System Startup , under Tools, In Spybot S&D

[leonor2mur]

I have 12 items which are checked by default. I have tried unchecking all of them, except for my antivirus. When I exit that startup page, or exit Spybot, when I return they are again all re-checked. What am I doing wrong? Thanks for any help.

[md usa spybot fan]

leonor2mur:

I have 12 items which are checked by default. …

There are no entries "checked (or unchecked) by default". The check indicates if the startup entry is active or not in your system. In other words, Spybot is merely reporting what startup entries are present in your system and if the startup entries are enabled or disabled.

It would helpful if you posted the "12 items" you are questioning. To post the entry itself, right click on the startup listing and select "Copy to clipboard". Then paste (Ctrl+V) those results to a new post in this thread editing out all entries except the "12 items" you are questioning.

[leonor2mur]

Spybot Fan, thanks. Here is the list:

For information, in my System Configuration Utility, I am in Selective Startup. I have 13 items, 12 are UNCHECKED....all except my Avast Antivirus.
I am assuming the 12 items are disabled (at least, I hope so!). Why, then, are they checked (and therefore enabled, I assume) in Spybot? Put another way, I only want my antivirus running on Startup (I have Windows Firewall enabled, but I guess that's not running on Startup).


Located: HK_LM:Run, avast!
command: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
file: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
size: 78008
MD5: 66893067C2FB0505F151D3FCB8EA92B5

Located: WinLogon, !SASWinLogon
command: C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
file: C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
size: 294912
MD5: 3B2F85D8C913CE452ADE4A0D24299FEA

Located: WinLogon, crypt32chain
command: crypt32.dll
file: crypt32.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cryptnet
command: cryptnet.dll
file: cryptnet.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cscdll
command: cscdll.dll
file: cscdll.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, igfxcui
command: igfxdev.dll
file: igfxdev.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, Schedule
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, termsrv
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, wlballoon
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

[md usa spybot fan]

leonor2mur:

It seems that Spybot no longer allows you to disable WinLogon startup entries. Those entries were first listed in Spybot's System Startup with version 1.4. Not understanding the nature of those entries, many people were deleting the entries causing such problems as no longer being able to do Windows updates.

The following entries are all legitimate and should not be disabled:

• WinLogon, !SASWinLogon
• WinLogon, crypt32chain
• WinLogon, cryptnet
• WinLogon, cscdll
• WinLogon, ScCertProp
• WinLogon, Schedule
• WinLogon, sclgntfy
• WinLogon, SensLogn
• WinLogon, wlballoon

Exactly where in your System Configuration Utility are those items unchecked?

[md usa spybot fan]

leonor2mur:

There may be a bug. Please see the following thread:

• Possible Tools » System Startup facility bug
  http://forums.spybot.info/showthread.php?t=35450

[leonor2mur]

Spybot Fan, the link you provided takes me right back to this page???

I am in "Selective Startup" in my System Configuration Utility...and under "Startup", all my items are unchecked, except my antivirus (which is the way I wanted it).

[md usa spybot fan]

leonor2mur:

Re the link: Sorry about that. Try:

• Possible Tools » System Startup facility bug
  http://forums.spybot.info/showthread.php?t=35462

In my system those items are not listed in the System Configuration Utility under the Startup tab. Those items should not be disabled. For exmple:

• The WinLogon !SASWinLogon (SASWINLO.DLL) processor is used by SUPERAntiSpyware to remove malware on stasrtup and shutdown.
• WinLogon igfxcui (igfxdev.dll) belongs to the Intel Integrated Graphics Controller Driver.
• The rest are default Windows installation WinLogon entries and without the many functions will be affected such as Windows updates.

[leonor2mur]

Spybot Fan, I think we may be having a miscommunication here.

The 12 items I referred to in my previous post are listed in Spybot's Startup listing. They are NOT listed in my System Configuration Utility's Startup listing.

I guess the only reason I'm questioning all of this is that I expected both my system's AND Spybot's lists would be the same. I'm probably wrong about this.
If you check the startup up items in Spybot, you will note the information given at the top of the window states: "This list displays all programs that will be started along with Windows if you power on your system".

[md usa spybot fan]

leonor2mur:

Fact: Not all things that automatically start in your system are shown in the System Configuration Utility.

I assume this statement in Spybot's System Startup facility may be true: "This list displays all programs that will be started along with Windows if you power on your system. …", but I have never attempted to verify it. I do know that Spybot's System Startup facility shows more than the System Configuration Utility.

For a list of startup locations compiled by Tony Kleinkramer (a.k.a. TonyKlein) see:

• A Collection Of Autostart Locations, by Tony Kleinkramer
  http://forums.subratam.org/index.php...er&f=29&t=1063

In that "Collection Of Autostart Locations" the Winlogon entries shown in Spybot's System Startup facility are referenced here:

27. Winlogon\Notify (Win XP/2000/NT)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

Another well known registry key added to in order to communicate to Winlogon.exe and let it know which procedures to run during an event notification; a DLL referenced here will be executed in a SYSTEM-level process, regardless of whether a user logs in.

[leonor2mur]

Spybot Fan, this clarifies things for me. Thanks for all your help....and thanks for picking up on the bug!