Questions about Spybot and CHKDSK

[jlreich]

Hi everyone.

I looked at my startup list in Spybot S&D and found these new items listed.

Any idea why they are there now. :confused: They were never there before. I disabled them when I found them.


Located: WinLogon, AtiExtEvent (DISABLED)
command: Ati2evxx.dll

Located: WinLogon, crypt32chain (DISABLED)
command: crypt32.dll

Located: WinLogon, cryptnet (DISABLED)
command: cryptnet.dll

Located: WinLogon, cscdll (DISABLED)
command: cscdll.dll

Located: WinLogon, igfxcui (DISABLED)
command: igfxsrvc.dll

Located: WinLogon, ScCertProp (DISABLED)
command: wlnotify.dll

Located: WinLogon, Schedule (DISABLED)
command: wlnotify.dll

Located: WinLogon, sclgntfy (DISABLED)
command: sclgntfy.dll

Located: WinLogon, SensLogn (DISABLED)
command: WlNotify.dll

Located: WinLogon, termsrv (DISABLED)
command: wlnotify.dll

Located: WinLogon, wlballoon (DISABLED)
command: wlnotify.dll


Also ran a CHKDSK(through CMD prompt) and came up with problems in my index and MTF. MTF was fixed, but after running CHKDSK several times, it was unable to fix the index problems. After I run it to fix things, I then run it again in read only mode to check if things are ok, but the same problems keep coming back.
:confused: Now I just ran it again and no problems come up with index, but it says it has recovered lost files, found problems with file system, run with /f option to fix.....

Any ideas. Is this some kind of virus or something?? I have ran online AV with nothing found.

I have a good recent backup of my C drive on external USB drive, so I can go that route if needed.

Any input appreciated.

[Donn]

How did you look at your startup list in spybot, if I did it right, I do not have these files listed. . .

[jlreich]

Hi Donn.

I went into tools - System startup. I have no idea were they came from. I do the "create snapshot" every once in a while. So I know when something new comes up(changes are highlighted in bold).

:confused:

Thanks for the reply.

[pop pop]

This will be of little help but I Googled everything and they all appear to be legit .dll's. I can only guess that most are related to monitoring or tracking logins and I only say that based on the descriptions and other info I saw. There are a couple that don't quite fit that pattern: AtiExtEvent/Ati2evxx.dll is an ATI External Event Utility and cscdll.dll is described as "client-side caching".

Being a paranoid person when it comes to my computers, and being one that loves conspiracies, I would say you are using XP or W2K (or at least an NT kernel OS), an ATI graphics card, and you are possibly networked. Something recently changed and login monitoring is being affected or has been enabled.

Then again ... :confused:

[jlreich]

You are right Pop Pop, XP, ATI.....

I googled for some of the entries as well, and found the same thing you found. I just don't understand why they are there all of the sudden. Very suspicious.


As far as the CHKDSK problem goes, I have run Data Lifeguard Tools and have come up with no errors. Seems to be an OS problem as far as I can tell. I also have ran CHKDSK on my backup external drive, and found no errors.

I am thinking reformat and install backup. Unless someone can come up with an idea.

Thanks.

[Donn]

How would those files be in your SpyBot startup, but not be in your msconfig, startup tab, or am I just being redundant to the point? :eek:

edit: what happens if you just uninstall--totally- SpyBot and reinstall it ? Worth a try before reformatting HDD, yeah?

[jlreich]

Good thought Donn. I looked at msconfig, not there. Enabled all the mysterious entries in Spybot, still not in msconfig. :confused:

Reinstall Spybot, worth a try. Although, if there are still errors in my file system, I will still have to do a backup install. :(

But hey, that's what I bought the external HDD for. My last backup is about a week and a half old. Not to bad. :) Most of the files that have changed since then I can backup on another partition, so I am not to sad. More aggravated than anything. Not knowing what happened.

Thanks Donn.

[Donn]

In msconfig, startup tab, do you have a little icon at the bottom above 'apply' and 'ok' that reads 'clean up' ? If you do, click on it, and then go check Spybot start up again. . .just a thought. . .

[Donn]

If you are in selective startup --wouldn't that keep it out of msconfig if it was being planted, say, by a problem in Spybot. So if you uninstall SpyBot, you should reinstall it in selective startup, right? If it comes back, then at least it won't be in msconfig . . . .

[jlreich]

Hey Donn, I reinstalled Spybot, and the entries are gone. Maybe it was a glitch. I don't know. But at least that is taken care of. :)

Now if I can figure out what to do with my file system problems. Like I said before, I can do a backup, but that's not the point. I would rather fix it. :p

Thanks for your help Donn.