Information about winlogon.exe file

The process "winlogon.exe" runs in the background. It's a part of the Windows Login subsystem. Winlogon is necessary for user authorization and checks the Windows XP activation code.

Note: The winlogon.exe file is located in the c:\windows\System32 folder. In other cases, winlogon.exe is a virus, spyware, trojan or worm! Check this with Anti-Spy.Info.

Virus with same name:
W32.Netsky.D - see McAfee Symantec Corporation Trend Micro

User feedback

Rating Opinion From The Windows Logon Process is responsible for managing user logon and logoff, and checks the Windows XP activation code. Must be in system32 folder!  link for more info Alex il permet d'ouvrir et fermer les sessions windows it permit to open and close session of windows Diksa Windows Logon Process SvanUden It check registratin code and user settings so it seems ok, but some hacks can change and than it owns about 100 MB of your memory and kills your operation system David My dial-up internet service was going crazy before I used "End task" to shut it down. The file creation date was only two days ago. A new registry entry HKLM\Software\...\Run was "ICQ Net C:\WINDOWS\winlogon.exe -stealth". I have never installed ICQ on this machine (win98SE, IE5.5SP2). I deleted the registry entry and the file from the c:\windows dir. No Problems. Michael Thorpe windows logon process Basic system process of XP/2000 of logging into the system itself, monitoring users and so on. Robert This is the Windows NT logon utility that manages user logons and logoffs. The utility prompts you for the password when you log on and allows you to log off or shut down. It also keeps track of your computer's license(s) if you are using Windows XP. Nathan Anmeldedienst von Windows. Aber nicht nur das. Bauen sie im Ihrem Rechner eine neue interne Hardwarekomponente ein, wird die WINLOGON.EXE dieses feststellen und , wenn Windows XP schon mal aktiviert war, dieses rückgängig machen. Sie dürfen bei Microsoft anrufen, und Ihre XP-Version erneut aktivieren. DataFighter As said by others, this process is responsible for managing user logon and logoff, both in Windows 2000 and Windows XP. It is perfectly normal and safe, AS LONG ASIT'S IN THE SYSTEM32 FOLDER! If it's running from anywhere else, it's a FAKE - some malware often names itself as a trusted program, only in another directory. Capi W32/Backdoor-CFB Martin Polder There is a trojan variant of Backdoor.Padador that hides unser the name winIogon.exe(that is really winiogon.exe, the 'i' is capitalized) i believe this is really a '5" rating if it goes unnoticed, it steals all kinds of cd keys and other private information. I had 2 winlogon.exe open (so it says the taskmanager), the original was "winlogon.exe" the bad file is list with "WinIogon.exe" (big i not L). I found it in Windowsdirectorie Jodahs Chek it out Captain Mnemo Pro is running under the same name winlogon.exe Pako I have seen one instance where winlogin.exe (as opposed to winlogon.exe) keeps getting re-entered in the HKLM\...\run\ regkey. As far as I can tell, winlogon.exe is good, winlogin.exe is bad. John D It is not more dangerous then Windows it self, and on most pc you need this file Twb it seems to be a backdoor hack of some sort, the windows process is all caps, the virus is lowercase. mike Dont kill this process!!! or your pc will hang. Louis Cyphre Part of WinNT applications. Created by Microsoft Windows, this file is safe and protected by windows system file protection. Jaeboy dangerous if found in C:\windows inetg. Hard to remove MaTT Even though it is neutral,it can be made to do dangerous things Rahul It seems activate Netbios conexion Eduardo There is a file that hides it's self as WinIogon and you must delete this in the WINDOWS Dir not the SYSTEM 32 dir if you are infeced John M This is a standard for NT machines , can be found in NT/2000/XP but not in windows 98/95/ME, however from what i have experieneced is that there is a Virus CLONE of this and obviously needs to be gone, if you are using 95/98/me and there is a winlogon.exe (or similar) then kill it, you dont need it, NT/2000/XP users will have to look closely at the filename if its Winlogon.exe then its ok if its WinIogon.exe (with Capital i) kill it, or if its Winlogin.exe (notice the change from logon to login) then kill it. but do use extreme caution as you could lock yourself out,if you delete the wrong one Ben Its a Windows file. Some virusses use its name. But they are cheap imitations. Viruswriters=Cant code :) On XP(sp1), You cannot delete C:\Program Files\Movie Maker\*.* or C:\Program Files\NetMeeting\*.* due to winlogon.exe. if some of these files be deleted, winlogon detects the deleting and restore that files. Microsoft never tells about this. pinewood zon Extreamly harmless task. Dennis M WinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone Shaun from CSC IŽd like to know if I can turn on or off.I donŽt find this info Rob i have winlogon.exe but it keep saying "error" and when i close the msg box it sudden goes to restart my computer, huh! what should i do? i need a site that has a copy of this file. I also found out that my winlogon.exe has an icon of moon and stars in the window image. I am totally suppecting that this is a virus. pls help me. clever_yong@yahoo.com I'm not sure, But I think this program caused my computer to restart on its own... it messed up Issas.exe, at least I think it did. Also, is it meant to look like a window with a moon in the background? al1 should be a normal process. John Smith why does it use like 24 MB RAM? It varies but pretty often it does. Chris I know that the good winlogon DO NOT Try to log to the internet if your firewall tell you that it try to connect to the net well you are infected me well I donot no much about this But it keeps poping up sridhar create a backup of the winlogon.exe that is already in the system32 just in case but if it aint 420 KB without updating windows then it gonna take your computer down, after updating with sp1 and sp2 the size might change as at this time i have no idea Blue Wolf a virus cws.yexe can made this file this virus is not danger but very claver i changes the default site in ie explorer so be carefull this could be a virus my computer is running slower than ever Stace i know nothing about it, but my system has been going fine and Norton hasnt found anything so 0 i say its a go! Jessie I get a fatal error if I try to quarantine this file. DON'T try to remove it! dcalin@dynamicintl.com slick little process gets added to the HKLM\...\run\ registry. It appears to coexist with the real executable in the system32 directory. It really has a different name that is not displayed. If you try to winzip the file it is displayed as w?nlogon.exe. delete this file if it you experience this and the creation date is recent. Do not delete the real WINLOGON.EXE. Derek It made my computer go crazy it was 51,000 in mem usage justin I found winlogon in HLKEY/Run other than the true winlogon of windows, and when i copy and paste its name in wordpad, the name was : w?nlogon.exe, i found that because a hacker was slealing all my yahoo and hotmail passwords, even all my personal information. it is a very dangerous virus, so try to localise it and delete it, ps: when u search by windows, u cant find it, and when u do alt+ctrl+del u will see wVnlogon in the task manager window Zak This is also used by the TIBS virus bastards!...in which case it will be located in a subdirectory "inetsrv" and is much smaller than the 500 KB os version.. Very hard to kill because windows thinks you are trying to kill the "real" one. Try a safe boot and edit all occurrences of "inetsrv" from the registry! i had to copy the file from one of my friend computer to my cpu .... then it worked Sunny Its a windows proccess, but can killyour machine in a matter of months if viruses or trojans attach to it Chris It checks your product id an activation key but it's a kind of "legal" spyware. Emil After the end of the boot, keep 100% CPU during 1 mn. PS wenn ich sie löschen will fahrt mein PC heruter WINLOGON is the windows compenent, winlogin.exe is not. The below link is what I used to fix it...my firewall caught it trying to connect to the internet, if it cant it seems harmless. A well problem solved for me.  link for more info Pat My machine also has an instance of WINLOGON.exe (yes in capitals in C:\I386) and as winlogon.exe in C:\WINDOWS\SYSTEM32\DLLCACHE and in C:\WINDOWS\ServicePackFiles\i386. Mark Johnson I have winlogon.exe in 6 files WinSys32, ServicePack files, and 4 Software Distributions. Why ? Pearson This thing may or may not be the real deal, since on my machine, it shows up as file location \??\C:\WINDOWS\system32\winlogon.exe. When I "Remove" the app, the whole computer just shuts off, and I get a BSD (Blue Screen of Death). This is very odd on a Windows XP machine. In fact this may be the first BSD I have ever seen on XP! Craig It doesn't hang anything when I remove process. Tim In Windows XP it checks to make sure that you have activated your Windows Operating System. Some people have hacked this file to avoid the activation. A modified winlogon.exe file will not lock you out and won't even remind you that you need to activate Windows. ZZ If U find it in system32 directory, save. if not, it's virus! All I know is that right after I installed SP2, and followed the reboot prompt, I lost this exe file, and received an error saying that I had an entry point proble. I could not get into my notebook rey to many people confuse this with the winlogon.exe, it has a capital i in the name to look like an I. Its very persistant it isnt picked up with adaware or antivirus software. It cant be disabled via msconfig. I had to go into safemode delete the exe then remove it out of the registry and it was all over the show in there. Drefsab WinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone. Scorpio Look for sign (click on this process look downwindow (Anti-Spy.Info) Properties Microsoft signed file). If its signed - its normal winlogon Name Some Parasite or something Sokhunthea All i know about winlogin.exe is that though it is system file but if u do improper shutdown a few times, whenever you try to open an internet application it will shutdown the computer without user input Rajesh Pillai Just noticed on my machine that the process running is 'WINLOG0N.EXE' (Note the second 'O' is actually a '0') Sure that it's malicious, so now have to find what it is (Symantec antivirus corporate has not picked up on it !!) Colin Norton Internet Security 2005 -- reports ? it was hogging resorces so i deleted it with kill box now the computer won't reboot tryed replacing it with another copy but still won't boot Job windows logon.exe always encouter a problem on my pc and needs to close resulting in restarting of the pc i can't understand i think it is dangerous leyade i lend a pal my pc to seek something but it he looked for a stupid no cd patch for a game the problem is one of the sites infected my winlogon.exe and my win32.dll with some subroutines that makes the data choose some stupid commercials on web isnt there a way to remove this part in the data file? ekei this file is located in the C:\windows\system32\ folder in winxp pro..... it took me about 40-45 sec to load windows everytime i click on my account...also my computer was not shuttin down for 1hr ! i'm very disappointed with windows xp....i even updated my windows...still gettin this problem A B If you know more about winlogon.exe, share your knowledge and help other users. Your opinion:  --- don't know ---  1 (not dangerous)  2  3 (neutral)  4  5 (dangerous) What do you know about this file: Link for more details: Your Name:

Search Results for winlogon.exe in

• Google
• Discussion boards

Other files