!SASWinLogon / SASWINLO.dll in startup ?

[sammy]

hi all - i tried looking around in the forum about this and i did see a few threads where it was mentioned BUT

i dont know if the people that inquired about it were running a paid version (which i might understand, then the first chance prevention) ....

im running the FREE version and wanted to know if this item should indeed be running at system start-up ?

[SUPERAntiSpy]

hi all - i tried looking around in the forum about this and i did see a few threads where it was mentioned BUT

i dont know if the people that inquired about it were running a paid version (which i might understand, then the first chance prevention) ....

im running the FREE version and wanted to know if this item should indeed be running at system start-up ?

Yes. The Winlogon handler is used by the Free Edition (in XP).

[sammy]

gotya SUPERAntiSpy ....

thanks for the feedback ive been checking the thread for days .....

you mentioned XP but ill assume its just the same for Vista, right.

thanks again - much appreciated.

[SUPERAntiSpy]

gotya SUPERAntiSpy ....

thanks for the feedback ive been checking the thread for days .....

you mentioned XP but ill assume its just the same for Vista, right.

thanks again - much appreciated.

Vista doesn't have Winlogon handlers

[siliconman01]

It appears, then, that the 32-bit SAS installer has a bug in it for Vista and Windows 7 because it does add the following WinLogon registry key.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]

"DllName"="C:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll"

"Logon"="SABWINLOLogon"

"Logoff"="SABWINLOLogoff"

"Startup"="SABWINLOStartup"

"Shutdown"="SABWINLOShutdown"

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

[sammy]

sorry for the delay in replying ....

so im a bit confused now and unsure as how to proceed.

@ SUPERAntiSpy & siliconman01, are you saying that it shouuld not be running at start-up as well as not even showing up ?

sorry if the question is dumb - but i wasnt sure what you meant by a "handler" so i dont know for sure what to make of what you guys are saying.

thanks guys! too cool!

[siliconman01]

It is not used in Vista and Windows 7 (x86 and x64). Nick is going to fix the Installer so that it only uses WinLogon on XP systems.

[sammy]

got it.

so, ill remove it.

do you think i should un-install / download again, and reinstall again (SAS).....

where should i check to know that the new installer is out ?

[siliconman01]

got it.

so, ill remove it.

do you think i should un-install / download again, and reinstall again (SAS).....

where should i check to know that the new installer is out ?

If you un-install and re-install V4.33.1000, it will add it right back in because the SAS installer has not been fixed yet. I suspect it will be fixed when V4.90 is released which is currently in Pre-Release testing. I'll check it when they release the next update for the pre-release.

How are you removing the !SASWinLogon entry...via Hijackthis or what?

[sammy]

If you un-install and re-install V4.33.1000, it will add it right back in because the SAS installer has not been fixed yet. I suspect it will be fixed when V4.90 is released which is currently in Pre-Release testing. I'll check it when they release the next update for the pre-release.

How are you removing the !SASWinLogon entry...via Hijackthis or what?

hi again siliconman01,

i was thinking of disabling it with winpatrol - it shows up under "start up programs" when i enable "display secret start up locations"

at the bottom of the picture that i attached youll see that theres the option for me to disable it ....

- Do you consider this okay or suggest another (better) way ??

you mentioned Hijackthis - i dont know anything about that, but ill try to have a look around to see if i can learn more, or maybe you can advise.

ill standby ....

i attached the pic for you to see.

EDIT: i just learned how hijackthis can help remove it - i will still standby and wait to hear back from you.

if you suggest that i use hijackthis, then ill download and install it to perform the task at hand - from what i learned its a pretty good tool to keep on-board anyways.

[siliconman01]

hi again siliconman01,

i was thinking of disabling it with winpatrol - it shows up under "start up programs" when i enable "display secret start up locations"

at the bottom of the picture that i attached youll see that theres the option for me to disable it ....

- Do you consider this okay or suggest another (better) way ??

you mentioned Hijackthis - i dont know anything about that, but ill try to have a look around to see if i can learn more, or maybe you can advise.

ill standby ....

i attached the pic for you to see.

EDIT: i just learned how hijackthis can help remove it - i will still standby and wait to hear back from you.

if you suggest that i use hijackthis, then ill download and install it to perform the task at hand - from what i learned its a pretty good tool to keep on-board anyways.

Using WinPatrol to remove it is quite alright. No need to install Hijackthis for doing this.

[sammy]

Using WinPatrol to remove it is quite alright. No need to install Hijackthis for doing this.

siliconman01, thanks for all the help with this !

did the deed with winpatrol - and all id fine still.

thanks again and sorry for not having wrote back sooner but ive been up to my neck ( almost literally with snow ! lolol )