Arcade File Downloads Support Forum
Email
Confirm email
Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Winlogon.exe


Click here to Run a Free Scan for Winlogon.exe Related Errors

What is it?
Windows Logon Process - Winlogon.exe

What does it do?
Direct Quote from here:
This is the process responsible for managing user logon and logoff. Moreover, Winlogon is active only when the user presses CTRL+ALT+DEL, at which point it shows the security dialog box.

Search MS for more info: Link

Virus Precaution:
The original Winlogon.exe from Microsoft gets placed in the C:WINDOWSSystem32 directory. if you find it anywhere else then you should be suspicious for sure.

You'll want to keep an eye on this google search for any known viruses. We've been able to find only 1 report of a virus so far.

Troj/Madr-B @ Sophos
Netsky.D @ Trend Micro
Fix Winlogon.exe Errors: Free Scan

Recommendation: Run a Free Performance Scan to automatically optimize memory, CPU and Internet Settings


Winlogon.exe is a Windows System File and should be in a system directory. If it is then this application is safe.

Startup DB Entries:
( 1 ) "Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 2 ) "Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 3 ) "Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 4 ) "Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 5 ) "Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 6 ) "Added by a TROJAN - see here. Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 7 ) "Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 8 ) "Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
( 9 ) "Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 10 ) "Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This file is placed in the Windows or Winnt folder"
( 11 ) "Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
( 12 ) "Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup and is always located in the System32 folder. This worm file is placed in the Winnt or Windows folder"
( 13 ) "Added by the RAHIWI.A WORM!"
( 14 ) "Added by the BRONTOK-BS WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
( 15 ) "Added by the AGENT-FZM TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"


Disclaimer

Every attempt has been made to ensure the information about Winlogon.exe is accurate but alot of malware applications try to pose as valid applications. If it is something other than what was posted above please leave some feedback in the forum.
Printer Friendly

User Comments
kurthrob@aol.comI have an instance of winlogon.exe (with an L, or so it seems) that keeps making my virus scanner pop up with this infor mation ldC992.tmp C:\windows\system32\1024 fakeAlert-B trojan deleted winlobon.exe I would just like to know how to stop the occurance from happening. Please help if you can. kurthrob@aol.com

Submit your comment Comments ARE moderated! Please only submit once!

Windows Files
lsass.exe | alg.exe | csrss.exe | Svchost.exe | Spoolsv.exe | wowexec.exe | dwwin.exe | ctfmon.exe | wuauclt.exe | wmiprvse.exe | Winlogon.exe | Smss.exe | msmsgs.exe | cidaemon.exe | rundll32.exe | mdm.exe | ntvdm.exe | ntdll.dll | explorer.exe | msdxm.ocx | wisptis.exe | iexplore.exe | wdfmgr.exe | PDVDServ.exe | gcasdtserv.exe | wscntfy.exe | DLLhost.exe | shdoclc.dll | Winmgmt.exe | cisvc.exe |
Table 'iamnotageek.files' doesn't exist