Attack to port 445 (microsoft-ds)

there are two strange proccesses under task manager called “svapache.exe” or “crtl.exe” and what they are doing is a heavy network scanning that makes the net slow down. the pc’s don’t have sasser, korgo or something like that and my norton is working with the last update. I had erased the files locating in windows\prefetch and windows\system32 and all registry keys, but after few hours it comes again.
Any help?