sammy Posted February 6, 2010 hi all - i tried looking around in the forum about this and i did see a few threads where it was mentioned BUT i dont know if the people that inquired about it were running a paid version (which i might understand, then the first chance prevention) .... im running the FREE version and wanted to know if this item should indeed be running at system start-up ? Share this post Link to post Share on other sites
SUPERAntiSpy Posted February 8, 2010 hi all - i tried looking around in the forum about this and i did see a few threads where it was mentioned BUT i dont know if the people that inquired about it were running a paid version (which i might understand, then the first chance prevention) .... im running the FREE version and wanted to know if this item should indeed be running at system start-up ? Yes. The Winlogon handler is used by the Free Edition (in XP). Share this post Link to post Share on other sites
sammy Posted February 8, 2010 gotya SUPERAntiSpy .... thanks for the feedback ive been checking the thread for days ..... you mentioned XP but ill assume its just the same for Vista, right. thanks again - much appreciated. Share this post Link to post Share on other sites
SUPERAntiSpy Posted February 9, 2010 gotya SUPERAntiSpy .... thanks for the feedback ive been checking the thread for days ..... you mentioned XP but ill assume its just the same for Vista, right. thanks again - much appreciated. Vista doesn't have Winlogon handlers Share this post Link to post Share on other sites
siliconman01 Posted February 9, 2010 It appears, then, that the 32-bit SAS installer has a bug in it for Vista and Windows 7 because it does add the following WinLogon registry key. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] "DllName"="C:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll" "Logon"="SABWINLOLogon" "Logoff"="SABWINLOLogoff" "Startup"="SABWINLOStartup" "Shutdown"="SABWINLOShutdown" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 Share this post Link to post Share on other sites
sammy Posted February 11, 2010 sorry for the delay in replying .... so im a bit confused now and unsure as how to proceed. @ SUPERAntiSpy & siliconman01, are you saying that it shouuld not be running at start-up as well as not even showing up ? sorry if the question is dumb - but i wasnt sure what you meant by a "handler" so i dont know for sure what to make of what you guys are saying. thanks guys! too cool! Share this post Link to post Share on other sites
siliconman01 Posted February 11, 2010 It is not used in Vista and Windows 7 (x86 and x64). Nick is going to fix the Installer so that it only uses WinLogon on XP systems. Share this post Link to post Share on other sites
sammy Posted February 11, 2010 got it. so, ill remove it. do you think i should un-install / download again, and reinstall again (SAS)..... where should i check to know that the new installer is out ? Share this post Link to post Share on other sites
siliconman01 Posted February 11, 2010 got it. so, ill remove it. do you think i should un-install / download again, and reinstall again (SAS)..... where should i check to know that the new installer is out ? If you un-install and re-install V4.33.1000, it will add it right back in because the SAS installer has not been fixed yet. I suspect it will be fixed when V4.90 is released which is currently in Pre-Release testing. I'll check it when they release the next update for the pre-release. How are you removing the !SASWinLogon entry...via Hijackthis or what? Share this post Link to post Share on other sites
sammy Posted February 11, 2010 If you un-install and re-install V4.33.1000, it will add it right back in because the SAS installer has not been fixed yet. I suspect it will be fixed when V4.90 is released which is currently in Pre-Release testing. I'll check it when they release the next update for the pre-release. How are you removing the !SASWinLogon entry...via Hijackthis or what? hi again siliconman01, i was thinking of disabling it with winpatrol - it shows up under "start up programs" when i enable "display secret start up locations" at the bottom of the picture that i attached youll see that theres the option for me to disable it .... - Do you consider this okay or suggest another (better) way ?? you mentioned Hijackthis - i dont know anything about that, but ill try to have a look around to see if i can learn more, or maybe you can advise. ill standby .... i attached the pic for you to see. EDIT: i just learned how hijackthis can help remove it - i will still standby and wait to hear back from you. if you suggest that i use hijackthis, then ill download and install it to perform the task at hand - from what i learned its a pretty good tool to keep on-board anyways. Share this post Link to post Share on other sites
siliconman01 Posted February 12, 2010 hi again siliconman01, i was thinking of disabling it with winpatrol - it shows up under "start up programs" when i enable "display secret start up locations" at the bottom of the picture that i attached youll see that theres the option for me to disable it .... - Do you consider this okay or suggest another (better) way ?? you mentioned Hijackthis - i dont know anything about that, but ill try to have a look around to see if i can learn more, or maybe you can advise. ill standby .... i attached the pic for you to see. EDIT: i just learned how hijackthis can help remove it - i will still standby and wait to hear back from you. if you suggest that i use hijackthis, then ill download and install it to perform the task at hand - from what i learned its a pretty good tool to keep on-board anyways. Using WinPatrol to remove it is quite alright. No need to install Hijackthis for doing this. Share this post Link to post Share on other sites
sammy Posted February 14, 2010 Using WinPatrol to remove it is quite alright. No need to install Hijackthis for doing this. siliconman01, thanks for all the help with this ! did the deed with winpatrol - and all id fine still. thanks again and sorry for not having wrote back sooner but ive been up to my neck ( almost literally with snow ! lolol ) Share this post Link to post Share on other sites