Author Topic: port 80 / avast? problem after incorrect power down  (Read 12498 times)

0 Members and 1 Guest are viewing this topic.

yahsas

  • Guest
port 80 / avast? problem after incorrect power down
« on: July 15, 2009, 02:13:49 PM »
Hi - after incorrectly powering down (accidentally switched off at the switch when pc was on but screen in power save) I have been experiencing several problems, the last of which I can't seem to solve but seems to relate to avast...

Windows XP Home Service Pack 3, Avast home 4.8.1335 (VPS 090714-0 14/07/2009), Sygate Personal firewall 5.6, Windows firewall turned off), external broadband modem, IE8 & Firefox 3.0.11, Outlook Express (POP mail via yahoo)

Symptoms (& solution where found):
- chkdsk ran at every boot (ran chkdsk /f /r and this stopped),
- could send but couldn't receive pop mail (changed port to to 995 from 110).
- couldn't get to any http websites using Firefox or Explorer but could access https - could only access by pausing avast webshield

I have run spybot, ad-aware, a thorough (avast) virus check, uninstalled & reinstalled sygate, uninstalled & reinstalled avast and probably some other things that I've since forgotten I've tried and finally after much googling of port 80 problems found this:
http://beer234.blogspot.com/2008/10/port-80-blocked-windows-xp.html
My value in 'start' was 4 and after resetting to 3, everything worked...for about 3 days...and then I encountered the same problem only this time the fix didn't work :(

I have been able to access http sites in safe mode w networking - implying it's an application problem - and given that I can only access these sites when avast webshield's turned off, I figured it might be avast (or how it interacts with sygate?) but have dried up searching the forums........any assistance would be greatly appreciated as I'd rather have webshield on!!!

Thanks in advance / hoping someone can point me in the right direction.....

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: port 80 / avast? problem after incorrect power down
« Reply #1 on: July 15, 2009, 03:54:21 PM »
The email port 995 is for secure communication and avast can't handle SSL/TLS email even before your power off issue. By having it on port 995 avast wouldn't be scanning that content (as it can't, its secure) as it only monitors ports 25, 110, 119 and 143.

Changing port to 110 whilst still retaining the secure communication would cause the email collection to fail.

I believe your problems are related to your firewall actually blocking the avast processes.

Does it allow ashWebSv.exe, ashMaiSv.exe and avast.setup internet access ?
- If it does delete the entries for them and do a manual update and reconnect to the internet, brows and try to collect your email (having set your email back to what it was 995) this should force the firewall to ask permission again.

Personally I would be looking for a firewall that hasn't effectively been abandoned and sygate has holes as far as localhost loopback it concerned as it can allow processes using the localhost proxy right through without challenge, as it only seeks permission for the parent of the proxy.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

yahsas

  • Guest
Re: port 80 / avast? problem after incorrect power down
« Reply #2 on: July 15, 2009, 11:52:54 PM »
Thanks - yeah, agree that I should switch to another firewall in any case but should clarify that sygate doesn't seem to be the problem: have tried the following (a couple of times)
- sygate does allow the avast entries you listed
- deleted those entries anyway & reconnected etc
- still can't access port 80 or 110
- turned off sygate
- tried the regedit/'start' value (3)/reboot fix again as per the link in original post
- on rebooting, still can't access port 80 or 110 (and 'start' value is 4 again)
- repeated the above after uninstalling sygate (with and without windows firewall turned on and off) with same result

In summary:
> re: browsing, can still only access http sites when avast webshield turned off (without any firewall active)
> re: pop mail download, can only access using port 995 - even when avast paused / terminated (ditto)
(Btw, have re-run an ad-aware thorough scan and also various registry cleaners etc - any other free malware programs I should try?)

So to answer my own question(s), I guess avast isn't the main/only problem since the two ports seem to be affected differently - although the browsing problem does seem to involve avast somehow.  Any ideas how I can track down the problem, even if it's not avast-related (if so, apols for posting on an avast forum) - any pointers would be appreciated....  As you can tell, I'm getting in too deep here  :'(

yahsas

  • Guest
Re: port 80 / avast? problem after incorrect power down
« Reply #3 on: July 16, 2009, 12:31:23 AM »
btw, the errors I get are:

Outlook Express:
Your server has unexpectedly terminated the connection. Possible causes for this include server problems, network problems, or a long period of inactivity. Account: 'pop.mail.yahoo.co.uk', Server: 'pop.mail.yahoo.co.uk', Protocol: POP3, Port: 110, Secure(SSL): No, Error Number: 0x800CCC0F

Firefox & IE:
timeout

also btw: I can ping known good sites (google, microsoft, my ISP) without packet loss

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: port 80 / avast? problem after incorrect power down
« Reply #4 on: July 16, 2009, 12:59:35 AM »
Couldn't be a Sygate issue?
If you uninstall it (enabling Windows one), will the connections work?
The best things in life are free.

yahsas

  • Guest
Re: port 80 / avast? problem after incorrect power down
« Reply #5 on: July 16, 2009, 01:28:57 AM »
yeah, unfortunately tried that too (see last few dot-points in post from 09:52:54 PM) - get the same problem with windows firewall on or off, sygate on or off, both windows & sygate on or off (incl. w sygate completely uninstalled)....




Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: port 80 / avast? problem after incorrect power down
« Reply #6 on: July 16, 2009, 01:41:38 AM »
I really can't think of how this kind of issue was caused by the system being switched off whilst running. That may well cause some corruption, but the system would normally do a chkdsk scan on the next boot recognising that the shutdown wasn't good. This should attempt to fix or at least detect corrupt files.

Have (or did) you another AV installed in this system, if so what was it and how did you get rid of it ?

Whilst you say you reinstalled avast, I would try a clean reinstall to make sure any registry entries which may have been effected are cleared.

Download the latest version of avast http://www.avast.com/eng/download-avast-home.html and save it to your HDD, somewhere you can find it again. Use that when you reinstall. Ensure that you scroll down and select the avast direct download link for the English version and not Cnet as that is for an on-line installation (not what you want to do). - Direct download for avast Home, English version, http://files.avast.com/iavs4pro/setupeng.exe.
Download the avast! Uninstall Utility, find it here and save it to your HDD.
  • 1. Now uninstall (using add remove programs, if you can't do that start from the next step), reboot.
  • 2. run the avast! Uninstall Utility, reboot.  If step 1 failed it may be necessary to run this from safe mode, once complete reboot into normal mode.
  • 3. install the latest version, reboot.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

yahsas

  • Guest
Re: port 80 / avast? problem after incorrect power down
« Reply #7 on: July 16, 2009, 04:22:11 AM »
Thanks - I'm fairly sure that's what I tried a few days ago but will give it a go again and report back.

ps. in answer to your question, I used to have AVG Free (ages ago - prob >1yr) but uninstalled it.  The problem described in this thread appeared about 2wks ago and like you can't think a) why chkdsk didn't solve it and b) why the fix I mentioned [http://beer234.blogspot.com/2008/10/port-80-blocked-windows-xp.html] seemed to work for 3 days / reboot cycles and then reverted back. First thought was some malware but doesn't seem to be the case, going by ad-aware, avast etc....

yahsas

  • Guest
Re: port 80 / avast? problem after incorrect power down
« Reply #8 on: July 16, 2009, 02:07:34 PM »
...no luck - no change after reinstalling avast as per instructions...

[incidentally, when I boot in safe mode, it hangs at a347bus.sys - after a bit of googling, it seemed Alcohol 120 might be to blame so I uninstalled Alcohol - however it still hangs at this file; not sure if this is related to my other problems or just another can of worms]

any further suggestions welcomed...


Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: port 80 / avast? problem after incorrect power down
« Reply #9 on: July 16, 2009, 03:55:03 PM »
Well avast doesn't run in safe mode so there should be zero interaction with/from avast on safe mode boots.

I don't know what version of AVG you had, if avg8 - AVG8 Remover, download tool from here, http://www.grisoft.com/ww.download-tools there is a 32bit and 64 bit windows version, ensure you use the correct one.

If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

yahsas

  • Guest
Re: port 80 / avast? problem after incorrect power down
« Reply #10 on: July 18, 2009, 08:34:24 AM »
Thanks for those suggestions, no change I'm afraid...

- ran AVG8 32bit remover (no traces found as far as I could see)
- ran superantispyware (only a couple of cookies)
- ran malwarebytes anti-malware (log file contents pasted below)

Any other thoughts or is it time for a windows repair / format?  Any way I can find out what process is changing HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\vsdatant\start value to 4 (if this is relevant)?

------------------------------------
Malwarebytes' Anti-Malware 1.39
Database version: 2453
Windows 5.1.2600 Service Pack 3

18/07/2009 4:17:09 PM
mbam-log-2009-07-18 (16-17-09).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 370394
Time elapsed: 1 hour(s), 46 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: port 80 / avast? problem after incorrect power down
« Reply #11 on: July 18, 2009, 03:49:25 PM »
I really am at a loss as to what else to suggest as we have basically covered all the bases to resolve any http/web shield issues.

However your comment about vsdatznt, indicates this is related to zone alarm, http://www.google.com/search?q=vsdatant and see image.

Quote
vsdatant.sys file information

The process TrueVector Device Driver belongs to the software TrueVector Device Driver or vsdatant or ZoneAlarm or ZoneAlarm with Antivirus or ZoneAlarm Security Suite or ZoneAlarm Pro or ZoneAlarm Anti-virus by Zone Labs Inc (www.zonelabs.com) or Zone Labs, LLC or Zone Labs LLC (www.zonelabs.com).]vsdatant.sys file information

The process TrueVector Device Driver belongs to the software TrueVector Device Driver or vsdatant or ZoneAlarm or ZoneAlarm with Antivirus or ZoneAlarm Security Suite or ZoneAlarm Pro or ZoneAlarm Anti-virus by Zone Labs Inc (www.zonelabs.com) or Zone Labs, LLC or Zone Labs LLC (www.zonelabs.com).

So have you ever had zone alarm installed on this system as it appears there might be remnants ?
That could well have a large impact with possible conflict not just with the web shield proxy but with sygate.

Check for the existence of vsdatant.sys and report your findings ?

Use this analysis tool - Program & Tutorial - useful as a diagnostic tool - FileHippo Download - HiJackThis and post the contents of the HJT log file here. - HJT Information HiJackThis Tutorial.

Download and run HJT and post the contents of the log file (cut and paste or attach the log file) into this topic, you may need to split it over two or more posts depending on how large it is.
« Last Edit: July 19, 2009, 02:31:46 AM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Sammo

  • Guest
Re: port 80 / avast? problem after incorrect power down
« Reply #12 on: July 19, 2009, 02:12:17 AM »
I had a very similar problem yesterday when after a forced shut down and system restart Web Shield would block everything. I suspect that the firewall rules were damaged or something. What I did was remove the firewall rule for ashWebSv.exe and let Outpost firewall create a new rule. This restored Web Shield functionality again.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: port 80 / avast? problem after incorrect power down
« Reply #13 on: July 19, 2009, 02:34:00 AM »
I don't believe that this is the case here as we have already gone through those steps and disables Sygate.

The point I'm making here is that there appears to be remnants of another firewall not previously mentioned, so the same as not having two AV, having two firewalls or remnants could have the same conflicting issues.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

yahsas

  • Guest
Re: port 80 / avast? problem after incorrect power down
« Reply #14 on: July 19, 2009, 04:50:38 AM »
hmm, no, have never had ZoneAlarm installed - did the search: no sign of  'vsdatant.sys'

have run hijackthis, log pasted below

thanks

-------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:39 PM, on 19/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\mom.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com.au
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-au\msntb.dll
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-au\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: AutorunsDisabled
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161599965546
O16 - DPF: {F1D54B0B-B6EA-43B5-BD26-A79D3DBF47E3} (Multidownx Control) - http://bigpondmusic.com/activex/multidownx.cab
O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe (file missing)

--
End of file - 7996 bytes