Jump to content
Sign in to follow this  
sammy

!SASWinLogon / SASWINLO.dll in startup ?

Recommended Posts

hi all - i tried looking around in the forum about this and i did see a few threads where it was mentioned BUT

i dont know if the people that inquired about it were running a paid version (which i might understand, then the first chance prevention) ....

im running the FREE version and wanted to know if this item should indeed be running at system start-up ?

Share this post


Link to post
Share on other sites

hi all - i tried looking around in the forum about this and i did see a few threads where it was mentioned BUT

i dont know if the people that inquired about it were running a paid version (which i might understand, then the first chance prevention) ....

im running the FREE version and wanted to know if this item should indeed be running at system start-up ?

Yes. The Winlogon handler is used by the Free Edition (in XP).

Share this post


Link to post
Share on other sites

gotya SUPERAntiSpy ....

thanks for the feedback ive been checking the thread for days .....

you mentioned XP but ill assume its just the same for Vista, right.

thanks again - much appreciated.

Share this post


Link to post
Share on other sites

gotya SUPERAntiSpy ....

thanks for the feedback ive been checking the thread for days .....

you mentioned XP but ill assume its just the same for Vista, right.

thanks again - much appreciated.

Vista doesn't have Winlogon handlers :)

Share this post


Link to post
Share on other sites

It appears, then, that the 32-bit SAS installer has a bug in it for Vista and Windows 7 because it does add the following WinLogon registry key.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]

"DllName"="C:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll"

"Logon"="SABWINLOLogon"

"Logoff"="SABWINLOLogoff"

"Startup"="SABWINLOStartup"

"Shutdown"="SABWINLOShutdown"

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

Share this post


Link to post
Share on other sites

sorry for the delay in replying ....

so im a bit confused now and unsure as how to proceed.

@ SUPERAntiSpy & siliconman01, are you saying that it shouuld not be running at start-up as well as not even showing up ?

sorry if the question is dumb - but i wasnt sure what you meant by a "handler" so i dont know for sure what to make of what you guys are saying.

thanks guys! too cool!

Share this post


Link to post
Share on other sites

got it.

so, ill remove it.

do you think i should un-install / download again, and reinstall again (SAS).....

where should i check to know that the new installer is out ?

Share this post


Link to post
Share on other sites

got it.

so, ill remove it.

do you think i should un-install / download again, and reinstall again (SAS).....

where should i check to know that the new installer is out ?

If you un-install and re-install V4.33.1000, it will add it right back in because the SAS installer has not been fixed yet. I suspect it will be fixed when V4.90 is released which is currently in Pre-Release testing. I'll check it when they release the next update for the pre-release.

How are you removing the !SASWinLogon entry...via Hijackthis or what?

Share this post


Link to post
Share on other sites

If you un-install and re-install V4.33.1000, it will add it right back in because the SAS installer has not been fixed yet. I suspect it will be fixed when V4.90 is released which is currently in Pre-Release testing. I'll check it when they release the next update for the pre-release.

How are you removing the !SASWinLogon entry...via Hijackthis or what?

hi again siliconman01,

i was thinking of disabling it with winpatrol - it shows up under "start up programs" when i enable "display secret start up locations"

at the bottom of the picture that i attached youll see that theres the option for me to disable it ....

- Do you consider this okay or suggest another (better) way ??

you mentioned Hijackthis - i dont know anything about that, but ill try to have a look around to see if i can learn more, or maybe you can advise.

ill standby ....

i attached the pic for you to see.

post-10663-126592573016_thumb.png

EDIT: i just learned how hijackthis can help remove it - i will still standby and wait to hear back from you.

if you suggest that i use hijackthis, then ill download and install it to perform the task at hand - from what i learned its a pretty good tool to keep on-board anyways.

Share this post


Link to post
Share on other sites

hi again siliconman01,

i was thinking of disabling it with winpatrol - it shows up under "start up programs" when i enable "display secret start up locations"

at the bottom of the picture that i attached youll see that theres the option for me to disable it ....

- Do you consider this okay or suggest another (better) way ??

you mentioned Hijackthis - i dont know anything about that, but ill try to have a look around to see if i can learn more, or maybe you can advise.

ill standby ....

i attached the pic for you to see.

post-10663-126592573016_thumb.png

EDIT: i just learned how hijackthis can help remove it - i will still standby and wait to hear back from you.

if you suggest that i use hijackthis, then ill download and install it to perform the task at hand - from what i learned its a pretty good tool to keep on-board anyways.

Using WinPatrol to remove it is quite alright. No need to install Hijackthis for doing this.

Share this post


Link to post
Share on other sites

Using WinPatrol to remove it is quite alright. No need to install Hijackthis for doing this.

siliconman01, thanks for all the help with this !

did the deed with winpatrol - and all id fine still.

thanks again and sorry for not having wrote back sooner but ive been up to my neck ( almost literally with snow ! lolol :-( )

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×