You're right. Check out this site:

http://www.pestpatrol.com/pestinfo%5...ftp_server.asp

Um, dunno, but those look normal to me. Spoolsv is just your print server/driver, ccevtmgr.exe is a symantec event manager, and the r_server is a remote admin. Now the last one could be a hack if your not using remote admin, but a legit prog if you are, or are on a VPN or your network admin set something like that up. If none of those are true, startup your services.msc and disable r_server.exe, check your msconfig and startup directory, and check your registry.

You could run the online viri scan in my signature .and spybot ,ad-aware will find the baddie also !

d/l'ed the spyware protector in ur sig earlier, ill check out the adware one

Then after reboot:
Download 'Hijack This!'. http://www.tomcoyote.org/hjt/
Unzip to a permanent folder, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
then post the log here

hmm the web site might be down or wrong link because the link isnt working

http://mjc1.com/mirror/hjt/

same thing, different link if the redirector wasnt working.

Yeah ,the site is under a DDOS attach ,the temporary link in my sig now works