| All comments about winlogon.exe: |
 Alex | The Windows Logon Process is responsible for managing user logon and logoff, and checks the Windows XP activation code. Must be in system32 folder! See also: Link |
| Diksa | il permet d'ouvrir et fermer les sessions windows it permit to open and close session of windows |
| SvanUden | Windows Logon Process |
 David | It check registratin code and user settings so it seems ok, but some hacks can change and than it owns about 100 MB of your memory and kills your operation system |
 Michael Thorpe | My dial-up internet service was going crazy before I used "End task" to shut it down. The file creation date was only two days ago. A new registry entry HKLM\Software\...\Run was "ICQ Net C:\WINDOWS\winlogon.exe -stealth". I have never installed ICQ on this machine (win98SE, IE5.5SP2). I deleted the registry entry and the file from the c:\windows dir. No Problems. |
| | windows logon process |
| Robert | Basic system process of XP/2000 of logging into the system itself, monitoring users and so on. |
 Nathan | This is the Windows NT logon utility that manages user logons and logoffs. The utility prompts you for the password when you log on and allows you to log off or shut down. It also keeps track of your computer's license(s) if you are using Windows XP. |
| DataFighter | Anmeldedienst von Windows. Aber nicht nur das. Bauen sie im Ihrem Rechner eine neue interne Hardwarekomponente ein, wird die WINLOGON.EXE dieses feststellen und , wenn Windows XP schon mal aktiviert war, dieses rückgängig machen. Sie dürfen bei Microsoft anrufen, und Ihre XP-Version erneut aktivieren. |
| Capi | As said by others, this process is responsible for managing user logon and logoff, both in Windows 2000 and Windows XP. It is perfectly normal and safe, AS LONG ASIT'S IN THE SYSTEM32 FOLDER! If it's running from anywhere else, it's a FAKE - some malware often names itself as a trusted program, only in another directory. |
| Martin Polder | W32/Backdoor-CFB |
 | There is a trojan variant of Backdoor.Padador that hides unser the name winIogon.exe(that is really winiogon.exe, the 'i' is capitalized) i believe this is really a '5" rating if it goes unnoticed, it steals all kinds of cd keys and other private information. |
 Jodahs | I had 2 winlogon.exe open (so it says the taskmanager), the original was "winlogon.exe" the bad file is list with "WinIogon.exe" (big i not L). I found it in Windowsdirectorie |
| Pako | Chek it out Captain Mnemo Pro is running under the same name winlogon.exe |
| John D | I have seen one instance where winlogin.exe (as opposed to winlogon.exe) keeps getting re-entered in the HKLM\...\run\ regkey. As far as I can tell, winlogon.exe is good, winlogin.exe is bad. |
| Twb | It is not more dangerous then Windows it self, and on most pc you need this file |
| mike | it seems to be a backdoor hack of some sort, the windows process is all caps, the virus is lowercase. |
| Louis Cyphre | Dont kill this process!!! or your pc will hang. |
| Jaeboy | Part of WinNT applications. Created by Microsoft Windows, this file is safe and protected by windows system file protection. |
| MaTT | dangerous if found in C:\windows inetg. Hard to remove |
| Rahul | Even though it is neutral,it can be made to do dangerous things |
| Eduardo | It seems activate Netbios conexion |
| John M | There is a file that hides it's self as WinIogon and you must delete this in the WINDOWS Dir not the SYSTEM 32 dir if you are infeced |
| Ben | This is a standard for NT machines , can be found in NT/2000/XP but not in windows 98/95/ME, however from what i have experieneced is that there is a Virus CLONE of this and obviously needs to be gone, if you are using 95/98/me and there is a winlogon.exe (or similar) then kill it, you dont need it, NT/2000/XP users will have to look closely at the filename if its Winlogon.exe then its ok if its WinIogon.exe (with Capital i) kill it, or if its Winlogin.exe (notice the change from logon to login) then kill it. but do use extreme caution as you could lock yourself out,if you delete the wrong one |
| | Its a Windows file. Some virusses use its name. But they are cheap imitations. Viruswriters=Cant code :) |
| pinewood zon | On XP(sp1), You cannot delete C:\Program Files\Movie Maker\*.* or C:\Program Files\NetMeeting\*.* due to winlogon.exe. if some of these files be deleted, winlogon detects the deleting and restore that files. Microsoft never tells about this. |
| Dennis M | Extreamly harmless task. |
| Shaun from CSC | WinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone |
| Rob | I´d like to know if I can turn on or off.I don´t find this info |
| clever_yong@yahoo.com | i have winlogon.exe but it keep saying "error" and when i close the msg box it sudden goes to restart my computer, huh! what should i do? i need a site that has a copy of this file. I also found out that my winlogon.exe has an icon of moon and stars in the window image. I am totally suppecting that this is a virus. pls help me. |
| al1 | I'm not sure, But I think this program caused my computer to restart on its own... it messed up Issas.exe, at least I think it did. Also, is it meant to look like a window with a moon in the background? |
| John Smith | should be a normal process. |
| Chris | why does it use like 24 MB RAM? It varies but pretty often it does. |
| me | I know that the good winlogon DO NOT Try to log to the internet if your firewall tell you that it try to connect to the net well you are infected |
| sridhar | well I donot no much about this But it keeps poping up |
| Blue Wolf | create a backup of the winlogon.exe that is already in the system32 just in case but if it aint 420 KB without updating windows then it gonna take your computer down, after updating with sp1 and sp2 the size might change as at this time i have no idea |
| | a virus cws.yexe can made this file this virus is not danger but very claver i changes the default site in ie explorer so be carefull this could be a virus |
| Stace | my computer is running slower than ever |
| Jessie | i know nothing about it, but my system has been going fine and Norton hasnt found anything so 0 i say its a go! |
| dcalin@dynamicintl.com | I get a fatal error if I try to quarantine this file. DON'T try to remove it! |
| Derek | slick little process gets added to the HKLM\...\run\ registry. It appears to coexist with the real executable in the system32 directory. It really has a different name that is not displayed. If you try to winzip the file it is displayed as w?nlogon.exe. delete this file if it you experience this and the creation date is recent. Do not delete the real WINLOGON.EXE. |
| justin | It made my computer go crazy it was 51,000 in mem usage |
| Zak | I found winlogon in HLKEY/Run other than the true winlogon of windows, and when i copy and paste its name in wordpad, the name was : w?nlogon.exe, i found that because a hacker was slealing all my yahoo and hotmail passwords, even all my personal information. it is a very dangerous virus, so try to localise it and delete it, ps: when u search by windows, u cant find it, and when u do alt+ctrl+del u will see wVnlogon in the task manager window |
| | This is also used by the TIBS virus bastards!...in which case it will be located in a subdirectory "inetsrv" and is much smaller than the 500 KB os version.. Very hard to kill because windows thinks you are trying to kill the "real" one. Try a safe boot and edit all occurrences of "inetsrv" from the registry! |
| Sunny | i had to copy the file from one of my friend computer to my cpu .... then it worked |
| Chris | Its a windows proccess, but can killyour machine in a matter of months if viruses or trojans attach to it |
| Emil | It checks your product id an activation key but it's a kind of "legal" spyware. |
| PS | After the end of the boot, keep 100% CPU during 1 mn. |
| | wenn ich sie löschen will fahrt mein PC heruter |
| Pat | WINLOGON is the windows compenent, winlogin.exe is not. The below link is what I used to fix it...my firewall caught it trying to connect to the internet, if it cant it seems harmless. A well problem solved for me. See also: Link |
| Mark Johnson | My machine also has an instance of WINLOGON.exe (yes in capitals in C:\I386) and as winlogon.exe in C:\WINDOWS\SYSTEM32\DLLCACHE and in C:\WINDOWS\ServicePackFiles\i386. |
| Pearson | I have winlogon.exe in 6 files WinSys32, ServicePack files, and 4 Software Distributions. Why ? |
| Craig | This thing may or may not be the real deal, since on my machine, it shows up as file location \??\C:\WINDOWS\system32\winlogon.exe. When I "Remove" the app, the whole computer just shuts off, and I get a BSD (Blue Screen of Death). This is very odd on a Windows XP machine. In fact this may be the first BSD I have ever seen on XP! |
| Tim | It doesn't hang anything when I remove process. |
| ZZ | In Windows XP it checks to make sure that you have activated your Windows Operating System. Some people have hacked this file to avoid the activation. A modified winlogon.exe file will not lock you out and won't even remind you that you need to activate Windows. |
| | If U find it in system32 directory, save. if not, it's virus! |
| rey | All I know is that right after I installed SP2, and followed the reboot prompt, I lost this exe file, and received an error saying that I had an entry point proble. I could not get into my notebook |
| Drefsab | to many people confuse this with the winlogon.exe, it has a capital i in the name to look like an I. Its very persistant it isnt picked up with adaware or antivirus software. It cant be disabled via msconfig. I had to go into safemode delete the exe then remove it out of the registry and it was all over the show in there. |
| Scorpio | WinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone. |
| Name | Look for sign (click on this process look downwindow (Security Task Manager) Properties Microsoft signed file). If its signed - its normal winlogon |
| Sokhunthea | Some Parasite or something |
| Rajesh Pillai | All i know about winlogin.exe is that though it is system file but if u do improper shutdown a few times, whenever you try to open an internet application it will shutdown the computer without user input |
| Colin | Just noticed on my machine that the process running is 'WINLOG0N.EXE' (Note the second 'O' is actually a '0') Sure that it's malicious, so now have to find what it is (Symantec antivirus corporate has not picked up on it !!) |
| ? | Norton Internet Security 2005 -- reports |
| Job | it was hogging resorces so i deleted it with kill box now the computer won't reboot tryed replacing it with another copy but still won't boot |
| leyade | windows logon.exe always encouter a problem on my pc and needs to close resulting in restarting of the pc i can't understand i think it is dangerous |
| ekei | i lend a pal my pc to seek something but it he looked for a stupid no cd patch for a game the problem is one of the sites infected my winlogon.exe and my win32.dll with some subroutines that makes the data choose some stupid commercials on web isnt there a way to remove this part in the data file? |
| A B | this file is located in the C:\windows\system32\ folder in winxp pro..... it took me about 40-45 sec to load windows everytime i click on my account...also my computer was not shuttin down for 1hr ! i'm very disappointed with windows xp....i even updated my windows...still gettin this problem |
| | it is a virus |
| roy masters | winlogon.exe is normal windows system32 file if you have another one spelled with capital i not a lower case L .you have trojan called backdoor armageddon.the hacker remotely controls your pc completely sees all your hard drive info & uses your pc as a proxy for evil deeds. delete it kill it get rid of it asap! |
| Keegan | Winlogon handles interface functions that are independent of authentication policy. It creates the desktops for the window station, implements time-out operations, and provides a set of support functions for the GINA. Some of you are calling it dangerous, it is no different from any other file, if is hijacked by a virus or other maliciuos program it will become hostile. All files are potentially vulnerable to this kind of attack. |
| Jordan | the file is winiogon.exe...it trys to get into the task manager but somethins blockin it...i dont know if this is a problem for my computer or not |
| cmatcme.zor.org | If it has a icon with a moon behind a window and it's in the system32 folder and it's written by the microsoft co-operation and it is being run by SYSTEM |
| Jaffe | It is not virus itself, but i some viruses esim I-worm.netsky.Q can get to it, if that happens use www.f-secure.com, http://www.f-secure.fi/v-kuvaus/netsky_d.shtml |
| redmug100 | It has appeared in my window 98 se windows folder. its also in my msconfig startup menu and unticking the box makes no difference . Its impossible to delete or even change attributes due to Windows believing that its a system file. |
| unknown | i tryed a system restore but half way through the pc came up with a message and it said that the logon ui had been deleted i let finish and when i tryed to turnon the computer again its stuck in a cycle of booting up and then closing dow again what can i do? |
| Christopher | The winIogon (Capital i) I found in the task manager under running processes kept my Aunt's PC from connecting to the internet. I just ended it's process in the task manager, then used search to find it in the windows/system32 folder. I then deleted it and used regedit to find any refrences to it in the registry. DO BE CAREFULL not to delete the wrong one. My Aunt is now back on the internet. I don't know if it's a virus or trojen, but she's back on the net. |
| William | sometimes it is a trojan kreeper G but nots if its in the right folder |
| Dave | Right now I have this file. Notice the difference between winlogon and winiogon the i capitalized (which it is) looks like l and can fool many users into thinking that it is the winlogon.exe file. This acts just like any other type of backdoor trojan file. If you have this you should try and remove it right away... But make sure you DO NOT delete your winlogon.exe file. Just the winiogon.exe file. |
| Hotchili | Very hard to delete, there is a bad variant out there that is not the Windows app. I finally got ccleaner to remove it, but now I get an error that it can't be found at login. Probably a Registry entry that needs removing still. |
| delphidoc | Appears on server and workstations in my SBS 2003 domain. I assume it run stand-alone or in a workgroup as well. Cannot kill WinLogon with Services.msc or Task Manager. Killing process with Security Task Manager = BSOD. |
| Xaque | The program "KGB Keylogger" disguises itself as winlogon.exe. This is not a virus per se, instead it is usually installed by system administrators who want to keep tabs on the system |
| james | well everytime i try and run yahoo says ypager error now my winlogon file creates an error says to disable my cache and i get a blue screen |
| Jamie McGlynn | It is used by the operating system for logging on, this process cannot be ended, doing so may cause evere system instability. |
| Robert Gelki | Need it for ms windows Xp startup and lookup process. If u block this u will crash windows Xp pro service pack 2 |
| someone | it uses almost all my CPU power, but not allways, still don't konow why. (my processor is athlon 3000+ ) |
| | This file is in \??\C:\\WINDOWS\System32\winlogon.exe so what does that mean. Good or bad? |
| vijay | It slows down my computer, especially when I'm on the internet. |
| Buster | This is a backdoor, trojan file. |
| Yihao | Its totally harmless. |
| JC | Its slowed down my PC so it is running my processor at 100% all the time, if i am not connected to the net when i start i dont have the problem. i cannot close it using task manager and i cannot lower its priorty. Its splet WINLOGON.exe (yes all in caps) and is found in my system32 folder. I have yet to find a way that will remove it, Anti-virus doesnt work, the netsky removal doesnt, s_t_i_n_g_e_r f doesnt, AD-aware doesnt. |
| Greg | WINLOGON.EXE has been mutated into a virus on my machine. It is trying to contact CNCGROUP in China. None of the virus detection programs are detecting it. I am using Process Explorer to see user processes inside this program. |
| Wolfy | This is the worst thing I have ever gotten. I have no idea of how to fix it. I heard some talk about there being 2 winlogons in the task manager but I only got one yet it's the virus one. It takes up atleast 50% of all capacity of the computer so I can't play any major game and the computer is so slow. It just pisses me off. I do not understand how I could have gotten this thing. I just completely formatted my computer only 2 days ago. |
| Robin | me system haves 100% CPU @ winlogon.exe |
| Caue Rego | Mine is for sure, at very least, infected with some kind of threat. My GoogleDS found one "file copy" at D:\temp\ext54382 winFS can't see it. It is lowercase WINLOGON.EXE, no fake L or any other letter. I believe it might be really dangerous, but so far I got almost no harm from it, as long as I keep WinXP installation discs inside the drive so Windows File Protection can take care of it. It also affected my Windows Update. See also: Link |
| Vinit Jain | winlogon.exe is a system file that helps in authenticating users using GINA and also implements security |
| Dr. Alaister Woong Chung Kioyo | is a transferial system file, known best as morfolog.exe See also: Link |
| XBangittyX | It is neccessary to LOG ON to WINdows. Many viruses, or other malware, use the names of critical windows processes such as this to effectively camouflage their prescence. Note* Viruses do the same for other critical windows processes, so be sure that you know which one you are looking at by double checking file sizes and other identifying details. |
| derek | the one in sytem 32 is legit. i have another in c\i386(xp home edition) not sure about this one |
| devnullius | it's a default file, but... after running a serial generator from the p2p-world; I suddenly have a 2003 Server PC that keeps BEEPing :( Also I noticed (after installing STM) a running process in \??\D:\\windows\system32\winLogOn.exe (without captials:). Unkillable, stuck for now :/ |
| Ted | Okay, the process winlogon.exe is running at 100 cpu. I did a search and found winlogon.exe in the System32 folder, and ServicePackFiles\i386. Is the file in the ServicePackFiles folder legit? It says that they were both created last year, but I have never had this process running at 100% like this before. |
| | Can you help me, people say that all these treats and some people say that it is essential for your computer. Is it dangerous or not. How do you know it is a virus/trojan/worm/malware/trackware/adware or spyware? My virus detectors never detect any of these threats. |
| Sug | mine reads C:\windows\winlogon.exe i dunno if that is how its suppose to look |
| M.TALHA | many viruses use the same name to hide them self |
| Bertus | Used for Spam distribution |
| Somone who knows | Don't bother with all the whiners.. Simple: Winlogon.exe , clean ( Aslong as it's run by SYSTEM. Can be ghosted as $user or $local ! ) Any other variant like Winiogon ( WinIogon ), WINLOG0N or similiar $system or not is a virus/trojan. |
| sina | winlogon.exe (or winiogon.exe) is using up all 99% of CPU and has extremely slowed down my laptop (haven't yet been able to open a normal my computer window!!!), cannot terminate it cause it's a "critical system process"... it's the same even in Safe Mode...? |
| Madame Arsenic | This file is originally used for logging on to Windows, but certain Trojans turn this program into a worm program, constantly trying to email random domains. The only remedy I can think of is reinstalling Windows. |
| Robert Gelki | \??\C:\\WINDOWS\System32\winlogon.exe is harmless but can be infected also with virus. If u turn winlogon.exe off and your copy of windows xp is illegal your comp should crash into bluescreen. If your copy of win xp is legal it nothing happends with your comp |
| Ashok Srivastav | Actually I want to prevent users from loading windows in windows 98.After submitting his/her credentials then only windows should be loaded. |
| Dave | Its totally harmless. |
| Gary | This got into my computer with some malware called Spy Falcon 2.0. I can only run my computer in Safe Mode. In normal mode, I see "WINLOGON.EXE encountered a problem and has to close." Two minutes after start-up, the computer crashes and I get the Blue Sreen of Death c000021a Fatal System Error. |
| Le Nguyen Khoa | It make up more than 90% CPU |
| Sam Morris | The actual file is normally harmless, but various spyware items can cause it to use high CPU and/or memory usage. In my case both. |
| jay | spy sweeper says it tries to install bho's so i dont trust is one bit |
| Nutamu | It appeared in taskmanager and i though nothing of it until my ad-aware picked up something then the comptuer went black. I looked around online to fix the problem and found this. i don't know enough about computers to fix this on my own. I have no clue what to do now. |
| some2 | If you want, you can block its internet access with firewall (Sygate Personal Firewall or some else...) |
| Funnyzombies | It slows my computor down A LOT when i'm surfing the web The winlOgon file is a backdoor trojan file. Do not delete the winlogon.exe file. The worm is the winlogOn.exe |
| nerb | mit dem internet verbunden löst die datei einen kritischen fehler aus, der den computer überlastet und zum absturz führt. |
| leex | Anmeldedienst von Windows.Original Dateigröße 495kb(mit updates)!Installierst du neu Hard oder software , erkennt die WINLOGON.EXE dies und regiestriet die neu komponete!!Winlogon.exe überprüft die regiestrienrung bei Microsoft!!Winlogon.exe kann aber auch böse inhalte enthalten, viele backdoor programme tarnen die server datei als winlogon.exe(häufig wird auch winlogin.exe gewählt)!! Jeder rechner der hinter eine Firewall sitzt und eine AntiVirensoftware besitzt ist 99%ig sicher!! Und kann sich eigentlich nicht mit einer Falschen Winlogon.exe anfreunden!!! cu leex |
| la | it shuts down my computer automatically.. |
| SUparJErk | Often times adware / spyware software (usually advertising / popups) will attach themselves to this process somehow to deliver annoying popup ads all the time. If you boot your computer in safe mode and you are still experiencing popups, chances are the malicious software attached itself to winlogon.exe |
| gavin | mine sometimes hogs up to 500Mb memory, no idea why. |
| Mr.X | Is it supposed to take 20-30mb of memory? |
| jc | occupies 99 percent of CPU resources thereby making the computer virtually unusable. Cannot terminate this process because windows thinks it is an important system file. Trying to find and kill the troublesome file is very difficult. |
| Dee | Seems this is quite an annoying Trojan when it's not in the System32 folder. Mine was in a folder called C:\WINDOWS\inet20010\win~ Run Prevx1 (free download) to get rid of it. Then click "Start" "Run" type "msconfig" "ok" Under the Startup tab look for winlongon. Make suer it's not in the System32 location, remove the tick, "apply", "ok" and then restart your computer. This will stop the registry from looking for the deleted file |
| Mike | you need this file, the trojan file causing problems is called winslogin.exe. almost similiar to this file. if you find winslogin.exe in your system32 folder, DELETE IMMEDIATELY! |
| | Die datei hat sich bei mir erst bemerkbar gemacht, als ich eine Trojanermeldung von AntiVir bekommen habe! Löschen kann man sie aber offenbar nicht! |
| Jello | WinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone. |
| spank money | it is used to logon and to allow people from space to look at your computer man |
| PC expert | To clear this up once and for all. This file is part of the windows operating system and is required for normal logon/logoff function. On systems not regularly security updated it is also funerable to both w32.netsky and backdoor prorat trojans amongst others. If these viruses attach themselves to the file, then it becomes a threat. The genuine winlogon.exe resides in system32 folder, and also in service pack uninstall files, so any other place is a virus, BUT it can also be a virus in system32 folder if trojan has attached itself to it. |
| Vincent lamar | Keine Probleme, auch wenn Winlogon abgestürtzt ist. Wenn dies allerdings mehrere male passiert fehlen Dateien...... |
| SwodeG | Removed my desktop picture and made my Comp LAGG, due to it's CONSTANT reloading, real pain in the ass. Thx to all for help removing it. I hope this site helps other in need. |
| Thomas | well i got zone alarm pro and i cant even have it display alerts while logged onto the net or ill get bombarded with access attemps from windows ny logon application, and if i alow it i get massive popups, no idea how i got it, no idea how to get rid of it, had it since day after christmas and its feb 1st... cant tell if says winlogon.exe or winIogon.exe, but processed wont terminate it.. also in the system32 folder should it have a picture for its icon or regular app look |
| Manu | If this data is right used like in w32blast ,it might be dangerous...now i'm trying to make a easy shutdown -a funktion so that the user easily can help himself. |
| Gerard | It is to start up and shut down your computer. Sometimes a trojan horse use this process to shut down your computer. Don´t kill the process but search your computer for files with the name winlogon.exe and delete the one which is infected. |
| ConFusion | This file (winlogon.exe) is as many before me have said: just a part of the OS that is made for handling loging on and off the computer. but there are a Trojan mimmic file out the that can be dangerous... if your firewall og Virus program is reporting that this file have been stopt from starting up that only means that you need to make a exception for this file so that it can run normal again. The point is that you don't really know if it's the dangerous one ore not before... I would recomend these Prog's: Registry Mechanic, Xoftspy and Panda Titanium 2006 plus |
| Archmage | It is confusing because Winlogon.exe is also a windows component. The way to determine if it is a virus or not is to see the properties. If it has no description it is not from microsoft. See also: Link |
| An Irrate C++ Developer | WinLogon on my Windows 2003 Server System currently runs at 50% of the CPU but I dont know the reason I dont think that it is a virus though, just some sloppy coding from our good friends at Microsoft |
| | this file seems pretty harmless, and for me it is in the system32 folder, but just a few days ago it spiked to using 10% of the cpu. anyone tell me why? |
| mr. Y | my C:\WINDOWS\system32\winlogon.exe (it's the only one winlogon.exe on my system) tries to connect to various ip addresses or sites like: custblock.intercage.com I had to block it with my firewall but i got no idea whether its safe or modified. Its size is 485 888 bytes. Help! |
| Timmey | Bei Windows 98 SE gilt diese Datei als Virus. Sie nennt sich winlogon.exe und ist in der Win.ini und System.ini eingetragen. Man diese Datei mit einem Virenscanner löschen, oder manuell entfernen. Anschließend müssen allerdings die Eintrage zum Ausführen der Datei in den genannten .ini-Dateien gelöscht werden. |
| Alex | This file is used by some spyware programs to launch their dll files when winlogon.exe is launched. Since you cannot run in any mode of Windows without winlogon.exe running it prevents the dll file from being removed. The simplest way to remove the offending dll file is to boot from the Windows XP cd and go into Recovery Console. Go to the system32 folder and do dir *.dll. Write down all of the dll files that have been recently created on your system then delete or rename them. It helps if you have a program like autoruns.exe which can check for you which dll files are linked to winlogon.exe. |
| David | now this file (winlogon.exe in system32 and same as winxpcd one) is sending a lot smtp mail |
| nate | I don't think it does anything good for protection. It won't even allow me to use adaware se to stop some pop ups. |
| Maur | This process manages security-related interactions, such as logon and logoff requests, locking or unlocking the machine, changing the password, and the remote registry service. Do NOT delete or remove from process list. |
| | i get a (NIPS) intrusion Alert popup from it about every hour i get 3 attempts at the same time really annoying i dont know if its a false positive or something trying to remote access it |
| | Delete all of this file but the one in system32 |
| Kbelo | Vai a puta q pariu, ta dando vírus por causa dessa merda de programa, a Microsfot ta muito ruim, vai mesmo vende cana de açúcar otário!!! |
| J | I know nothing. Just got an error today. Came to this website and was surprised to find that it is a harmfull file. I checked my filesystem and there are 4 locations where it was found: 1. winlogon under c:\windows\system32 . 2: WINLOGON.exe under c:\ADI\NT4SP3\i386 3:winlogon.exe under c:\windows\ServicePackFiles\i386 and 4: winlogon.exe under c:\windows\SoftwareDistribution\Download\453a5dd959bf8c3148eb54e4e1aff1d8\sp1qfe |
| Onmarag | It is the Windows' logon program. It's ESSENTIAL for your computer to run WinXP. It has to run the whole session because you also use your logininfo during the session and with logging of. It's harmless, but very powerful. |
| TheGMan | Win 2k User, Try this MS Update. Did it for me. WINLOGON.EXE all uppercase running in Task manager. 4 Copies of it in a search. Slow as a B***CH on startup. WINLOGON.EXE main drain, first 2 mins or so, Ran Virus cleaners etc. This Did the job!! See also: Link |
| JohnR | I am also showing the file link to be \??\D:\\WINDOWS\system32\winlogon.exe with a Name called Process ID 1900. Depending on when I look at this the Process ID tends to be different. This stopped showing up for a while in Security Task Manager then just recently came back. This does not look normal at all. |
| eric | "winlogon.exe has generated errors and needs to close" or something like that and then bluescreen in winNT WTF. |
| Hexxeh | The file is a virus or trojan imitating a legit Windows file. Make sure that is the one with the suspicious name that you delete. |
| Blizer | I set my firewall on high security. It ask for me to acceptor deny winlogon.exe. The icon for this program is a moon behind a window. So this means its a trojan? |
| | it crashed my pc also it puts some changes on registry and hides folder options what shall i do in addition it restracted the access to regestry editor |
| | look for a file called vcodec and delete it its a trojan |
| keith | Seems to be part of vcodec ,spy axe ,spy falcon problem. |
| bil | Recently installed ntl netguard antivirus software. When it is running in real-time virus checking winlogon.exe runs at 100% cpu. Great, an antivirus product that stops all viruses by not giving them cpu time. Amazing. Just deinstalled. |
| Vinny | FACT: Winlogon can be used to start adware and viruses, run hijack this and it will show you the items being started. Very few programs should be started in this way. I just removed 2 items from a corporate pc at my company. Something was attached to the winlogon process and norton email scanner kept popping up and saying email with subject "viagra" could not be sent. Had to use killbox to kill and remove the processes. |
| Chloe-Jane McCartney | My computer constantly brought up this "Click to end task" and when I clicked it, it reset itself my e-mail didn't want to open and the repair expert said it installed 53 Spyware types inside the PC |
| the expert | this is only a problem if it not a system 32 file, if it is sys32 leave it alone, it is necessary for windows to work, if not system 32, try any of the well known anti-spyware programs to remove!!! |
| Alex | normally, just a stupid windows process that assists in logging in/out of windows. should not be disabled or removed. if it is not in the system32 it is very likely to be a resource-hogging, virus/spyware, and should be removed from only the suspiscious location. |
| Mr. Snrub | Having gaming issues - noticed winlogon.exe is using 20-50% cpu cycles occaisionally. Watching my work computer (which is squeaky clean) - and winlogon.exe. aint doing jack. Should this exe (the "real" exe in system32) ever utilized cpu cycles when not logging in or out? Should i consider cpu usage by this exe erratic/problematic? or is it normal? |
| L Murphy (MCSE) | This file is a natural process. If you cannot end the process from Task Manager then it is winlogon.exe you are trying to end. The application does have an icon (arched window with night sky and a cresent moon outside), however, when viewed in Explorer it will probably just appear as a standard looking ".exe" file. You should not attempt to stop the winlogon.exe application (except for, as stated above, if it is located elsewhere than "C:\WINDOWS\System32"). Invariably windows' process manager will not allow you end the correct and harmless, real, version on the file, but will the fake. |
| Takai | Winlogon is the system logon process! it is not dangerous! See also: Link |
| Mesut Tekin | if it contain downloader virus. Virus file is g2550093.dll. |
| T | It is a part of Windows login system, but if you see two same processes named "winlogon.exe" under running process list in Windows task manager, one of them could be "Win32:Delf-BNM" trojan |
| Jamie | I just got this virus in my system. "WinLogon.exe is a component of the W32.Netsky.D@mm mass-mailing worm. The file arrives as an e-mail attachment. Once the computer is infected, the worm scans the hard drive for e-mail addresses and e-mails itself to all collected address using its own SMTP program. The worm may function as a backdoor, allowing remote intruders to secretly access the user’s computer." So it is extremely dangerous. remove it as soon as possible! See also: Link |
| ozan | I tried to delete this file once, because i thought it'd contained some virus; but i couldn't perform this action even in safe mode. but i could change its name in "safe mode with command line", but then that restart was the most tragedicomic time of my life; because of that tiny change, i lost my OS... DON'T DELETE THE \\??\\system32\winlogon.exe FILE OF YOUR O.S. TO AVOID A SYSTEM COLLAPSE. See also: Link |
| xBoom | It is an essential process for the Windows subsystem. If it's killed, your computer will hang/stuck. In Windows XP Pro SP2 it's home is the ONLY .\(WindowsFolder)\system32. It's perfectly safe unless your computer is not protected by Anti-Virus (AVG is a good one) programs and Anti-Spyware/Adware programs (Ad-aware and Spybot are the good ones). To the one who asked, winlogon should only take a maximum of 3MB of memory. |
| stu | it keeps causing the computer to crash and causes a 'fatal error' were the screen turns blue ans dhuts it self off, reboots and completes the process again. ive got no idea how to get rid of it! |
| Microsoft Service Technician "Metalica11" | winlogon.exe is the system process and needs to run. WINLOGON are viruses, also if your winlogon.exe process is running very high and is having major impact on your systems performance, you may have picked up a trojan or rootkit that has attached itself to the process. Lastly, if winlogon.exe or any of the variants are found outside of system32, they are viruses. Thank you |
| Jeff | All caps 'WINLOGON' in the sys32 dir is ok. Also, there are other files named 'winlogon.exe' on my Win2K machine in patch uninstall directories. My guess is that they are also harmless. |
| | Found it in C:\Program Files, double clicked it out of curiosity and all 3 of my antivirus's popped up. If it's not in system32, it's a virus. |
| IT Pro | it can be either good or bad. Many viruses and spyware applications use this name. You need to look at the location of the file, the Winlogon in (Windows Root)\system32 is the Winlogon that is the one you need. Any others need to be deleted. NOTE: The Windows Root is usually either "C:\WINDOWS" or "C:\WINNT" |
| Dave | This file is a ligit windows file, however, it is very suspectable to trojans. My current problem is windowsxp will not boot all the way trough and restarts after the blue error screen comes up. I have seen alot of very helpful advice in these posts however, not any that fit the restarting problem. I really dont want to reinstall windows, but Im not sure of any other fixers... I will explore the registry and see if I can locate any of the winlogon varients to delete.. please continue to post sucsesses on this page, and thank you to every one who has posted. |
| jhp | winlogon.exe (the normal one) suddenly started generating errors en masse, so I guess it has been infected. Avira Antivir say something about a Trojan called WLHack.A |
| ...lypô | Datei wird dringend benötigt. Das Problem sind darin enthaltene Viren, Trojaner! |
| Wacko | The winlogon.exe on my win2003 server some times grows up to 400MB in RAM memory, i search in microsoft web page and the solution say that i have to restart the computer 0_o and it realy sucks, does some know how to fix this problem? |
| Mac | I saw a bad product install winlogon.exe after using a keygen. My trojan detection application found the threat and removed it. However I now get a "winlogon.exe cannot be found" message after booting up. The original is still there in Program Files/sytem32. |
| nutella | well, okay, i've got the same problems like devnullius and SwodeG. Means , that my computer started beeping and it removed my desktop pictures... Can anyone help? |
| gord | I was dumb and downloaded a suspicious file knowingly, clicked on the icon after unzipping and code popped up and disappeared. ran spybot, it found it but couldn't fix it. I went to the C/windows folder where it was located now and deleted 3/5 of the files. the other 2 were "in use" so I couldn't kill them. None of my other programs could kill them either, now I have winlogon.exe in my end task menu. its high priority and it won't let me touch it. Even spybots, startup and run before windows is done loading, didn't work. The program must write itself to look like it is always running. |
| SiDDharTha | ok i have one thats windows NT logon app... i think it logs on at night for automatic updates |
| Shane | It is a process of WINDOWS VISTA that is needed. Unless found as C:\WINNT\winlogon.exe. It causes the computer to hang and not respond correctly with programs as well as hangs on shut down and start up. Sometimes will hide for days before it becomes active. Remove it if in the C:\WINNT Directory |
| porfi | my cd win xp in folder i386 shows the winlogon.exe file size 205 kb the c:\windows \system32\winlogon.exe has 422 kb why? |
| | It is a safe system file that manages logon rights. It is part of windows. |
| brandon | its completely harmless and ther rong its not a virus its just the log in screen when u start up ur computer -.- |
| Suzi | This program is required to log into Windows. Various viruses and trojans etc may mimic this file in order to create an entry in the Proccess, that looks geniune. |
| Hoba Phett | If you are running windows 9x there is a very large chance that the process is the virus version. spywbot S&D and AVG both took care of this for me. |
| Nick | It's a part of the Windows Login subsystem. But if it somewhere else then C:\Windows\System32 it might be a trojan. |
| Freeze | winlogon can be a part of a virus "WinlogonHack.A" tecnical name "W32/Patchlog.B" witch ataches itself to winlogon.exe in windows/system32 folder, See also: Link |
| .:.:.:. | i have deleted winlogon and my comupter shuts down itselves. you need winlogon! |
| Cyborg | When winlogon.exe is not in normal system32 folder it contains a version of the Trojan. Spbot.D (Norton AntiVirus). See also: Link |
| Wajdi Gary | i have a pc store, i sold about 3 pc's and i have this winlogon problem and i cant hide it because iam afraid if its system file |
| ... | I just read in the text in file of winlogon.exe that a remote user is trying to login, im sorry for him cause i disabled my remote settings and have zonealarm firewall to block him off. Newbie hacker tsk... |
| Bob Heinbokel | I have two of the same files, one is in system32 folder, and the other in the I386 folder. I don't really know if the I386 folder is a bad one though. They are exaclty the same, I'll go ahead and delete it anyways. |
| Gabe | I have winlogon.exe in two locations on Windows Server 2003, System32 and ServicePackFiles\i386 |
| | Windows Logon Application, ending it logs you out in Vista |
| Jeremy | It is how you login to the computer |
| MuToGeN | In most cases - a part of WinNT kernel (WinNT4.0, Win2K, WinXP). If You see more then 1 instance of this process or another a bit misspelled "winlogon" - congratulations, You are infected. |
| immortal | some .dll files are attached to it somehow one i found on my system was malware ...be sure to check your process |
| Mark Gonzales | the one in the system32 folder is harmless and is vital to windows, but the one in windows folder is a virus. try to look for it in your regedit and u will find out that it is acting like a MPEG file! responsible for the files Gwen(ISU) Zelur and sex video files that keeps coming back after u deleted it (IM SO MUCH POSITIVE BOUT THIS) |
| mike | don't delete the one in system32 other wise your computer won't start |
| | Logon to your'e CPU safe mode (press F8 at bootup) search for "winlogon.exe" delete all EXCEPT FOR THE ONE IN /SYSTEM32 FOLDER, clean up yore registry (run:regedit.exe) do a serach for winlogon, I killed them all except for the default value, I'm not sure that that was wise. I downloaded xisoft to avoid doing this manually, it's not worth 40 bucks, so I did it myself and sent to the software afterlife. The aftermath of this incident has left me with a dead anti/virus/spyware , Taking my nod32 and spyware doctor. The source of it all: a key generator for satlab, a little file under 1 mb of s |
| | First thing NOD32 found was winlogon.exe in Windows directory - botnet stuff I believe. |
| TS | winlogon.exe used on average 30-40% of my CPU resources. This occurred as soon as I installed PC Tools AV FREE Edition. Once I removed PC Tools my resource usage was back to normal. |
| alan | winlogon.exe located in HKLM is picked up by spyware doctor trying to access the registry. This is listed as a maliscious action. However when scanning for it it is not picked up. tricky one |
| Jens | This file as described on the top of the page is harmless thus I need to list it as 'not dangerous'. The many 'winlogon' variants can be anything from mostly harmless to the biggest bastard virus you will find (netsky related). I tried a variant that mcfee, norton, spybot and a couple of others found, but it was replaced at every reboot with some new variant. (tried every advice I could find about disabling system restore, clearing run entries in registry/startup, starting in safe mode, but every time even when the programs told the machine was clean it only lasted to restart). |
| Dave | i have 2 winlogons runnng, my computer will constantly try to launch IE over and over which hogs all the resorces, the file shows up in documents and settings/ local user/temp, i know it's not needed to run my system since it's not in the system32 folder, but i can't end task it either, going to try to boot in safe mode and delete it that way hopefully |
|
|
