How about winlogon.exe

http://comprolive.com/remove/winlogon-exe
winlogon.exe is a file/ a process belonging to the Windows login manager. It handles the login and logout procedures on your system. Probably because of the familiarity of this name, the virus writers are tempted in using this name to create a harmful file on your computer. If you find this file anywhere else other than its defaut locations , then certainly that would be a virus

Category:

Education

Tags:

• winlogon
• winlogon.exe
• winlogon-exe
• winlogon.exe virus
• winlogon.exe trojan

[Andriu0004]

@srajure my computer is windows 7 i start the avg antivirus and it found the winlogon.exe in a folder, and that folder's name is winlog.

But when i go to that folder i don´t found it

And its another winlogon in the system 32

[srajure]

@Andriu0004 , see if you have enabled to view hidden files and folders. Probably the file and the folder have hidden attribute

[jmatj513]

i checked system 32 i also have a winlogon.exe.mui is that bad?

[srajure]

@jmatj513 , open the system 32 folder, go to the file and hover the mouse pointer over the file icon, that will pop up a tooltip which displays the info about that file. Probably it is legit

[srajure]

@Terigator12 , you need to look at the paths of currently running processes either in process explorer, windows defender or (in windows 7, in task manager itself) and if you see a winlogon.exe which is not in its default location, then delete that file from the hard disk.

[Terigator12]

@srajure ok then but what does it do? does it do the thing when you go select your user?

[srajure]

@Terigator12 , winlogon.exe is a legitimate windows process. Some viruses create files with same name but in different locations, and if your computer is infected by that virus, then you will have to remove those fake winlogon.exe files.

[Terigator12]

um....why delete it? why is it so bad? and wont that mess up your computer? O_O

i really have no idea you tell me

[qxen95]

i found 1 winlogon cp ? IS IT OK?

[Martintin7]

@DemonOf4Elements yes its ok, your suppose to have 1 winlogon there but if there are multiply like the comment above try do as srajure explaind