What is winlogon.exe? Is winlogon.exe spyware or a virus?

How to fix winlogon.exe related problems?
1. Run Security Task Manager to check your winlogon process
2. Run Windows Repair Tool to repair winlogon.exe related Windows Errors
3. Run MalwareBytes to remove persistent malware

Process name: Windows Logon Application

Product: Windows

Company: Microsoft

File: winlogon.exe

Security Rating:

The process "winlogon.exe" runs in the background. Winlogon is a part of the Windows Login subsystem, and is necessary for user authorization and Windows activation checks. www.neuber.com/taskmanager/process/winlogon.exe.html 

Note: The winlogon.exe file is located in the folder C:\Windows\System32. In other cases, winlogon.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

Virus with same file name:
W32.Netsky.D - see McAfee Symantec Corporation Trend Micro

Click to Run a Free Scan for winlogon.exe related errors

Users Opinions

Average user rating of winlogon.exe: based on 334 votes. Read also the 284 reviews.

  • 21671 users ask for this file. 123 users rated it as not dangerous. 13 users rated it as not so dangerous. 58 users rated it as neutral. 33 users rated it as little bit dangerous. 107 users rated it as dangerous. 46 users didn't rate it ("don't know").

All comments about winlogon.exe:
The Windows Logon Process is responsible for managing user logon and logoff, and checks the Windows XP activation code. Must be in system32 folder!  See also: Link Alex
il permet d'ouvrir et fermer les sessions windows it permit to open and close session of windows Diksa
Windows Logon Process SvanUden
It check registratin code and user settings so it seems ok, but some hacks can change and than it owns about 100 MB of your memory and kills your operation system David
My dial-up internet service was going crazy before I used "End task" to shut it down. The file creation date was only two days ago. A new registry entry HKLM\Software\...\Run was "ICQ Net C:\WINDOWS\winlogon.exe -stealth". I have never installed ICQ on this machine (win98SE, IE5.5SP2). I deleted the registry entry and the file from the c:\windows dir. No Problems. Michael Thorpe
windows logon process
Basic system process of XP/2000 of logging into the system itself, monitoring users and so on. Robert
This is the Windows NT logon utility that manages user logons and logoffs. The utility prompts you for the password when you log on and allows you to log off or shut down. It also keeps track of your computer's license(s) if you are using Windows XP. Nathan
As said by others, this process is responsible for managing user logon and logoff, both in Windows 2000 and Windows XP. It is perfectly normal and safe, AS LONG ASIT'S IN THE SYSTEM32 FOLDER! If it's running from anywhere else, it's a FAKE - some malware often names itself as a trusted program, only in another directory. Capi
W32/Backdoor-CFB Martin Polder
There is a trojan variant of Backdoor.Padador that hides unser the name winIogon.exe(that is really winiogon.exe, the 'i' is capitalized) i believe this is really a '5" rating if it goes unnoticed, it steals all kinds of cd keys and other private information.
I had 2 winlogon.exe open (so it says the taskmanager), the original was "winlogon.exe" the bad file is list with "WinIogon.exe" (big i not L). I found it in Windowsdirectorie Jodahs
Chek it out Captain Mnemo Pro is running under the same name winlogon.exe Pako
I have seen one instance where winlogin.exe (as opposed to winlogon.exe) keeps getting re-entered in the HKLM\...\run\ regkey. As far as I can tell, winlogon.exe is good, winlogin.exe is bad. John D
It is not more dangerous then Windows it self, and on most pc you need this file Twb
it seems to be a backdoor hack of some sort, the windows process is all caps, the virus is lowercase. mike
Dont kill this process!!! or your pc will hang. Louis Cyphre
Part of WinNT applications. Created by Microsoft Windows, this file is safe and protected by windows system file protection. Jaeboy
dangerous if found in C:\windows inetg. Hard to remove MaTT
Even though it is neutral,it can be made to do dangerous things Rahul
It seems activate Netbios conexion Eduardo
There is a file that hides it's self as WinIogon and you must delete this in the WINDOWS Dir not the SYSTEM 32 dir if you are infeced John M
This is a standard for NT machines , can be found in NT/2000/XP but not in windows 98/95/ME, however from what i have experieneced is that there is a Virus CLONE of this and obviously needs to be gone, if you are using 95/98/me and there is a winlogon.exe (or similar) then kill it, you dont need it, NT/2000/XP users will have to look closely at the filename if its Winlogon.exe then its ok if its WinIogon.exe (with Capital i) kill it, or if its Winlogin.exe (notice the change from logon to login) then kill it. but do use extreme caution as you could lock yourself out,if you delete the wrong one Ben
Its a Windows file. Some virusses use its name. But they are cheap imitations. Viruswriters=Cant code :)
On XP(sp1), You cannot delete C:\Program Files\Movie Maker\*.* or C:\Program Files\NetMeeting\*.* due to winlogon.exe. if some of these files be deleted, winlogon detects the deleting and restore that files. Microsoft never tells about this. pinewood zon
Extreamly harmless task. Dennis M
WinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone Shaun from CSC
Iīd like to know if I can turn on or off.I donīt find this info Rob
i have winlogon.exe but it keep saying "error" and when i close the msg box it sudden goes to restart my computer, huh! what should i do? i need a site that has a copy of this file. I also found out that my winlogon.exe has an icon of moon and stars in the window image. I am totally suppecting that this is a virus. pls help me. clever_yong
I'm not sure, But I think this program caused my computer to restart on its own... it messed up Issas.exe, at least I think it did. Also, is it meant to look like a window with a moon in the background? al1
should be a normal process. John Smith
why does it use like 24 MB RAM? It varies but pretty often it does. Chris
I know that the good winlogon DO NOT Try to log to the internet if your firewall tell you that it try to connect to the net well you are infected me
well I donot no much about this But it keeps poping up sridhar
create a backup of the winlogon.exe that is already in the system32 just in case but if it aint 420 KB without updating windows then it gonna take your computer down, after updating with sp1 and sp2 the size might change as at this time i have no idea Blue Wolf
a virus cws.yexe can made this file this virus is not danger but very claver i changes the default site in ie explorer so be carefull this could be a virus
my computer is running slower than ever Stace
i know nothing about it, but my system has been going fine and Norton hasnt found anything so 0 i say its a go! Jessie
I get a fatal error if I try to quarantine this file. DON'T try to remove it! dcalin
slick little process gets added to the HKLM\...\run\ registry. It appears to coexist with the real executable in the system32 directory. It really has a different name that is not displayed. If you try to winzip the file it is displayed as w?nlogon.exe. delete this file if it you experience this and the creation date is recent. Do not delete the real WINLOGON.EXE. Derek
It made my computer go crazy it was 51,000 in mem usage justin
I found winlogon in HLKEY/Run other than the true winlogon of windows, and when i copy and paste its name in wordpad, the name was : w?nlogon.exe, i found that because a hacker was slealing all my yahoo and hotmail passwords, even all my personal information. it is a very dangerous virus, so try to localise it and delete it, ps: when u search by windows, u cant find it, and when u do alt+ctrl+del u will see wVnlogon in the task manager window Zak
This is also used by the TIBS virus bastards!...in which case it will be located in a subdirectory "inetsrv" and is much smaller than the 500 KB os version.. Very hard to kill because windows thinks you are trying to kill the "real" one. Try a safe boot and edit all occurrences of "inetsrv" from the registry!
i had to copy the file from one of my friend computer to my cpu .... then it worked Sunny
Its a windows proccess, but can killyour machine in a matter of months if viruses or trojans attach to it Chris
It checks your product id an activation key but it's a kind of "legal" spyware. Emil
After the end of the boot, keep 100% CPU during 1 mn. PS
WINLOGON is the windows compenent, winlogin.exe is not. The below link is what I used to fix it...my firewall caught it trying to connect to the internet, if it cant it seems harmless. A well problem solved for me.  See also: Link Pat
My machine also has an instance of WINLOGON.exe (yes in capitals in C:\I386) and as winlogon.exe in C:\WINDOWS\SYSTEM32\DLLCACHE and in C:\WINDOWS\ServicePackFiles\i386. Mark Johnson
I have winlogon.exe in 6 files WinSys32, ServicePack files, and 4 Software Distributions. Why ? Pearson
This thing may or may not be the real deal, since on my machine, it shows up as file location \??\C:\WINDOWS\system32\winlogon.exe. When I "Remove" the app, the whole computer just shuts off, and I get a BSD (Blue Screen of Death). This is very odd on a Windows XP machine. In fact this may be the first BSD I have ever seen on XP! Craig
It doesn't hang anything when I remove process. Tim
In Windows XP it checks to make sure that you have activated your Windows Operating System. Some people have hacked this file to avoid the activation. A modified winlogon.exe file will not lock you out and won't even remind you that you need to activate Windows. ZZ
If U find it in system32 directory, save. if not, it's virus!
All I know is that right after I installed SP2, and followed the reboot prompt, I lost this exe file, and received an error saying that I had an entry point proble. I could not get into my notebook rey
to many people confuse this with the winlogon.exe, it has a capital i in the name to look like an I. Its very persistant it isnt picked up with adaware or antivirus software. It cant be disabled via msconfig. I had to go into safemode delete the exe then remove it out of the registry and it was all over the show in there. Drefsab
WinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone. Scorpio
Look for sign (click on this process look downwindow (Security Task Manager) Properties Microsoft signed file). If its signed - its normal winlogon Name
Some Parasite or something Sokhunthea
All i know about winlogin.exe is that though it is system file but if u do improper shutdown a few times, whenever you try to open an internet application it will shutdown the computer without user input Rajesh Pillai
Just noticed on my machine that the process running is 'WINLOG0N.EXE' (Note the second 'O' is actually a '0') Sure that it's malicious, so now have to find what it is (Symantec antivirus corporate has not picked up on it !!) Colin
Norton Internet Security 2005 -- reports ?
it was hogging resorces so i deleted it with kill box now the computer won't reboot tryed replacing it with another copy but still won't boot Job
windows logon.exe always encouter a problem on my pc and needs to close resulting in restarting of the pc i can't understand i think it is dangerous leyade
i lend a pal my pc to seek something but it he looked for a stupid no cd patch for a game the problem is one of the sites infected my winlogon.exe and my win32.dll with some subroutines that makes the data choose some stupid commercials on web isnt there a way to remove this part in the data file? ekei
this file is located in the C:\windows\system32\ folder in winxp pro..... it took me about 40-45 sec to load windows everytime i click on my account...also my computer was not shuttin down for 1hr ! i'm very disappointed with windows xp....i even updated my windows...still gettin this problem A B
it is a virus
winlogon.exe is normal windows system32 file if you have another one spelled with capital i not a lower case L .you have trojan called backdoor armageddon.the hacker remotely controls your pc completely sees all your hard drive info & uses your pc as a proxy for evil deeds. delete it kill it get rid of it asap! roy masters
Winlogon handles interface functions that are independent of authentication policy. It creates the desktops for the window station, implements time-out operations, and provides a set of support functions for the GINA. Some of you are calling it dangerous, it is no different from any other file, if is hijacked by a virus or other maliciuos program it will become hostile. All files are potentially vulnerable to this kind of attack. Keegan
the file is winiogon.exe...it trys to get into the task manager but somethins blockin it...i dont know if this is a problem for my computer or not Jordan
If it has a icon with a moon behind a window and it's in the system32 folder and it's written by the microsoft co-operation and it is being run by SYSTEM cmatcme.zor.org
It is not virus itself, but i some viruses esim I-worm.netsky.Q can get to it, if that happens use www.f-secure.com, http://www.f-secure.fi/v-kuvaus/netsky_d.shtml Jaffe
It has appeared in my window 98 se windows folder. its also in my msconfig startup menu and unticking the box makes no difference . Its impossible to delete or even change attributes due to Windows believing that its a system file. redmug100
i tryed a system restore but half way through the pc came up with a message and it said that the logon ui had been deleted i let finish and when i tryed to turnon the computer again its stuck in a cycle of booting up and then closing dow again what can i do? unknown
The winIogon (Capital i) I found in the task manager under running processes kept my Aunt's PC from connecting to the internet. I just ended it's process in the task manager, then used search to find it in the windows/system32 folder. I then deleted it and used regedit to find any refrences to it in the registry. DO BE CAREFULL not to delete the wrong one. My Aunt is now back on the internet. I don't know if it's a virus or trojen, but she's back on the net. Christopher
sometimes it is a trojan kreeper G but nots if its in the right folder William
Right now I have this file. Notice the difference between winlogon and winiogon the i capitalized (which it is) looks like l and can fool many users into thinking that it is the winlogon.exe file. This acts just like any other type of backdoor trojan file. If you have this you should try and remove it right away... But make sure you DO NOT delete your winlogon.exe file. Just the winiogon.exe file. Dave
Very hard to delete, there is a bad variant out there that is not the Windows app. I finally got ccleaner to remove it, but now I get an error that it can't be found at login. Probably a Registry entry that needs removing still. Hotchili
Appears on server and workstations in my SBS 2003 domain. I assume it run stand-alone or in a workgroup as well. Cannot kill WinLogon with Services.msc or Task Manager. Killing process with Security Task Manager = BSOD. delphidoc
The program "KGB Keylogger" disguises itself as winlogon.exe. This is not a virus per se, instead it is usually installed by system administrators who want to keep tabs on the system Xaque
well everytime i try and run yahoo says ypager error now my winlogon file creates an error says to disable my cache and i get a blue screen james
It is used by the operating system for logging on, this process cannot be ended, doing so may cause evere system instability. Jamie McGlynn
Need it for ms windows Xp startup and lookup process. If u block this u will crash windows Xp pro service pack 2 Robert Gelki
it uses almost all my CPU power, but not allways, still don't konow why. (my processor is athlon 3000+ ) someone
This file is in \??\C:\\WINDOWS\System32\winlogon.exe so what does that mean. Good or bad?
It slows down my computer, especially when I'm on the internet. vijay
This is a backdoor, trojan file. Buster
Its totally harmless. Yihao
Its slowed down my PC so it is running my processor at 100% all the time, if i am not connected to the net when i start i dont have the problem. i cannot close it using task manager and i cannot lower its priorty. Its splet WINLOGON.exe (yes all in caps) and is found in my system32 folder. I have yet to find a way that will remove it, Anti-virus doesnt work, the netsky removal doesnt, s_t_i_n_g_e_r f doesnt, AD-aware doesnt. JC
WINLOGON.EXE has been mutated into a virus on my machine. It is trying to contact CNCGROUP in China. None of the virus detection programs are detecting it. I am using Process Explorer to see user processes inside this program. Greg
This is the worst thing I have ever gotten. I have no idea of how to fix it. I heard some talk about there being 2 winlogons in the task manager but I only got one yet it's the virus one. It takes up atleast 50% of all capacity of the computer so I can't play any major game and the computer is so slow. It just pisses me off. I do not understand how I could have gotten this thing. I just completely formatted my computer only 2 days ago. Wolfy
me system haves 100% CPU @ winlogon.exe Robin
Mine is for sure, at very least, infected with some kind of threat. My GoogleDS found one "file copy" at D:\temp\ext54382 winFS can't see it. It is lowercase WINLOGON.EXE, no fake L or any other letter. I believe it might be really dangerous, but so far I got almost no harm from it, as long as I keep WinXP installation discs inside the drive so Windows File Protection can take care of it. It also affected my Windows Update.  See also: Link Caue Rego
winlogon.exe is a system file that helps in authenticating users using GINA and also implements security Vinit Jain
It is neccessary to LOG ON to WINdows. Many viruses, or other malware, use the names of critical windows processes such as this to effectively camouflage their prescence. Note* Viruses do the same for other critical windows processes, so be sure that you know which one you are looking at by double checking file sizes and other identifying details. XBangittyX
the one in sytem 32 is legit. i have another in c\i386(xp home edition) not sure about this one derek
it's a default file, but... after running a serial generator from the p2p-world; I suddenly have a 2003 Server PC that keeps BEEPing :( Also I noticed (after installing STM) a running process in \??\D:\\windows\system32\winLogOn.exe (without captials:). Unkillable, stuck for now :/ devnullius
Okay, the process winlogon.exe is running at 100 cpu. I did a search and found winlogon.exe in the System32 folder, and ServicePackFiles\i386. Is the file in the ServicePackFiles folder legit? It says that they were both created last year, but I have never had this process running at 100% like this before. Ted
Can you help me, people say that all these treats and some people say that it is essential for your computer. Is it dangerous or not. How do you know it is a virus/trojan/worm/malware/trackware/adware or spyware? My virus detectors never detect any of these threats.
mine reads C:\windows\winlogon.exe i dunno if that is how its suppose to look Sug
many viruses use the same name to hide them self M.TALHA
Used for Spam distribution Bertus
Don't bother with all the whiners.. Simple: Winlogon.exe , clean ( Aslong as it's run by SYSTEM. Can be ghosted as $user or $local ! ) Any other variant like Winiogon ( WinIogon ), WINLOG0N or similiar $system or not is a virus/trojan. Somone who knows
winlogon.exe (or winiogon.exe) is using up all 99% of CPU and has extremely slowed down my laptop (haven't yet been able to open a normal my computer window!!!), cannot terminate it cause it's a "critical system process"... it's the same even in Safe Mode...? sina
This file is originally used for logging on to Windows, but certain Trojans turn this program into a worm program, constantly trying to email random domains. The only remedy I can think of is reinstalling Windows. Madame Arsenic
\??\C:\\WINDOWS\System32\winlogon.exe is harmless but can be infected also with virus. If u turn winlogon.exe off and your copy of windows xp is illegal your comp should crash into bluescreen. If your copy of win xp is legal it nothing happends with your comp Robert Gelki
Actually I want to prevent users from loading windows in windows 98.After submitting his/her credentials then only windows should be loaded. Ashok Srivastav
Its totally harmless. Dave
This got into my computer with some malware called Spy Falcon 2.0. I can only run my computer in Safe Mode. In normal mode, I see "WINLOGON.EXE encountered a problem and has to close." Two minutes after start-up, the computer crashes and I get the Blue Sreen of Death c000021a Fatal System Error. Gary
It make up more than 90% CPU Le Nguyen Khoa
The actual file is normally harmless, but various spyware items can cause it to use high CPU and/or memory usage. In my case both. Sam Morris
spy sweeper says it tries to install bho's so i dont trust is one bit jay
It appeared in taskmanager and i though nothing of it until my ad-aware picked up something then the comptuer went black. I looked around online to fix the problem and found this. i don't know enough about computers to fix this on my own. I have no clue what to do now. Nutamu
If you want, you can block its internet access with firewall (Sygate Personal Firewall or some else...) some2
It slows my computor down A LOT when i'm surfing the web The winlOgon file is a backdoor trojan file. Do not delete the winlogon.exe file. The worm is the winlogOn.exe Funnyzombies
it shuts down my computer automatically.. la
Often times adware / spyware software (usually advertising / popups) will attach themselves to this process somehow to deliver annoying popup ads all the time. If you boot your computer in safe mode and you are still experiencing popups, chances are the malicious software attached itself to winlogon.exe SUparJErk
mine sometimes hogs up to 500Mb memory, no idea why. gavin
Is it supposed to take 20-30mb of memory? Mr.X
occupies 99 percent of CPU resources thereby making the computer virtually unusable. Cannot terminate this process because windows thinks it is an important system file. Trying to find and kill the troublesome file is very difficult. jc
Seems this is quite an annoying Trojan when it's not in the System32 folder. Mine was in a folder called C:\WINDOWS\inet20010\win~ Run Prevx1 (free download) to get rid of it. Then click "Start" "Run" type "msconfig" "ok" Under the Startup tab look for winlongon. Make suer it's not in the System32 location, remove the tick, "apply", "ok" and then restart your computer. This will stop the registry from looking for the deleted file Dee
you need this file, the trojan file causing problems is called winslogin.exe. almost similiar to this file. if you find winslogin.exe in your system32 folder, DELETE IMMEDIATELY! Mike
WinLogon.exe is the Windows NT login manager. It handles the login and logout procedures on your system. This process is an essential part of your OS and should be left alone. Jello
it is used to logon and to allow people from space to look at your computer man spank money
To clear this up once and for all. This file is part of the windows operating system and is required for normal logon/logoff function. On systems not regularly security updated it is also funerable to both w32.netsky and backdoor prorat trojans amongst others. If these viruses attach themselves to the file, then it becomes a threat. The genuine winlogon.exe resides in system32 folder, and also in service pack uninstall files, so any other place is a virus, BUT it can also be a virus in system32 folder if trojan has attached itself to it. PC expert
Removed my desktop picture and made my Comp LAGG, due to it's CONSTANT reloading, real pain in the ass. Thx to all for help removing it. I hope this site helps other in need. SwodeG
well i got zone alarm pro and i cant even have it display alerts while logged onto the net or ill get bombarded with access attemps from windows ny logon application, and if i alow it i get massive popups, no idea how i got it, no idea how to get rid of it, had it since day after christmas and its feb 1st... cant tell if says winlogon.exe or winIogon.exe, but processed wont terminate it.. also in the system32 folder should it have a picture for its icon or regular app look Thomas
If this data is right used like in w32blast ,it might be dangerous...now i'm trying to make a easy shutdown -a funktion so that the user easily can help himself. Manu
It is to start up and shut down your computer. Sometimes a trojan horse use this process to shut down your computer. Donīt kill the process but search your computer for files with the name winlogon.exe and delete the one which is infected. Gerard
This file (winlogon.exe) is as many before me have said: just a part of the OS that is made for handling loging on and off the computer. but there are a Trojan mimmic file out the that can be dangerous... if your firewall og Virus program is reporting that this file have been stopt from starting up that only means that you need to make a exception for this file so that it can run normal again. The point is that you don't really know if it's the dangerous one ore not before... I would recomend these Prog's: Registry Mechanic, Xoftspy and Panda Titanium 2006 plus ConFusion
It is confusing because Winlogon.exe is also a windows component. The way to determine if it is a virus or not is to see the properties. If it has no description it is not from microsoft.  See also: Link Archmage
WinLogon on my Windows 2003 Server System currently runs at 50% of the CPU but I dont know the reason I dont think that it is a virus though, just some sloppy coding from our good friends at Microsoft An Irrate C++ Developer
this file seems pretty harmless, and for me it is in the system32 folder, but just a few days ago it spiked to using 10% of the cpu. anyone tell me why?
my C:\WINDOWS\system32\winlogon.exe (it's the only one winlogon.exe on my system) tries to connect to various ip addresses or sites like: custblock.intercage.com I had to block it with my firewall but i got no idea whether its safe or modified. Its size is 485 888 bytes. Help! mr. Y
This file is used by some spyware programs to launch their dll files when winlogon.exe is launched. Since you cannot run in any mode of Windows without winlogon.exe running it prevents the dll file from being removed. The simplest way to remove the offending dll file is to boot from the Windows XP cd and go into Recovery Console. Go to the system32 folder and do dir *.dll. Write down all of the dll files that have been recently created on your system then delete or rename them. It helps if you have a program like autoruns.exe which can check for you which dll files are linked to winlogon.exe. Alex
now this file (winlogon.exe in system32 and same as winxpcd one) is sending a lot smtp mail David
I don't think it does anything good for protection. It won't even allow me to use adaware se to stop some pop ups. nate
This process manages security-related interactions, such as logon and logoff requests, locking or unlocking the machine, changing the password, and the remote registry service. Do NOT delete or remove from process list. Maur
i get a (NIPS) intrusion Alert popup from it about every hour i get 3 attempts at the same time really annoying i dont know if its a false positive or something trying to remote access it
Delete all of this file but the one in system32
I know nothing. Just got an error today. Came to this website and was surprised to find that it is a harmfull file. I checked my filesystem and there are 4 locations where it was found: 1. winlogon under c:\windows\system32 . 2: WINLOGON.exe under c:\ADI\NT4SP3\i386 3:winlogon.exe under c:\windows\ServicePackFiles\i386 and 4: winlogon.exe under c:\windows\SoftwareDistribution\Download\453a5dd959bf8c3148eb54e4e1aff1d8\sp1qfe J
It is the Windows' logon program. It's ESSENTIAL for your computer to run WinXP. It has to run the whole session because you also use your logininfo during the session and with logging of. It's harmless, but very powerful. Onmarag
Win 2k User, Try this MS Update. Did it for me. WINLOGON.EXE all uppercase running in Task manager. 4 Copies of it in a search. Slow as a B***CH on startup. WINLOGON.EXE main drain, first 2 mins or so, Ran Virus cleaners etc. This Did the job!!  See also: Link TheGMan
I am also showing the file link to be \??\D:\\WINDOWS\system32\winlogon.exe with a Name called Process ID 1900. Depending on when I look at this the Process ID tends to be different. This stopped showing up for a while in Security Task Manager then just recently came back. This does not look normal at all. JohnR
"winlogon.exe has generated errors and needs to close" or something like that and then bluescreen in winNT WTF. eric
The file is a virus or trojan imitating a legit Windows file. Make sure that is the one with the suspicious name that you delete. Hexxeh
I set my firewall on high security. It ask for me to acceptor deny winlogon.exe. The icon for this program is a moon behind a window. So this means its a trojan? Blizer
it crashed my pc also it puts some changes on registry and hides folder options what shall i do in addition it restracted the access to regestry editor
look for a file called vcodec and delete it its a trojan
Seems to be part of vcodec ,spy axe ,spy falcon problem. keith
Recently installed ntl netguard antivirus software. When it is running in real-time virus checking winlogon.exe runs at 100% cpu. Great, an antivirus product that stops all viruses by not giving them cpu time. Amazing. Just deinstalled. bil
FACT: Winlogon can be used to start adware and viruses, run hijack this and it will show you the items being started. Very few programs should be started in this way. I just removed 2 items from a corporate pc at my company. Something was attached to the winlogon process and norton email scanner kept popping up and saying email with subject "viagra" could not be sent. Had to use killbox to kill and remove the processes. Vinny
My computer constantly brought up this "Click to end task" and when I clicked it, it reset itself my e-mail didn't want to open and the repair expert said it installed 53 Spyware types inside the PC Chloe-Jane McCartney
this is only a problem if it not a system 32 file, if it is sys32 leave it alone, it is necessary for windows to work, if not system 32, try any of the well known anti-spyware programs to remove!!! the expert
normally, just a stupid windows process that assists in logging in/out of windows. should not be disabled or removed. if it is not in the system32 it is very likely to be a resource-hogging, virus/spyware, and should be removed from only the suspiscious location. Alex
Having gaming issues - noticed winlogon.exe is using 20-50% cpu cycles occaisionally. Watching my work computer (which is squeaky clean) - and winlogon.exe. aint doing jack. Should this exe (the "real" exe in system32) ever utilized cpu cycles when not logging in or out? Should i consider cpu usage by this exe erratic/problematic? or is it normal? Mr. Snrub
This file is a natural process. If you cannot end the process from Task Manager then it is winlogon.exe you are trying to end. The application does have an icon (arched window with night sky and a cresent moon outside), however, when viewed in Explorer it will probably just appear as a standard looking ".exe" file. You should not attempt to stop the winlogon.exe application (except for, as stated above, if it is located elsewhere than "C:\WINDOWS\System32"). Invariably windows' process manager will not allow you end the correct and harmless, real, version on the file, but will the fake. L Murphy (MCSE)
Winlogon is the system logon process! it is not dangerous!  See also: Link Takai
if it contain downloader virus. Virus file is g2550093.dll. Mesut Tekin
It is a part of Windows login system, but if you see two same processes named "winlogon.exe" under running process list in Windows task manager, one of them could be "Win32:Delf-BNM" trojan T
I just got this virus in my system. "WinLogon.exe is a component of the [email protected] mass-mailing worm. The file arrives as an e-mail attachment. Once the computer is infected, the worm scans the hard drive for e-mail addresses and e-mails itself to all collected address using its own SMTP program. The worm may function as a backdoor, allowing remote intruders to secretly access the user’s computer." So it is extremely dangerous. remove it as soon as possible!  See also: Link Jamie
I tried to delete this file once, because i thought it'd contained some virus; but i couldn't perform this action even in safe mode. but i could change its name in "safe mode with command line", but then that restart was the most tragedicomic time of my life; because of that tiny change, i lost my OS... DON'T DELETE THE \\??\\system32\winlogon.exe FILE OF YOUR O.S. TO AVOID A SYSTEM COLLAPSE.  See also: Link ozan
It is an essential process for the Windows subsystem. If it's killed, your computer will hang/stuck. In Windows XP Pro SP2 it's home is the ONLY .\(WindowsFolder)\system32. It's perfectly safe unless your computer is not protected by Anti-Virus (AVG is a good one) programs and Anti-Spyware/Adware programs (Ad-aware and Spybot are the good ones). To the one who asked, winlogon should only take a maximum of 3MB of memory. xBoom
it keeps causing the computer to crash and causes a 'fatal error' were the screen turns blue ans dhuts it self off, reboots and completes the process again. ive got no idea how to get rid of it! stu
winlogon.exe is the system process and needs to run. WINLOGON are viruses, also if your winlogon.exe process is running very high and is having major impact on your systems performance, you may have picked up a trojan or rootkit that has attached itself to the process. Lastly, if winlogon.exe or any of the variants are found outside of system32, they are viruses. Thank you Microsoft Service Technician "Metalica11"
All caps 'WINLOGON' in the sys32 dir is ok. Also, there are other files named 'winlogon.exe' on my Win2K machine in patch uninstall directories. My guess is that they are also harmless. Jeff
Found it in C:\Program Files, double clicked it out of curiosity and all 3 of my antivirus's popped up. If it's not in system32, it's a virus.
it can be either good or bad. Many viruses and spyware applications use this name. You need to look at the location of the file, the Winlogon in (Windows Root)\system32 is the Winlogon that is the one you need. Any others need to be deleted. NOTE: The Windows Root is usually either "C:\WINDOWS" or "C:\WINNT" IT Pro
This file is a ligit windows file, however, it is very suspectable to trojans. My current problem is windowsxp will not boot all the way trough and restarts after the blue error screen comes up. I have seen alot of very helpful advice in these posts however, not any that fit the restarting problem. I really dont want to reinstall windows, but Im not sure of any other fixers... I will explore the registry and see if I can locate any of the winlogon varients to delete.. please continue to post sucsesses on this page, and thank you to every one who has posted. Dave
winlogon.exe (the normal one) suddenly started generating errors en masse, so I guess it has been infected. Avira Antivir say something about a Trojan called WLHack.A jhp
The winlogon.exe on my win2003 server some times grows up to 400MB in RAM memory, i search in microsoft web page and the solution say that i have to restart the computer 0_o and it realy sucks, does some know how to fix this problem? Wacko
I saw a bad product install winlogon.exe after using a keygen. My trojan detection application found the threat and removed it. However I now get a "winlogon.exe cannot be found" message after booting up. The original is still there in Program Files/sytem32. Mac
well, okay, i've got the same problems like devnullius and SwodeG. Means , that my computer started beeping and it removed my desktop pictures... Can anyone help? nutella
I was dumb and downloaded a suspicious file knowingly, clicked on the icon after unzipping and code popped up and disappeared. ran spybot, it found it but couldn't fix it. I went to the C/windows folder where it was located now and deleted 3/5 of the files. the other 2 were "in use" so I couldn't kill them. None of my other programs could kill them either, now I have winlogon.exe in my end task menu. its high priority and it won't let me touch it. Even spybots, startup and run before windows is done loading, didn't work. The program must write itself to look like it is always running. gord
ok i have one thats windows NT logon app... i think it logs on at night for automatic updates SiDDharTha
It is a process of WINDOWS VISTA that is needed. Unless found as C:\WINNT\winlogon.exe. It causes the computer to hang and not respond correctly with programs as well as hangs on shut down and start up. Sometimes will hide for days before it becomes active. Remove it if in the C:\WINNT Directory Shane
my cd win xp in folder i386 shows the winlogon.exe file size 205 kb the c:\windows \system32\winlogon.exe has 422 kb why? porfi
It is a safe system file that manages logon rights. It is part of windows.
its completely harmless and ther rong its not a virus its just the log in screen when u start up ur computer -.- brandon
This program is required to log into Windows. Various viruses and trojans etc may mimic this file in order to create an entry in the Proccess, that looks geniune. Suzi
If you are running windows 9x there is a very large chance that the process is the virus version. spywbot S&D and AVG both took care of this for me. Hoba Phett
It's a part of the Windows Login subsystem. But if it somewhere else then C:\Windows\System32 it might be a trojan. Nick
winlogon can be a part of a virus "WinlogonHack.A" tecnical name "W32/Patchlog.B" witch ataches itself to winlogon.exe in windows/system32 folder,  See also: Link Freeze
i have deleted winlogon and my comupter shuts down itselves. you need winlogon! .:.:.:.
When winlogon.exe is not in normal system32 folder it contains a version of the Trojan. Spbot.D (Norton AntiVirus).  See also: Link Cyborg
i have a pc store, i sold about 3 pc's and i have this winlogon problem and i cant hide it because iam afraid if its system file Wajdi Gary
I just read in the text in file of winlogon.exe that a remote user is trying to login, im sorry for him cause i disabled my remote settings and have zonealarm firewall to block him off. Newbie hacker tsk... ...
I have two of the same files, one is in system32 folder, and the other in the I386 folder. I don't really know if the I386 folder is a bad one though. They are exaclty the same, I'll go ahead and delete it anyways. Bob Heinbokel
I have winlogon.exe in two locations on Windows Server 2003, System32 and ServicePackFiles\i386 Gabe
Windows Logon Application, ending it logs you out in Vista
It is how you login to the computer Jeremy
In most cases - a part of WinNT kernel (WinNT4.0, Win2K, WinXP). If You see more then 1 instance of this process or another a bit misspelled "winlogon" - congratulations, You are infected. MuToGeN
some .dll files are attached to it somehow one i found on my system was malware ...be sure to check your process immortal
the one in the system32 folder is harmless and is vital to windows, but the one in windows folder is a virus. try to look for it in your regedit and u will find out that it is acting like a MPEG file! responsible for the files Gwen(ISU) Zelur and sex video files that keeps coming back after u deleted it (IM SO MUCH POSITIVE BOUT THIS) Mark Gonzales
don't delete the one in system32 other wise your computer won't start mike
Logon to your'e CPU safe mode (press F8 at bootup) search for "winlogon.exe" delete all EXCEPT FOR THE ONE IN /SYSTEM32 FOLDER, clean up yore registry (run:regedit.exe) do a serach for winlogon, I killed them all except for the default value, I'm not sure that that was wise. I downloaded xisoft to avoid doing this manually, it's not worth 40 bucks, so I did it myself and sent to the software afterlife. The aftermath of this incident has left me with a dead anti/virus/spyware , Taking my nod32 and spyware doctor. The source of it all: a key generator for satlab, a little file under 1 mb of s
First thing NOD32 found was winlogon.exe in Windows directory - botnet stuff I believe.
winlogon.exe used on average 30-40% of my CPU resources. This occurred as soon as I installed PC Tools AV FREE Edition. Once I removed PC Tools my resource usage was back to normal. TS
winlogon.exe located in HKLM is picked up by spyware doctor trying to access the registry. This is listed as a maliscious action. However when scanning for it it is not picked up. tricky one alan
This file as described on the top of the page is harmless thus I need to list it as 'not dangerous'. The many 'winlogon' variants can be anything from mostly harmless to the biggest bastard virus you will find (netsky related). I tried a variant that mcfee, norton, spybot and a couple of others found, but it was replaced at every reboot with some new variant. (tried every advice I could find about disabling system restore, clearing run entries in registry/startup, starting in safe mode, but every time even when the programs told the machine was clean it only lasted to restart). Jens
i have 2 winlogons runnng, my computer will constantly try to launch IE over and over which hogs all the resorces, the file shows up in documents and settings/ local user/temp, i know it's not needed to run my system since it's not in the system32 folder, but i can't end task it either, going to try to boot in safe mode and delete it that way hopefully Dave
If it is in your local settings/temp file, its a VIRUS!!! [d30./f2n}
The REAL winlogon.exe (a critical componant of XP) is capable of behaving much like a virus, hence some of the confusion in this thread. Two days trying to get SP2 to install, on completion winlogon uses 99% of CPU. REAL culprit was garbage AOL trialware orphaned in Win.ini. To solve, safe-boot, use msconfig & disable anything non-essential. Restart. If you're OK, then repeat, enabling one or two item at a time. By process of elimination, eventually you'll find the real problem. You **can** have two (or more I suspect) copies of the REAL winlogon.exe running simultaneously if you use 'Fast User Switching' and thus can have more than one user 'logged in'. Drew Kirk, Columbus Ohio
For me, it was not in "C:\Windows\System32" NA
this file is a windows process for logging on and starts your applications. If it is taking cpu or too much memory it may be a virus. it is a 1 if it is acting normally. if it is not then it IS a virus. mitch
This process controls Windows NT logon/logoff procedures. On my computer it uses 832k memory and is located within C:/Windows/System32 subdirectory. Normally, this process should not be tampered with - If it is using any more memory than 832k (approx.) memory, then it should be removed as it could be a virus/spyware. Normal display in NT/XP/Vista should show winlogon.exe and no other variants. This is all I know about this process. Kermit the frog
Used for logging into the machine. like stated before you can get infections that use the same name or slight variations of the name. this file should be left alone unless you are sure you are dealing with the virus.  See also: Link Tim
If winlogon.exe is using 0% cpu and ~ 2,008k memory, then it is most likely not infected. Daemon
Run the "free" short version of this software http://www.superantispyware.com/ It will eliminated your winlogon.exe error box. This is nothing but an annoying virus and this site will take care of it. Takes abut 1 hr. depending on how many files you have. Be patient... it works!!  See also: Link Sandra - Houston, TX
The only one needed in system32 is fine until a trojan attaches itself to it. Start up with no internet connected by wires if there is one. Then check your security before puting the cable back in. XD
This program IS NOT A tojan This appears when you logg off your pc henry - Top viurs finder on norton -
This is legitimate, but dangerous if you terminate it. It can cause the PC to shutdown. COHA Systems, Inc.
If it's not in the system32 file then it's a virus. J
Its a file that manages windows Telis
This is actually a common name for a bot for a botnet, so if it pops up after opening a .exe file extension, it may be harmless, but could slow your processes Lucas
if you have changed an xp theme to a vista or windows 7 theme and it changed normal drivers into a generic OS then the drivers will try to load off of those files because the path is changed. So becareful when you uninstall a "generic" OS cuz for instance i tried to logoff my pc and nothing happened, nothing. john
it takes 4 or 5 attempts to take the box off the screen when the "program" wants to run, i've gone thorugh my AVG and found i have 2 of them... c:\windows.winlogon.exe and C:\WINDOWS.winlogon.exe (3400) it's not in my system32, my files or anything...and i have several tracking cookies as well...i'm thinking i have a shifty hacker...or someone idiotic enough to think i won't realise it's not the real winlogon.exe kirsty
Its can blocks your Browser Windows
C:\\WINLOGON.exe is malware be very careful, and destroy the damned thing before it's too late, trust me kirsty
"winlogon.exe" is essential component of Windows XP, allowing user(s) to log onto Windows. -- However, "WINLOGON.exe" is a dangerous virus. This can cause any/all of the following: inability to log-on with 'any user' (including Safe Mode), creating a false antivirus program window that cannot be closed (can be called Internet Security 2010 with similar layout to Norton AntiVirus' Internet Security 2010 software), 'Windows Directory' filename confusion and/or accidental deletion of essential: 'winlogon.exe'. These issues can cause irreplaceable damage to Windows and C: Nick - Cherry Hill, NJ
You must keep only C:\windows\system32\winlogon.exe , You must remove C:\windows\winlogon.exe , Run: msconfig , remove from startup,then restart and delete that file. vo.andrei
Difficult to remove, especially after multiple logons, because if it is a trojan, every logon reinstalls itself and alters the system backup files. Tasos
it from the microsoft geneuine security update and if any one really need all the file in the hard disk without format it there's a way to say it. Beacause the win log on exe comes up on the starting so evenly the window will not open just star up window display but nothing hapen even in the safe mode still the same but the easy way are by doing this..or can ask me at my site... wajabar
Just like everyone says, it is important, but you should figure it out f it is a virus, according to xBoom, it should not exceed more than 3MB, if it does, try scanning it with an Antivirus, if it can't be deleted use Malwarebytes Anti-Malware's FileASSASSIN, it can delete files, but be sure that it is a virus, or else, system crash. ax_colleen
it try to connect to a bunch of ip addresses here are some: What's Your Name
winLogon isnt a virus it is a very important file however if you notice WinLogon being spelt WinIogon it is a virus which will need to be removed with anti virus sharif ahmed
Usually Harmless and needed by the System. If another process, e.g. a virus, is named winlogon.exe, you are unable to shut it down via task-manager, like the original winlogon.exe. barn
It is a system file and used to Login and out a user. But a trojan or virus easily can attach itself with winlogon.exe Awais M. Awan
If you have more than 1 of these files, you are Keylogged Gyazo AKA Roy
If you found one only its harmless if you delete it your computer will crash but if you find two then you have keylogger and its 50:50 change of deleting keylogger or breaking windows Your name
i have 6 of those files and only one of them are located in the system32 folder and the other 5 is something else Kevin
i have winlogon.exe running but when i click open file location none, n i clicked properties nothing came out. its a brand new laptop benny
The winlogon process is important for the stable and secure running of your computer and should not be terminated. When you log into Windows, Winlogon.exe will load in and manage your logging in.  See also: Link Phil Adams
It's safe, Important and if You kill the process, your OS may suffer severe fractures. WinIogon.exe is hard to remove unless you have SuperAntiSpyWare. WinLogon.exe must of course be in the system32 folder, or something will go wrong with the system. Also Important to know that this File is Closely Related to the BIOS, the entire startup program, which perhaps make one understand exactly how Important this process really is. Calle.N
This thing is dangerous! My computer always gets the blue screen of death!!!!!!!!
winlogon.exe has never runned in my task manager till i downloaded blaze audio sound sfx crack my antivirus shoved it's a high risk cloacked malware i deleted and now winlogon.exe runs i think it wanted to harm this process but since i deleted that crack it didn't do anything.now winlogon.exe runs in my task manager it's size is 404 kb it uses 0 cpu i can't stop this process.my pc runs normal.i also have found wonlogon.exe in c:windows\system32\dllcache i deleted it and nothing happened it was not used by any process Mantas
Part of Windows, NOT DANGEROUS!!!! All the other people here have virusses because they fail with anti virus software :L Wesley
My winlogon.exe hogged 50% to 100% of CPU. I tried everything. Finally I turned off my McAffee real-time scanning (it's a virus checker). Presto, problem fixed. chaya
Ending the real process may cause bluescreen. Hisbollah
WinLogon.exe is a critcal system process that lets you log on, log off, and checks to see if you have a Valid License Key. This file SHOULD take up less than 1MB of ram on Windows 7. This file can be infected with a virus like some of idiots do. Infamous4Loko
If you have only 1 of these processes, then it's safe. It manages the login and logout of your computer. If you have two, it may be a virus (Usually it will be a winIogon) but it will seem like an l. Anononononymous
Its Showing up on my task manager as System, Its not running anything extra no other users its not using any CPU but it is 1,460K big Of the MEM Usage. Ryan
This is the windows logon program. I task-killed it and I got logged off. It's not okay to delete it. If you have something like WiNlOgOn.ExE or some crazy stupid name, open file location via task manager and if it's in AppData, it's a virus. some random guy
When I boot the machine i get a message saying it can't find file c:\windows\inetr45\winlogon.exe. where in the registry would i go to delete the reference? Mike H
it's totally harmless and when you shut down the process your com will log off automatically .
Used for logging into the machine. like stated before you can get infections that use the same name or slight variations of the name. this file should be left alone unless you are sure you are dealing with the virus. Barbie
This process belongs to the Operating System. No harm here. Raphael
If for some odd reason your computer hangs at startup, use taskmanager to kill explorer.exe and restart it. don't kill winlogon. Terry
Winlogon is pretty busy when using Remote Desktop Paul Sakrison
It can or cannot be a virus... Gio Santos
It's sort of a 50/50 chance it is supposed to be an application that logs you on (i think) but its mostly a system process OR it could be one of the latest viruses that track what you type so if you were logging on it would probally steal your password for stuff like BANK ACCOUNTS so its very annoying to tell BUT it could say in "Task manager" (click the toolbar at the bottom of the screen and click "Task manager")Then (I have windows XP) It could say if it belongs to "SYSTEM" or something else so Happy Computing! -Zack Zack.F
This is the Windows NT Logon Authority Process. If removed from the system32 folder you will have to do a repair install. Try to terminate this legitimate process in any way shape or form and you will get a blue screen and the system will halt. This is what the blue screen will contain.... STOP: c000021a {Fatal System Error} The windows Logon Process system process terminated unexpectedly with a status of 0xc0000142 (0x00000000 0x00000000). The system has been shut down. Unless it is in another folder other than system32, leave it alone as Windows won't be able to log you into any accounts, even admin accounts in safe mode if this is deleted from the system32 folder. TechWizard86
I would like to add that in addition to the logon process and validation key checking, The Winlogon.exe process also holds some functions of win32k.sys (which is the kernel or subsystem part of csrss.exe) and some critical kernel functions that are crucial for the correct functioning of Windows. This is why you get a blue screen when the Winlogon.exe process is terminated or if it exits unexpectedly. When this process dies those kernel functions also die with it. This is why you get a blue screen. TechWizard86
when i click for it properties it dont open and it dont have a user or a description in windows task manager ahmed
winlogon.exe Manages Your Logins And Logouts.It Also Manages So The Computer Won't Like Restart Without A User Warning.DO NOT Kill The Process.It Will Restart Your Computer.It Is Normal If It Has A Moon With Stars Logo,That Is The Default Icon.If You Find It NOT In The C:\WINDOWS\system32 But Somewhere Else,DELETE That,That A Fake A Virus/Worm/Trojan/Spyware/Malware Generated To Trick You To Replace The REAL winlgon.exe. Arnold Alejo Nunag (Age:9) (B.D.:10/16)
it shuts down my laptop as many times as i type win, windows, or every word that has (win) in it. Sherbet kalemi
Without these file, windows wouldn't run ;-) the winlogon.exe in C:\Windows\system32 is harmless, and you won't be able to delete it. Nelethill
I dont know much about winlogan, but in system32 folder i found a hidden file named winlogan.exe.exe and a hidden folder named winlogan in which there was again a file named winlogan.exe........all these files were hidden......with no icon I also found another file called winlogon.exe in system32 folder, which was not hidden and was with an icon....so i kept it and deleted the other winlogan/winlogan.exe and winlogan.exe.exe file..... after deleting these files my computer works fine and i dont get any error messages that i used to get before Ksh
this is a malware,..this changes ur user parental and changes your default browser..be careful. nic
The file is a critical system process, and the real winlogon can not be killed with task manager. Type file:///C:/Windows/System32/Winlogon.exe into your browser to open it. This file comes with windows and should NOT be deleted. If it is not in C:\Windows\System32, it is a virus, and if it is not Winlogon.exe, but something similar, it is a virus. A good way to check is to scan any file called winlogon, but if it is in C:\Windows\System32, it is not a virus MOSTLY. Some viruses can modify winlogon, but asfar as I am concerned, winlogon is a critical process. Like explorer.exe and taskhost.exe and taskmanager.exe  See also: Link Platinum Pufferfish
winlogon.exe is not harmful since its needed for your computer to start because winlogon means Windows Logon, it will load your system files (such as svchost.exe, System etc...) and the location of winlogon.exe is in C:\WINDOWS\System32\winlogon.exe but if you see 2 winlogon.exe in the task manager choose 1 and right click then open file location, if it is located in C:\Documents and Settings\User\Application Data\winlogon.exe its a virus, so kill that task and delete that winlogon.exe before its too late... because if that virus locates your original winlogon.exe it will delete it and that infected winlogon.exe will be the main winlogon and when you start your computer that infected process will open 150 infected svchost.exe processes, i know because that happen to me once but good thing i had a backup os (Windows 7 Ultimate) so i managed to delete the infected svchost and winlogon and restored the original one from the Win XP CD Troll Face
I have 1 winlogon.exe in C:\Windows\System32, and a couple winlogon.exe and winlogon.exe.mui in C:\Windows\winsxs\amd64_microsoft-windows-winlogon... . Ward
Without this file you could not log on. important file!  See also: Link Kevin Ombecq
If you have TWO winlogons one is fake and actually trying to destory the other! i had this on my laptop and after awhile my screen went blank and i lost my os beacuse the winglogon had destoryed the other. Nick
This file manages Logging off and Logging on set by the user. It's an essential windows process, and will cause no harm. However, Malware can disguise itself as Winlogon.exe, so it's best to have your Antivirus software up to date. Anonymous Helper
It is sometimes fake and can be a virus Dr S.J Keeley phD F.R.S
its windows xp process that must be enabled, or u might get screen of death aleksandar
can be very dangerous, but is system file. If not in system32, delete it! Use Unlocker to delete it if you cant! Buzzy
Can be dangerous and can cause application error cx0005's. It hogs the index.dat file in windows and creates \??\C:\Windows\system32\winlogon.exe in Shared Access. It maybe a virus. ladybird55
Anyone who says this is other that safe is an idiot.Winlogon is the component of Microsoft Windows operating systems that is responsible for handling the secure attention sequence Paul
This file is the Windows NT Login system executable. Closing the process will result in one of the many things: Windows 2000/XP: Blue Screen Windows Vista/7: Logs you off and deletes your profile until a computer restart (No files destroyed!) Windows 8: UNKNOWN This file in %systemdrive%\Windows\system32\ should be safe. Anywhere else, delete immediately! winlogon.exe may attract viruses and some may attach to the process. If this happens, try and replace the file if you can and use an expert AV application in order to remove the infection InvoxiPlayGames (Daniel Wilkinson)
very safe Tim
This in only windows process that it cannot work whitout it
If you find another type of executable that is not in C:/Windows/System32, it's unsafe. Otherwise, it's safe. (maybe) Simon
Sometimes it pops up and sometimes it doesn't. I can't seem to open the file location either, but it has no suspicious typos, etc... in the name. Sgt. R.
It is needed to be able to log in and log off. If there is only one winlogon.exe, you're safe. If there's 2 or more, it's hard to know which one to remove. Simon
It's windows login system, and should never be terminated so your computer remains stable. Adriano
This is standard in Windows for authorization in logging in Max
Same As All The Other Proccesses Ruel Nathaniel
Winlogon is the component of Microsoft Windows operating systems that is responsible for handling the secure attention sequence (i.e. Ctrl + Alt + Del) and loading the user profile on logon, among other things.
It's what manages logging in and logging off (I thinl) it is not a virus open process manager and click show processes from all users and if winlogon is run by SYSTEM it's safe Zander
Sometime It CAN Be A Virus, eg:WiNLoGOn.exe or winIogon.exe And If NOT In The system32 Folder it IS A Virus. Iain
Well, 2 cases. If it's in the System32 Folder, safe. If not, it's a malicious program. Surmelon
It is the core process for handling the authentication. Do not kill it. Mr. Geek

If you know more about winlogon.exe, share your knowledge and help other users.

Security Rating:
Your opinion about this file:
Web page with more details:
Your first name:

More process information

Is winlogon.exe spyware or a virus, trojans, adware or worm? Is there a known winlogon.exe error?

Other Processes

[winlogon.exe in German] [all processes]