How to Remove the winlogon.exe virus from PC

What is winlogon.exe?

winlogon.exe is a legitimate process file popularly known as Windows NT Logon Application. It is associated with Windows Operating System developed by Microsoft Corporation. It is located in C:\Windows\System32 by default. Malware programmers create files with virus scripts and name them after winlogon.exe with an intention to spread virus on the internet.

Affected Platform: Windows OS

How to check if your computer is infected with winlogon.exe malware?

Keep an eye for the following symptoms to see if your PC is infected with winlogon.exe malware:

Internet connection fluctuates
winlogon.exe takes too much CPU space
PC slows down significantly
Browser automatically redirects to some irrelevant websites
Unsolicited ads and popups starts appearing
Screen freezes constantly

Take the following steps to diagnose your PC for possible winlogon.exe malware attack:

Step 1: Simultaneously press CTRL+ALT+DEL keys to open Task Manager.

Step 2: If you notice the file located outside C:\Windows\System32, then you should run an antivirus scan to get rid of the malware.

How to remove winlogon.exe malware from system using Comodo Virus Protection Software?

Step 1: Download the award-winning Free Antivirus.

Step 2: Installation configuration frames will be displayed. Select the configuration you would like to apply.

Step 3: After network detection is complete, press “Close” button for a scan window.

Step 4: Restart your PC.

Step 5: It will take some time for the Comodo Internet Security to update the Virus Protection Software.

Step 6: Proceed with a quick scan that automatically begins after the update.

Step 7: If threats are found during the scanning, you will be prompted with an alert screen.

Step 8: Comodo Antivirus Software will remove the winlogon.exe virus including all other malwares from your computer.

Windows OS PC Security Softwares:

Related Resources:

Website Malware Directory Resources:

Malware Entries

First Seen: 21 October 2011 at 4:51 am

No.	Company	File Type	SHA1	MD5	Malware Name	Digitally Signed	File Version	Product Version	Submitted From	Malware Behavior
1	N/A	Executable	183ab5ee8d165d81 ecbf497405a2e81c 59a60031	a75b3c55325ae7eb 16b38256eeb762b9	Backdoor.Win 32.Delf.~DF	No	1.1.09.04	1.1.09.04	India	N/A
2	NULL	Executable	eb976cb886b2a214 467bccba0f2d44a6 b00792ca	de85012569ee1d41 bc4119f4d01c0fa3	Unclassified Malware	No	1.00	1.00	Internal Submission	N/A
3	N/A	Executable	4ceb94539fab6fe8 6a19f74bec9e844c ac736697	4915989c241e93c4 e2941c83ceb27c9a	Unclassified Malware	No	N/A	N/A	Internal Submission	N/A
4	Корпорация Майкрософт	Executable	e4631dd8e906fde4 92ba989d115b4643 6b74d342	4cd72f067f763219 0c310b53ca93cb9d	Virus.Win32. Virut.Ce	No	5.1.2600.5 512 (xpsp.0804 13-2113)	5.1.2600.5 512	Czech Republic	N/A
5	CyberLink	Executable	e02d234299919e21 3b15b23e58e541d1 cc4e9850	b33527f1e9a2b957 0ed8252922defc8c	TrojWare.Win 32.Kryptik.W VD	No	7.0.0.1731	7.0.0.1731	Internal Submission	N/A
6	N/A	Executable	3d578529cd341386 f00d856734a83d1f f59c273d	fdf52e1e9771b6d6 9895f628fa6cbc74	Unclassified Malware	No	N/A	N/A	10.224.1.116/32	N/A
7	N/A	Executable	828d8c3eaa3e7e8b 70cae7d0f8e4d47d c32a587e	2ddc8601e5d0b76c 80aa46eef32ec825	TrojWare.Win 32.GameThief .Magania.~NW ABU	No	N/A	N/A	Internal Submission	N/A
8	Microsoft	Executable	06868dda21e29508 9fe04f7cca1d665f b2033db5	3a16a9c9515ee180 05659e64e5c57a45	TrojWare.Win 32.VB.YNA	No	1.00	1.00	Italy	N/A
9	N/A	Executable	b4b3f27777236a0e 259ca0940290dd98 d823f64b	b2f18ad8cd7a3738 fde601d8f9889699	TrojWare.Win 32.Kryptik.X CY	No	N/A	N/A	Internal Submission	N/A
10	Microsoft Corporation	Executable	6b18c84cb804be8d 2932ec17ebdbf5a3 bb779bc7	89351cf7c99b006e b544b9e4152406f4	TrojWare.Win 32.Kryptik.W VD	No	4.0.60129. 0	4.0.60129. 0	Internal Submission	N/A
11	Thorsten Blauhut http://www.desksave.de	Executable	94252fe5154b679d 7da5f5e192e99aae 22a02a86	9b0e23d54a5c9df7 a782bc9bd47c4744	Unclassified Malware	No	8, 2, 1, 0	8.2.1	United States	N/A
12	vidente	Executable	1870a3851b96503a b0909fc14affb4e7 d1d555bc	413f2907bcc8897f 81cd9d169f8a8929	Unclassified Malware	No	32.02.0004	32.02.0004	Internal Submission	N/A
13	DFoazKnekNtbUcw	Executable	66fbe9d94b51d9c1 0a5a471a4858d29f 200ac6ce	cab3f9b48e5ffdbf 808824f1cd24f80c	Unclassified Malware	No	8.4.6.6	8.4.6.6	Internal Submission	N/A
14	N/A	Executable	016bfabe3e4483e9 c155759a38b67b03 bb6143dd	3a91e6299be406f1 bfc0b75122385038	TrojWare.Win 32.Remex.bfj b	No	N/A	N/A	Russian Federation	N/A
15	N/A	Executable	02e6baec3ef8b2db 5502ac43c81c963b cb8db3cd	42205c328732f379 4bc37a97a9f32da5	Unclassified Malware	No	N/A	N/A	Internal Submission	N/A
16	Microsoft Corporation	Executable	a51dd859e1219d6d 07f24ff5958fecb3 d7020e55	779fcad3b2233bf6 cee667d91778b1fb	Virus.Win32. Virut.CE	No	5.1.2600.5 512 (xpsp.0804 13-2113)	5.1.2600.5 512	5.244.98.103/32	N/A
17	ByELDI	Executable	8dfb4d7d06b030f2 39aa4840fab58ae7 f7197966	cb0c944c483a89d5 f624d36678a46373	Unclassified Malware	No	...	...	181.59.113.57/32	N/A
18	NULL	Executable	9085ec3fdfaa1c62 d54405845b584d01 265e13a4	6c4b2a9e3815f7b5 468719123f798226	Unclassified Malware	No	1.00	1.00	Internal Submission	N/A
19	Microsoft Corporation	Executable	fc77f794243ebbae dec76b55d39827d2 72911297	ce48fba0404d2fc2 b601ccc3fbc52e13	Virus.Win32. Virut.CE	No	5.1.2600.6 443 (xpsp_sp3_ qfe.130904 -1137)	5.1.2600.6 443	156.194.246.209/32	N/A
20	Microsoft Corporation	Executable	bb1515a0d9036859 033beef4076855be 49deaaf3	ba9d70180207e35d 88c85814816d7935	Virus.Win32. Parite.gen	No	5.1.2600.2 180 (xpsp_sp2_ rtm.040803 -2158)	5.1.2600.2 180	Turkey	N/A
21	N/A	Executable	f951faad4428f3b0 732d4835d2ac61f9 4a18b0e3	9e120f73949f4ebb 58606e90d8c263fb	TrojWare.Win 32.KRotten.~ A	No	N/A	N/A	Belarus	N/A
22	N/A	Executable	2d8e82d650dd575c e4c0d56a740f0c34 2b21c389	066e9d4a618fbb96 1540f4b4c11b550c	Unclassified Malware	No	N/A	N/A	Russian Federation	N/A
23	Microsoft Corporation	Executable	8d4c8281e7b75c4b 2dee8b28f762bebc fcc40f98	c8c5a74fec9356fd 21899d77b81baae3	Virus.Win32. Virut.CE	No	5.1.2600.5 512 (xpsp.0804 13-2113)	5.1.2600.5 512	197.34.108.204/32	N/A
24	Microsoft Corporation	Executable	e3cc685554bb0f55 725e74cd03a86c54 88e8ab39	000bebacc25a9ef0 bb05e52d03d84b7a	Virus.Win32. Virut.CE	No	6.1.7601.1 8540 (win7sp1_g dr.140716- 1508)	6.1.7601.1 8540	Turkey	N/A
25	Microsoft Corporation	Executable	a99a2ef67fec279c 3a7caf43036913af 43b24a43	e1df5da4283bee0c 755dc13af94ec140	Virus.Win32. Sality.gen	No	5.1.2600.5 512 (xpsp.0804 13-2113)	5.1.2600.5 512	159.146.10.185/32	N/A
26	CyberLink	Executable	5f12df5ee7517081 f4da751b3c15c409 782d7fd9	12712a8669d7e0ea 356223eec78d706e	TrojWare.Win 32.Kryptik.W VD	No	7.0.0.1731	7.0.0.1731	Internal Submission	N/A
27	Корпорация Майкрософт	Executable	7a431d743d55b1e0 cef5e5cf966ecbae 9ea86113	2bbd57a277d05091 22bdf092cfe81d83	TrojWare.Win 32.Remex.bfj b	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Russian Federation	N/A
28	XeXE	Executable	6f831ed4db1653ce bad7c977ccfb859a 087057e4	f66a1c332462a414 3ff97688853169d1	Unclassified Malware	No	32.02.0006	32.02.0006	Internal Submission	N/A
29	N/A	Executable	1b90f5b0c3c8303d 843fc4cb75bb7cfe ff97cd7f	39c4937951bb1eb2 c9b68258c13e4856	Packed.Win32 .Packer.~GEN	No	N/A	N/A	Philippines	N/A
30	NULL	Executable	06bbaee1afdf25eb d4ceb4f3e2008020 5b4be5d1	9e076cb108d31eac 7afcc4c0c07734fb	TrojWare.MSI L.Agent.GA	No	0.0.0.0	0.0.0.0	Internal Submission	N/A
31	N/A	Executable	374a201897a67372 241437fee2dbe87c 940eca15	eff0b279f60b2e6f 64419eacf659d6fe	Win32.Neshta .A	No	N/A	N/A	Italy	N/A
32	N/A	Executable	0a543eb984aaff5c 181f408e24dddbbd 2a86318c	ae3a6330721ad8e3 567c1d06a124ca6b	Unclassified Malware	No	N/A	N/A	Internal Submission	N/A
33	ﾼﾍﾆﾏﾋﾐﾬﾊﾖﾋﾚ￑ﾰﾭ¸	Executable	a8ac87adb34d5a85 32b85cba515d310e f38a7659	965db4a5c1254b63 d5722e34932d5a62	Unclassified Malware	No	ￎ￑ￏ� �	ￎ￑ￏ� �	Internal Submission	N/A
34	Microsoft Corporation	Executable	8e8aa8b5d91115af 6c703d52590a3ea8 70914e9d	3e69c0b809b0c812 1b46294082f08676	Virus.Win32. Parite.gen	No	5.1.2600.2 180 (xpsp_sp2_ rtm.040803 -2158)	5.1.2600.2 180	Turkey	N/A
35	N/A	Executable	fcb987cb416e145d 2f385465e737f5a8 dfd40d4d	69c762c08cb3c190 515fd31f3ff4b4ef	Unclassified Malware	No	N/A	N/A	Czech Republic	N/A
36	N/A	Executable	1c774909e19c1b5d d326ed43c5a08547 12ba5fc6	75e919f682ee2a4c e5ce3e0445dfe8f5	Unclassified Malware	No	N/A	N/A	United States	N/A
37	NULL	Executable	029c2daab2e30443 bd888ef39496df2b 0c5ceb72	1a69949620d13ca5 a3cf9d95403a41fb	Unclassified Malware	No	NULL	NULL	Internal Submission	N/A
38	Корпорация Майкрософт	Executable	de870ccaafee4244 4a8df2770b0d5484 c0ebadde	0e7bbe6f1279871d 04b72a87531ca9e0	TrojWare.Win 32.Remex.bfj b	No	5.1.2600.5 512 (xpsp.0804 13-2108)	5.1.2600.5 512	Russian Federation	N/A
39	N/A	Executable	067de2514f4a70a5 f84c1ecf6c2b6a4c 996cdde6	b0b94b38442f6c95 450f8e3eb068cacf	Virus.Win32. Sality.gen	No	1.00	1.00	India	N/A
40	Microsoft Corporation	Executable	7dc550b77b3a8757 fd16fe308e9c4cd5 0ee43c5b	ae49096fad73be0d 02188654a58d3031	Virus.Win32. Sality.gen	No	6.1.7600.1 6385 (win7_rtm. 090713-125 5)	6.1.7600.1 6385	197.45.215.204/32	N/A
41	N/A	Executable	2b84b2d72ec4d9d6 74d51527ca3b1c05 b7c6b0b8	07a47fdeba53b5d6 9e2c9ff90fe6702c	Unclassified Malware	No	N/A	N/A	Russian Federation	N/A
42	N/A	Executable	ba97f18f6b821dac f2ba886d5bba9d8e acc2f279	ecc587c8f71c57b3 574b71fe6eed7438	Unclassified Malware	No	N/A	N/A	Russian Federation	N/A
43	Creative Technology Ltd	Executable	a51b32c081c9580e adae958ad06a52a2 45e1a88b	0d12cdeb88c3caae 203fdbd7d2461aca	TrojWare.Win 32.Kryptik.B MNA	No	2.61.7.4	2.61.0.0	Internal Submission	N/A
44	quesi	Executable	f18870376126e2f2 66576da0f0629f0d 5d83a7c5	acbb463635bf72ba 70744111c07b1b18	Unclassified Malware	No	66.66.0666	66.66.0666	United States	N/A

1 2 3...11

Display 4 items per page

4 items per page
8 items per page
16 items per page
32 items per page

Safe Entries

First Seen: 27 June 2008 at 12:21 pm

No.	Company	File Type	SHA1	MD5	Digitally Signed	File Version	Product Version	Submitted From
1	N/A	Executable	c56b7a5590661954 8193067b52d24b45 aef75c6f	d3af1bda57f41ebf 5bb9c43101e878af	No	N/A	N/A	Internal Submission
2	N/A	Executable	b359eb112dd0ee08 ad76555583fd244c c13310ec	fffb5a35052b2aaa e22d5e9f7642a69c	No	N/A	N/A	United States
3	Microsoft Corporation	Executable	b136d54bb0b352b2 239e08f0b4389d66 3e413050	8b9b35206487d39b 2d3d076444485ec2	No	10.0.19041 .1 (WinBuild. 160101.080 0)	10.0.19041 .1	India
4	Microsoft Corporation	Executable	40819a2cedbb846a 173f0989e34163e6 f0f03fa4	4535aa147d595876 fbb714d7b65d053a	No	4.00	4.00	United States
5	Microsoft Corporation	Executable	91e02520ac89446b 9ec37ee889b6533d 6dd892a9	13f1b88db521ee1e 247f540b43339703	No	5.2.3790.3 959 (srv03_sp2 _rtm.07021 6-1710)	5.2.3790.3 959	Internal Submission
6	ReactOS Development Team	Executable	94425bc55cbcafc6 f91fd2f6b8763f6e c3f6ff36	3046a925e7cadda1 6a8c2384326d25ad	No	0.4.13	0.4.13	10.108.22.232/32
7	Microsoft Corporation	Executable	51882f839215aadc 8bfa3cfb4d78dcf1 555ea32e	44361d919e314893 f2571179994bb356	No	6.1.7600.2 0560 (win7_ldr. 091027-150 3)	6.1.7600.2 0560	10.224.1.116/32
8	ReactOS Development Team	Executable	30de743b3523e0da e0b9f6b9ed8900c8 24e6efdb	aac8093f99214b88 b45166ac7f2126b8	No	0.4.9	0.4.9	10.108.51.116/32
9	Microsoft Corporation	Executable	981500f7d2477760 c3b46be1331141ce 321f5052	9df09a059a5f4289 3a250837f519f22c	No	5.1.2600.2 9 (xpclnt_qf e.010827-1 803)	5.1.2600.2 9	United States
10	Microsoft Corporation	Executable	ca6f4be9738c17a3 390f11507a4cc6ad 1c7d423b	d670e84f354c4973 f6309c59201a85a5	No	4.00	4.00	United States
11	N/A	Executable	5fa8b210f7d6c1b8 c1a9475d6c432c43 4bf0f5b6	0f60cb7e3865f714 a579fec371ef3aae	No	N/A	N/A	Internal Submission
12	ReFog Software	Executable	87321f18bf7a5b0e 1a254ad40e857c6f 04f4b631	4967f8981164d575 90a69d281d358adb	No	1.4.6.46	1.4.6.46	United States
13	ReactOS Development Team	Executable	94425bc55cbcafc6 f91fd2f6b8763f6e c3f6ff36	3046a925e7cadda1 6a8c2384326d25ad	No	0.4.13	0.4.13	10.224.25.40/32
14	Microsoft Corporation	Executable	a5396141cab8b22d 9d88b28a81408953 7dce366a	01c3346c241652f4 3aed8e2149881bfe	No	5.1.2600.2 180 (xpsp_sp2_ rtm.040803 -2158)	5.1.2600.2 180	Internal Submission
15	Microsoft Corporation	Executable	573ed5aed255dcec 948bcea8c28ec9f3 802a2e64	e8b1a6b8c6ea5972 c123a816df237af8	No	10.0.17763 .1075 (WinBuild. 160101.080 0)	10.0.17763 .1075	5.145.222.177/32
16	N/A	Executable	b359eb112dd0ee08 ad76555583fd244c c13310ec	fffb5a35052b2aaa e22d5e9f7642a69c	No	N/A	N/A	Internal Submission
17	N/A	Executable	5da52819a5010932 bcab3c837cf2dbce d4364da7	41403f5845598af3 310bebd2f230bdf7	No	N/A	N/A	Internal Submission

1 2 3...5

Display 4 items per page

4 items per page
8 items per page
16 items per page
32 items per page

Malware Search Engine

How to Remove “winlogon.exe”

What is winlogon.exe?

How to check if your computer is infected with winlogon.exe malware?