Page 1 of 6 12345 ... LastLast
Results 1 to 10 of 55

Thread: Win XPSpybot start up log, could you check to see if I can uncheck anything Also ther

  1. #1
    Member
    Join Date
    Dec 2006
    Posts
    67

    Default Win XPSpybot start up log, could you check to see if I can uncheck anything Also ther

    Hi the startup from spybot has more stuff then the MSCONFIG start up, Is there anything I can uncheck? Remove My System is slow to load. thanks

  2. #2
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,483

    Default

    You probably see more stuff in Spybot's startup list than in msconfig because Spybot shows the winlogon entries.I don't suggest disabling them unless it's necessary,people have had problems with that in the past.Were those the ones you were looking at?

  3. #3
    Member
    Join Date
    Dec 2006
    Posts
    67

    Default

    Yeah those and some of the other ones, what do you think any of those that I can get rid of? thanks

  4. #4
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,483

    Default

    The winlogon ones,it's best to leave.In fact,if you try to disable them with Spybot they will probably not stay disabled,if Spybot 1.6 does it the same as Spybot 1.5.2.

    Here's a list of some of the normal winlogon entries from my XP computer.They're all legit,and should be left alone.

    Located: WinLogon, crypt32chain
    command: crypt32.dll
    file: crypt32.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, cryptnet
    command: cryptnet.dll
    file: cryptnet.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, cscdll
    command: cscdll.dll
    file: cscdll.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, ScCertProp
    command: wlnotify.dll
    file: wlnotify.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, Schedule
    command: wlnotify.dll
    file: wlnotify.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, sclgntfy
    command: sclgntfy.dll
    file: sclgntfy.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, SensLogn
    command: WlNotify.dll
    file: WlNotify.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, termsrv
    command: wlnotify.dll
    file: wlnotify.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, WgaLogon
    command: WgaLogon.dll
    file: WgaLogon.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Located: WinLogon, wlballoon
    command: wlnotify.dll
    file: wlnotify.dll
    size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
    Warning: if the file is actually larger than 0 bytes,
    the checksum could not be properly calculated!

    Just as well to leave the other two winlogon entries I see in your list,as well.

    Other than the winlogon ones,you don't really have an overabundance of startup entries.

    This one is users choice:
    Located: HK_LM:Run, HotKeysCmds
    command: C:\WINDOWS\system32\hkcmd.exe
    file: C:\WINDOWS\system32\hkcmd.exe
    size: 126976
    MD5: E4CF942A4AEA9D27C87F190F65E7D0F6
    http://www.castlecops.com/s1427-HotKeysCmds.html
    http://www.bleepingcomputer.com/star....exe-1939.html

    Located: HK_LM:Run, IgfxTray
    command: C:\WINDOWS\system32\igfxtray.exe
    file: C:\WINDOWS\system32\igfxtray.exe
    size: 155648
    MD5: 093D3EE722542BA2E7AD929AA3CA6ABC
    This is listed as N for not required:
    http://www.bleepingcomputer.com/star...tray-2147.html

    Open Spybot,and go to System Startup.Please read the description at the links I posted,and decide if you would prefer the two items I listed in quotes above to be run at start-up,or if you would like to disable them.If you do decide on disabling those two,it'd be best if you highlight the entry with your mouse and then choose Toogle,or uncheck them,but don't use delete,in case you change your mind later.

  5. #5
    Member
    Join Date
    Dec 2006
    Posts
    67

    Default

    what is the go to assist? The PCTVOICE what is that? What about the ctfmon? Spybot is saying it is a virus? but evrything I see seems to say it is legit but a resource hog?

  6. #6
    Senior Member drragostea's Avatar
    Join Date
    Jan 2008
    Location
    @Home
    Posts
    3,674

    Default

    I remember that the processes such as:
    • igfxtray.exe
    • hkcmd.exe
    • ati2evxx.exe


    All have to do with a Intel Chipset/Graphics Card. I have a ATI Radeon graphics card, so these startup entries will appear in my Startup Manager.

    As for 'ctfmon.exe' it's usually for [foreign] language devices. Usually it is active if you are using another language other than English.

  7. #7
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,483

    Default

    Here is a description for ctfmon.exe:
    http://www.bleepingcomputer.com/star....exe-1121.html
    Located: HK_CU:Run, ctfmon.exe
    where: S-1-5-21-789336058-764733703-1060284298-1004...
    command: C:\WINDOWS\system32\ctfmon.exe
    file: C:\WINDOWS\system32\ctfmon.exe
    size: 15360
    MD5: 24232996A38C0B0CF151C2140AE29FC8
    Right filename and path,so yours should be legit.If you have IE 7,it's standard to have it in your startup list.For a little more info on that,please see here:
    http://forums.spybot.info/showthread.php?t=17058
    I believe Spybot now lists a couple different things that ctfmon could be,to avoid confusion,though.Do you see another description if you scroll down?

    http://www.castlecops.com/s5669-PCTVOICE.html
    Located: HK_LM:Run, PCTVOICE
    command: pctspk.exe
    file: C:\WINDOWS\system32\pctspk.exe
    size: 163840
    MD5: 0B86BC4C123D3CD08817B1848DB07AC6
    http://www.castlecops.com/o20list-441.html
    Located: WinLogon, GoToAssist
    command: C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
    file: C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
    size: 10792
    MD5: 3D6FD4FFDE6DE32C34DC280D0BE781
    Spybot should show bad items as red,yellow items are
    unknown, unneeded or unambiguous program (e.g. malware programs might use the same file name as legitimate programs)
    But,you have to decide what you need or want to run after looking at the info for yourself,if it is yellow.Green is legitimate,and in most cases should not be disabled.hth.

    If you have any trouble with the descriptions posted,please let me know.

  8. #8
    Member
    Join Date
    Dec 2006
    Posts
    67

    Default

    'ctfmon.exe' Should I dis able it, I only use english, If I do disable it can I get it back? I have not read the links you posted ( have to get to work will read them tonight) I do remember reading somewhere a while ago that there is a whole process to disable them.

  9. #9
    Senior Member drragostea's Avatar
    Join Date
    Jan 2008
    Location
    @Home
    Posts
    3,674

    Default

    If you do not need it, then you can safely disable. The 'ctfmon.exe' will still be there when you need it.

    The first link tells you that it is not necessary and will be up to the user's decision.

  10. #10
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,483

    Default

    You could try disabling ctfmon this way:
    http://www.dslreports.com/faq/15629
    If you do disable it,you can reverse what was done in the link above if you change your mind.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •