winlog

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	(default)	winlog.exe	"Added by the RBOT-CVY WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	.Prog	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	9m	winlog0n.exe	"Added by the LEGMIR-AQK TROJAN!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
X	AntiVir	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	BossIdea	winlogin.exe	"Added by the LINEAGE-I TROJAN!"
X	BuildLab	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
U	C:Program Filesdfjdkjfdkjfldjfdfjdkjfdkjfldjfwinlogin.exe	CritProc.exe	"KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself!"
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	cpanel	winlogin32.exe	"Added by the RBOT-FOY WORM!"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
X	Firewall auto setup	winlogon.exe	"Added by the AGENT-EDB TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	FriendlyTypeName	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Hhjg5jfd93dftdf	winlogan.exe	"Added by the ERTFOR.A TROJAN!"
X	icq lite	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	ICQ Net	winlogon.exe	"Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	ICQNet	winlogon.exe	"Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Internet	winlogom.exe	"Added by a variant of the SDBOT WORM!"
X	jkdfj94kgdftdf	winlogan.exe	"Added by the ZLOB.BZ TROJAN!"
X	key2	winlog.exe	"Added by the BAGLEDI-AL TROJAN!"
U	Login	winlog.exe	"Salfeld Child Control - parental control software"
X	Microsof Winlog Host	wilogon32.exe	"Added by the RBOT.XC WORM!"
X	Microsoft Login	winlogin.exe	"Added by the RBOT-AJP WORM!"
X	Microsoft Logins	winlogins.exe	"Added by the SPYBOT.BCZ WORM!"
X	Microsoft Service Login Manager	winlogin.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Synchronization Manager	WinLoginnn.exe	"Added by the SPYBOT.FO WORM!"
X	Microsoft Synchronization Manager	winlogon32.exe	"Added by the SDBOT.AEU WORM!"
X	Microsoft Visual SourceSafe	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	Microsoft Windows Logon Process	winlogon.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	msconfig	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	MSMSGS	winlogon.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	msn	winlogon.exe	"Added by the PROSTI.AA BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
X	MSWinlogon	SynCor.exe	"Added by the AGENT-FZL TROJAN!"
X	MSWinlogon	winlogon.exe	"Added by the AGENT-FZM TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	NDplDeamon	winlogin.exe	"Added by the RANDEX.E WORM!"
X	nvchost	winlogon.exe	"Added by the KLONE-J TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NVIDIA Media Center Library	winlogon.exe	"Added by the AUTORUN-AZK WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	PaRaY_VM	winlogon.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	RealTimeProtector	winlogon.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ï¿½ subfolder"
X	RegDone	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	ROOT_Machine	winlogon.exe	"Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\inf"
X	RPCserr32g	winlogon.exe	"Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserv32g	WINLOGON.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	runwinlogon	winlogon.exe	"Added by the AGENT.TQY TROJAN! Note - this is not the legitimate winlogon.exe process
X	SkynetRevenge	winlogon.scr	"Added by the NETSKY.AA WORM!"
X	SmansaApp	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	srv	winlogon.exe	"Added by the SILLYFDC.BCA WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%\Local Settings\Application Data"
X	startkey	winlogin.exe	"Added by the BIFROSE-PM TROJAN!"
X	Startup	WinlogonStartup	Unidentified malware
X	System Update2	winlogon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process
U	systray	winlogin.exe	"KidControl surveillance software. Uninstall this software unless you put it there yourself"
X	TEXTCONV	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	Torjan Program	WINLOGON.EXE	"Added by the WOWCRAFT.D TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Updade Windows	winlogom.exe	"Added by the TONAX-A TROJAN!"
X	Update Checker	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	urudjeffni	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	userinit	winlogon.exe	"Added by the DLOADER-TP TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	virtual-ie	winlogi.exe	"Added by the RBOT-BJU WORM!"
X	virtual-machine	winlogin.exe	"Added by the RBOT-VU WORM!"
X	W1N32.DLL	WINLOGON .exe	"Added by the DROPPERFL.A TROJAN!"
X	Win Login	winlogin.exe	"Added by the RBOT-AWE WORM!"
X	Win32 Drivers	winlogons.exe	"Added by the FORBOT-FG WORM!"
X	WinAuth	winlogon.exe	"Added by the STRTPAGE.BE TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Window UDP Control Servic	winlogon.exe	"Added by the RBOT-GXN WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows ARP Detectionc	winlogon.exe	"Added by the RBOT.EAB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows ARP Detectioncx	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows debug logging	winlogg.exe	"Added by the RBOT-OY WORM!"
X	Windows debug logging	winloggs.exe	"Added by the RBOT-QN WORM!"
X	Windows Firewall Log	winlog.exe	Added by an unidentified WORM or TROJAN!
X	Windows Log Agent	winlogon.exe	"Added by the KEYLOGGER.AVK TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
X	Windows Logger	winlog.exe	"Added by the NSHADOW-B TROJAN!"
X	Windows logging	winlogd.exe	"Added by the RBOT-ON WORM!"
X	Windows Login	winlog.exe	"Added by the AGOBOT.MG WORM!"
X	Windows Login Manager	winlogin.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Login Security	winlogin.pif	Added by an unidentified WORM or TROJAN!
X	Windows Login Service	winlog.exe	"Added by the RBOT-AFN WORM!"
X	Windows Login Service	winlogin.pif	"Added by the SDBOT-ACU WORM!"
X	Windows Logon	winlogin.exe	"Added by the SPYBOT-C TROJAN!"
X	Windows Logon	winlogon.exe	"Added by the VB.HE VIRUS! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\system"
X	Windows Logon Application	winlogon.exe	"Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process
X	Windows Logon Applicationedc	winlogon.exe	"Added by the DWNLDR-HGR TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Applicatonedc	winlogon.exe	"Added by the VB-EBV TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	windows logon procedure	winlogonpc.exe	"Added by the WINLOGON TROJAN!"
X	Windows Logon Service	winlogon.pif	"Added by the RBOT-AOU WORM!"
X	Windows Logon Service	winlogoservice.exe	"Added by the SPYBOT.ANOO WORM!"
X	Windows mangement	winlogonn.exe	"Added by the RANDEX.FC WORM!"
X	Windows Messanger Control Center	winlogin.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows modez Verifier	winlogom.exe	"Added by a variant of the RBOT WORM!"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows NT Logon Application	winlogon.scr	"Added by the RBOT-ALP WORM!"
X	Windows Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Services Layer	winlogz2.exe	"Added by the RBOT-FZE WORM!"
X	Windows Update	winlogin.exe	"Added by the BANKER-DV TROJAN!"
X	Windows Update	winlogonEvt.exe	"Added by the VB-DXM TROJAN!"
X	Windows Update 32	winlogons.exe	"Added by the FORBOT-FI WORM!"
X	Windows Update Manager	Winlog0n.exe	"Added by the AGENT-BO TROJAN!"
X	winlog	winlog.exe	"Added by the GAOBOT.DF WORM!"
X	winlog	windowxs.exe	"Added by the SDBOT-KT BACKDOOR!"
X	winlog manager	winlog.exe	"Added by the DONBOMB.A TROJAN!"
X	winlog.exe	winlog.exe	"Added by the BCKDR-RBJ TROJAN!"
X	WINLOG0N	WINLOG0N.EXE	"Added by the MYDOOM.BI WORM!"
X	WinLogin	winlogin.exe	"Added by the AGOBOT-IX WORM!"
X	winlogin	win32x.exe	"Browser hijacker
X	winlogin	ReadMe.exe	"Added by the SILLYFDC.BBT WORM!"
X	Winlogin.exe	log.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	winlogin.exe	logfile.exe	Added by the AGENT.AH TROJAN!
X	winlogin.exe	mspaint.exe	Added by a variant of the AGENT.AH TROJAN!
X	Winlogin.exe	steam.exe	Added by a variant of the AGENT.AH TROJAN!
X	winlogins.exe	winlogins.exe	"Added by the OPTIX.H BACKDOOR!"
X	winlogoff	winlogoff.exe	"Added by the AGOBOT-TR WORM!"
X	winlogon	winlogin.exe	"Added by the RANDEX.E WORM!"
X	winlogon	winlogon.exe	"Added by the TRODAL TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	winlogon	msreg32.exe	"Added by the SDBOT.EO WORM!"
X	winlogon	winlogon32.exe	"Added by the MASLAN.C WORM!"
X	winlogon	wpwlogon.exe	Added by an unidentified WORM or TROJAN!
X	WINLOGON	wscript.exe WINLOGON.vbs	"Added by the YSPAN.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WINLOGON.vbs"" file is found in %System%"
X	Winlogon	Lsass.exe	"Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	winlogon	nvchost.exe	Added by an unidentified WORM or TROJAN!
X	Winlogon	WINLOGON.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate winlogon.exe process
X	winlogon	system.exe	Added by a variant of the DELF.CNS TROJAN!
X	winlogon	cleanmg.exe	"Added by the AGENT-ICR TROJAN!"
X	Winlogon	scssrr.exe	"Added by the AGENT-LXB TROJAN!"
X	winlogon service	urx.exe	"Added by the SPYBOT.EN WORM!"
X	Winlogon Shell	Explorer.exe svchost.exe	"Added by the KIPIS.M WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""1032"" sub-folder"
X	Winlogon.exe	N/A	"CoolWebSearch parasite variant - resets home page to an adult content site"
X	winlogon.exe	helper.exe	"Added by the FAKESPY-A TROJAN!"
X	winlogon.exe	msole32.exe	"Adware
X	winlogon32_	[path to file]	"Added by the RULAND.A WORM!"
X	WinLogonnd	winlogonnd.exe	"Added by the AGENT-NNQ TROJAN!"
X	winlogon_user	ccIsass.exe	"Added by the SILLYFDC.BBT WORM!"
X	Winlogun	winlogin.exe	"Added by the P2LOAD-C WORM!"
X	WMAudio	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	WSAConfiguration	winlogon32.exe	"Added by the AGOBOT-WC WORM!"
X	xpstat	winlogins.exe	"Added by the RBOT-AAR WORM!"
X	xp_system	winlogon.exe	"Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe
X	[various names]	winlogon32.exe	Added by an unidentified WORM or TROJAN!

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.