Anti-Spy.Info > File library > winlogon.exe

Information about winlogon.exe file

File: winlogon.exe
Name: Windows NT/2000/XP Logon Application
Product: Windows
Manufacturer: Microsoft
Risk factor (Virus/Trojan/Spyware): Rating

The process "winlogon.exe" runs in the background. It's a part of the Windows Login subsystem. Winlogon is necessary for user authorization and checks the Windows XP activation code.

Note: The winlogon.exe file file should appear only the C:\Windows\System32\ folder. If you happen to find this file in a different folder, it is possible that your winlogon.exe is in reality a malicious file. Many trojans and viruses try to cloak their real identity by using the names of legitimate files. Any time that you encounter a suspicious process, you should verify the digital signature and the file path, for example using Anti-Spy.Info.

Virus with same name:
W32.Netsky.D - see McAfee Symantec Corporation Trend Micro

User feedback

There were 4115 user requests for that file. 24 users classify it as harmless. 3 users classify it as not so dangerous. 10 users classify it as neutral. 10 users considered the file to be suspicious. 24 users classify it as bad and recommend to delete winlogon.exe. 15 users didn't classify it ("don't know").

RatingThe Windows Logon Process is responsible for managing user logon and logoff, and checks the Windows XP activation code. Must be in system32 folder!  link for more info Alex
Ratingil permet d'ouvrir et fermer les sessions windows it permit to open and close session of windows Diksa
RatingWindows Logon Process SvanUden
RatingIt check registratin code and user settings so it seems ok, but some hacks can change and than it owns about 100 MB of your memory and kills your operation system David
RatingMy dial-up internet service was going crazy before I used "End task" to shut it down. The file creation date was only two days ago. A new registry entry HKLM\Software\...\Run was "ICQ Net C:\WINDOWS\winlogon.exe -stealth". I have never installed ICQ on this machine (win98SE, IE5.5SP2). I deleted the registry entry and the file from the c:\windows dir. No Problems. Michael Thorpe
Ratingwindows logon process
RatingBasic system process of XP/2000 of logging into the system itself, monitoring users and so on. Robert
RatingThis is the Windows NT logon utility that manages user logons and logoffs. The utility prompts you for the password when you log on and allows you to log off or shut down. It also keeps track of your computer's license(s) if you are using Windows XP. Nathan
RatingAnmeldedienst von Windows. Aber nicht nur das. Bauen sie im Ihrem Rechner eine neue interne Hardwarekomponente ein, wird die WINLOGON.EXE dieses feststellen und , wenn Windows XP schon mal aktiviert war, dieses rückgängig machen. Sie dürfen bei Microsoft anrufen, und Ihre XP-Version erneut aktivieren. DataFighter
RatingAs said by others, this process is responsible for managing user logon and logoff, both in Windows 2000 and Windows XP. It is perfectly normal and safe, AS LONG ASIT'S IN THE SYSTEM32 FOLDER! If it's running from anywhere else, it's a FAKE - some malware often names itself as a trusted program, only in another directory. Capi
RatingW32/Backdoor-CFB Martin Polder
RatingThere is a trojan variant of Backdoor.Padador that hides unser the name winIogon.exe(that is really winiogon.exe, the 'i' is capitalized) i believe this is really a '5" rating if it goes unnoticed, it steals all kinds of cd keys and other private information.
RatingI had 2 winlogon.exe open (so it says the taskmanager), the original was "winlogon.exe" the bad file is list with "WinIogon.exe" (big i not L). I found it in Windowsdirectorie Jodahs
RatingChek it out Captain Mnemo Pro is running under the same name winlogon.exe Pako
RatingI have seen one instance where winlogin.exe (as opposed to winlogon.exe) keeps getting re-entered in the HKLM\...\run\ regkey. As far as I can tell, winlogon.exe is good, winlogin.exe is bad. John D
RatingIt is not more dangerous then Windows it self, and on most pc you need this file Twb
Ratingit seems to be a backdoor hack of some sort, the windows process is all caps, the virus is lowercase. mike
RatingDont kill this process!!! or your pc will hang. Louis Cyphre
RatingPart of WinNT applications. Created by Microsoft Windows, this file is safe and protected by windows system file protection. Jaeboy
Ratingdangerous if found in C:\windows inetg. Hard to remove MaTT
RatingEven though it is neutral,it can be made to do dangerous things Rahul
RatingIt seems activate Netbios conexion Eduardo
RatingThere is a file that hides it's self as WinIogon and you must delete this in the WINDOWS Dir not the SYSTEM 32 dir if you are infeced John M
RatingThis is a standard for NT machines , can be found in NT/2000/XP but not in windows 98/95/ME, however from what i have experieneced is that there is a Virus CLONE of this and obviously needs to be gone, if you are using 95/98/me and there is a winlogon.exe (or similar) then kill it, you dont need it, NT/2000/XP users will have to look closely at the filename if its Winlogon.exe then its ok if its WinIogon.exe (with Capital i) kill it, or if its Winlogin.exe (notice the change from logon to login) then kill it. but do use extreme caution as you could lock yourself out,if you delete the wrong one Ben
RatingIts a Windows file. Some virusses use its name. But they are cheap imitations. Viruswriters=Cant code :)
RatingOn XP(sp1), You cannot delete C:\Program Files\Movie Maker\*.* or C:\Program Files\NetMeeting\*.* due to winlogon.exe. if some of these files be deleted, winlogon detects the deleting and restore that files. Microsoft never tells about this. pinewood zon
RatingExtreamly harmless task. Dennis M
RatingWinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone Shaun from CSC
RatingI'd like to know if I can turn on or off.I don't find this info Rob
Ratingi have winlogon.exe but it keep saying "error" and when i close the msg box it sudden goes to restart my computer, huh! what should i do? i need a site that has a copy of this file. I also found out that my winlogon.exe has an icon of moon and stars in the window image. I am totally suppecting that this is a virus. pls help me. [email protected]
RatingI'm not sure, But I think this program caused my computer to restart on its own... it messed up Issas.exe, at least I think it did. Also, is it meant to look like a window with a moon in the background? al1
Ratingshould be a normal process. John Smith
Ratingwhy does it use like 24 MB RAM? It varies but pretty often it does. Chris
RatingI know that the good winlogon DO NOT Try to log to the internet if your firewall tell you that it try to connect to the net well you are infected me
Ratingwell I donot no much about this But it keeps poping up sridhar
Ratingcreate a backup of the winlogon.exe that is already in the system32 just in case but if it aint 420 KB without updating windows then it gonna take your computer down, after updating with sp1 and sp2 the size might change as at this time i have no idea Blue Wolf
Ratinga virus cws.yexe can made this file this virus is not danger but very claver i changes the default site in ie explorer so be carefull this could be a virus
Ratingmy computer is running slower than ever Stace
Ratingi know nothing about it, but my system has been going fine and Norton hasnt found anything so 0 i say its a go! Jessie
RatingI get a fatal error if I try to quarantine this file. DON'T try to remove it! [email protected]
Ratingslick little process gets added to the HKLM\...\run\ registry. It appears to coexist with the real executable in the system32 directory. It really has a different name that is not displayed. If you try to winzip the file it is displayed as w?nlogon.exe. delete this file if it you experience this and the creation date is recent. Do not delete the real WINLOGON.EXE. Derek
RatingIt made my computer go crazy it was 51,000 in mem usage justin
RatingI found winlogon in HLKEY/Run other than the true winlogon of windows, and when i copy and paste its name in wordpad, the name was : w?nlogon.exe, i found that because a hacker was slealing all my yahoo and hotmail passwords, even all my personal information. it is a very dangerous virus, so try to localise it and delete it, ps: when u search by windows, u cant find it, and when u do alt+ctrl+del u will see wVnlogon in the task manager window Zak
RatingThis is also used by the TIBS virus bastards! which case it will be located in a subdirectory "inetsrv" and is much smaller than the 500 KB os version.. Very hard to kill because windows thinks you are trying to kill the "real" one. Try a safe boot and edit all occurrences of "inetsrv" from the registry!
Ratingi had to copy the file from one of my friend computer to my cpu .... then it worked Sunny
RatingIts a windows proccess, but can killyour machine in a matter of months if viruses or trojans attach to it Chris
RatingIt checks your product id an activation key but it's a kind of "legal" spyware. Emil
RatingAfter the end of the boot, keep 100% CPU during 1 mn. PS
Ratingwenn ich sie löschen will fahrt mein PC heruter
RatingWINLOGON is the windows compenent, winlogin.exe is not. The below link is what I used to fix firewall caught it trying to connect to the internet, if it cant it seems harmless. A well problem solved for me.  link for more info Pat
RatingMy machine also has an instance of WINLOGON.exe (yes in capitals in C:\I386) and as winlogon.exe in C:\WINDOWS\SYSTEM32\DLLCACHE and in C:\WINDOWS\ServicePackFiles\i386. Mark Johnson
RatingI have winlogon.exe in 6 files WinSys32, ServicePack files, and 4 Software Distributions. Why ? Pearson
RatingThis thing may or may not be the real deal, since on my machine, it shows up as file location \??\C:\WINDOWS\system32\winlogon.exe. When I "Remove" the app, the whole computer just shuts off, and I get a BSD (Blue Screen of Death). This is very odd on a Windows XP machine. In fact this may be the first BSD I have ever seen on XP! Craig
RatingIt doesn't hang anything when I remove process. Tim
RatingIn Windows XP it checks to make sure that you have activated your Windows Operating System. Some people have hacked this file to avoid the activation. A modified winlogon.exe file will not lock you out and won't even remind you that you need to activate Windows. ZZ
RatingIf U find it in system32 directory, save. if not, it's virus!
RatingAll I know is that right after I installed SP2, and followed the reboot prompt, I lost this exe file, and received an error saying that I had an entry point proble. I could not get into my notebook rey
Ratingto many people confuse this with the winlogon.exe, it has a capital i in the name to look like an I. Its very persistant it isnt picked up with adaware or antivirus software. It cant be disabled via msconfig. I had to go into safemode delete the exe then remove it out of the registry and it was all over the show in there. Drefsab
RatingWinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone. Scorpio
RatingLook for sign (click on this process look downwindow (Anti-Spy.Info) Properties Microsoft signed file). If its signed - its normal winlogon Name
RatingSome Parasite or something Sokhunthea
RatingAll i know about winlogin.exe is that though it is system file but if u do improper shutdown a few times, whenever you try to open an internet application it will shutdown the computer without user input Rajesh Pillai
RatingJust noticed on my machine that the process running is 'WINLOG0N.EXE' (Note the second 'O' is actually a '0') Sure that it's malicious, so now have to find what it is (Symantec antivirus corporate has not picked up on it !!) Colin
RatingNorton Internet Security 2005 -- reports ?
Ratingit was hogging resorces so i deleted it with kill box now the computer won't reboot tryed replacing it with another copy but still won't boot Job
Ratingwindows logon.exe always encouter a problem on my pc and needs to close resulting in restarting of the pc i can't understand i think it is dangerous leyade
Ratingi lend a pal my pc to seek something but it he looked for a stupid no cd patch for a game the problem is one of the sites infected my winlogon.exe and my win32.dll with some subroutines that makes the data choose some stupid commercials on web isnt there a way to remove this part in the data file? ekei
Ratingthis file is located in the C:\windows\system32\ folder in winxp pro..... it took me about 40-45 sec to load windows everytime i click on my account...also my computer was not shuttin down for 1hr ! i'm very disappointed with windows xp....i even updated my windows...still gettin this problem A B
If you know more about winlogon.exe, so post it here.
Your opinion:
Your info
about that file:
Website with further details:
Your Name:

Search Results for winlogon.exe in

Other files

alg.exe dllhost.exe explorer.exe mdm.exe mstask.exe rundll32.exe svchost.exe winlogon.exe winmgmt.exe wmiprvse.exe wscntfy.exe wuauclt.exe [all]
© Anti-Spy.Info