Security is multi layered. You have already decided to run Windows without a user password. Without criticising that decision too much (after all, many people do this) - this knocks out a whole layer of security, and increases your potential exposure. In particular, when an attacker gains access to your computer, he will have complete access - full control of your computer, because you are running with administrator rights and no password.

Running BOINC as a service opens up many ways to fine-tune the security profile. This is good practice, and reduces your exposure to undiscovered vulnerabilities.

There are no known vulnerabilities in BOINC at present.

But BOINC is just one part of your security setup. No point locking down BOINC and leaving everything else wide open.

Am I being paranoid? Well, not really. If your computer was taken over, you simply wouldn't know. The latest viruses are produced by criminals, and are very hard to detect and remove. They don't do immediate damage to your computer. You just are no longer in control. There are various estimates, but up to one quarter of computers connected to the Internet may be infected. Read about the Storm botnet here: http://en.wikipedia.org/wiki/Storm_botnet

...nope, it fetches nothing. Say communicatiog with Zone Alarm, then receiving data, then goes away....

Wow! That is really awesome!!