with trojans...they seem to go right through Zone Alarm and Norton (upadated). I'll run Norton and I'll have 2 or three new trojans (backdoors, IRC, mumus, randex etc. the ones that like to take over your computer, delete files, launch attacks on other computers etc) and or worms every few days.
I'm constantly being bombed with port scans and whatever from places like Korea, China and Zaire after doing traceroutes of their IP addresses.

This leads me to believe that something has been palced on my computer and is sending out invitations...

Anyone ever had something like this and what do you do about it shot of reformat?

 

[igowerf]

Are you downloading random stuff off Kazaa? You should expect svchost.exe to try and use the internet. A lot of different programs use it and there are usually several instances of it in your task manager. I don't know why spoolsv.exe is trying to access the internet since it's used by your printer.

Is your Norton updated? I'd run a full system scan.

 

[Macro2]

this compumper has never had Kaaza or any other file sharing program installed...
Everytime I boot, zoneALarm says svchost.exe wants to make the computer a server. Afterthat it wants to let messenger access the net and the computer become a server, which I guess I have to let it doo if I want to use messenger. It's just the svchost.exe that has me confused. If you look up svchost on google you get something about scanning the registry to see what to load...etc...but that doesn't explain why it wants to make the computer a server unless it's phoning home...or who knows where.
This one runs XP. Scanned and no viruses

The w2k machine is getting all the viruses. On boot it says services.exe and spoolsv.exe want to access the internet. The cleaner found tar.exe as a trojan. Norton missed it. Norton also misses backdoor/irc type trojans untill i do a scan. Somehow they are getting through.

 

[oboeguy]

Maybe you have IIS running?

 

[Davegod]

check blackviper to see what service is what, and i also suggest to anyone reasonably competent to have a fiddle while theyre there, disbling some services can reduce XP's ram usage and maybe more to the point, improve security.

something is definately not right if youre constantly being bombed with trojans and whatnot, especially if you dont have kazaa et all running. do you use mirc?

tbh since you seem to say its happening a LOT, i'd just format and reinstall.

the number one way to aviod infection is to be careful what you download...

try running the cleaner and AVG occasionally (i.e. not on startup) to see what norton might be missing.

 

[TheVrolok]

Services and svchost will always try to access the net on boot up, it's just the way it works with windows. A number of programs/services make reference to 'em when they try to access the net. I just set Zone Alarm up to always allow those two programs.