SVCHOST blocked from terminating microsoft antispyware\gcasdtserv.

[Steveb_395]

A program called process guard is reporting "Sat 28 - 17:27:36 [TERMINATE]
c:\windows\system32\svchost.exe [1216] was blocked from terminating
c:\program files\microsoft antispyware\gcasdtserv.exe [544]" on system
startup.
System information shows various instances of SVCHOST but PID 1216 is shown
as path not available, version not available. Sygate firewall shows this PID
listening on port 135 with a function of "EPMAP - location service -
dynamically assigns ports for RCP"
Seems a bit strange that SVCHOST is trying to kill a antispyware app.

Any idea what's going on? Is it usual or is it suspect?

[Malke]

Steveb_395 wrote:

Googling for "process guard" brings up links to this:
http://www.diamondcs.com.au/processguard/

Do you have this installed? What antivirus are you running?

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

[Steveb_395]

Yep, its the diamondcs process guard program - it monitors process activity
and queries stuff it finds suspicious.

Running Avast, AVG, Antivir, Spybot, Adaware, Ewido, and Microsoft
antispyware.
None of these report any problems. I just find it a bit odd that SVCHOST was
trying to terminate one of the antispyware processes.

[Malke]

Steveb_395 wrote:

Don't know. Here's the explanation of Svchost in XP:
http://support.microsoft.com/kb/314056/EN-US/ and
http://windowsxp.mvps.org/svchost.htm

Also, you've got an awful lot of resident antivirus/antispyware stuff
running. Not a good idea to have more than one of each going at the
same time. Maybe that's why you're getting issues.

[Steveb_395]

Re the security programs, I tend to only keep a few resident, the others I
run as scanners on an as needed basis. These ones are all free and seem to do
a fairly decent job without too many false alarms etc.

I'll keep hunting - whatever it is isn't doing any harm and may even be
legit such as part of the microsoft apps update routine or something - just
makes me curious. %$# OS have just become sooo complicated - bring back the
good old DOS days ;-)