BMWhere?

Was chacking my Yahoo mail yesterday and Norton firewall popped up saying that "winlogon.exe was trying to access the internet".

I've no idea what this is, but I would assume by the name its something to do with managing the login to windows (I'm using XP-pro with login prompt). If so, why on Earth does this program ever need to access the internet. In fact, I would think this would be a major security risk! Naturally I blocked the access and things worked fine.

Logged in today and after using the computer for about 30 minutes I got a message box saying winlogon.exe had a fatal error and was being terminated! Windows carried on working with no problems!

Just wondering if anyone knows what this program is/does? Will my blocking access to the internet cause it to crash?

darlodge

see here

I'd say grant it access if it asks again.

Darren

boomer

...or also see: here

mb

BMWhere?

Cheers for the info boomer!

I had two copies of winlogon.exe, one in the system32 folder and one in the root windows folder. Ran cwshredder and it deleted a spyware virus. winlogon.exe in the root windows folder has now dissapeared.

Bit p1ssed off this got through Norton antivirus

Guess it was a good idea to not allow access to the internet!

Side effect of the virus was to change my browsers homepage and default seach page to search-town.net When you change your hompage back to whatever, in resets back to search-town.net every time you log in again

Redkop

Try running this stand-alone Windows disinfector from Sophos

Go to where to where it says......

NTSKYGUI is a disinfector for standalone Windows computers

open NTSKYGUI
run it
then click GO.

Nick

"Bit p1ssed off this got through Norton antivirus "

Norton always lets through viruses, it's rubbish software. Use either McAfee or Panda. All of my customers use McAfee & no-one has EVER been zapped. Whenever I get a new customer that has Norton, I always run a stand-alone virus check using McAfee & the Norton pc is invariably infected with something.

boomer

BMWhere?

glad you found that web-site useful - it is one of my favo(u)rites. I can't claim all the credit though, as i first found it via, er, ScoobyNet

As for Norton - well i currently use it, and it does seem to catch most viri(um,er) - but...

It crashes my pooter at (i)regular intervals.
It used to connect to the Internet for no apparent reason
It uses a HUGE amount of resources (138+ threads ATM!)
I downloads MASSIVE amounts during liveupdates, and they ain't just virus definitions - (IFAIAC) they are bug-fixes to crappy code that you have already paid for!!!
The interface is sh1te

Oh, and it is just about to download 1372.6KB of (live)updates, of which only 228.4KB are actual new virus definitions

Thus i have a copy of McAffee 2004 (AV&FW) waiting in the wings until i get totally pi55ed off (or my NIS subscruption expires).

mb

BMWhere?

I've been happy with Norton upto now! I used to use McAffee and still do on my work PC but had loads of software compatability problems on the home pc and have had email viruses creep through at work Really not been happy with McAffee

I've been away for nearly 2 weeks and live update didn't run until after I got the firewall warning, so I'm thinking that the virus got through while the virus definitions were out of date.

All the info I can find on the web says the modified homepage is seach-town.com, however in my case it was search-town.net. I'm guessing its a new varient that's possibly not been added to virus definitions yet.

darlodge

Doh, **** up by me

Darren

Sith

Use mcafee and so do work. Top package IMO.

BMWhere?

Doh! More investigating done and I got the virus from a spam mail which was filtered by outlook 2003 to the junk folder. New installation of outlook and not set up properly. I had disabled the preview frame in inbox but this was the first time I looked in the junk folder as it was the first junk mail I received. Mail showed up in the preview pane and I immediately disabled the preview pane (also for deleted items folder at the same time)... but too late, virus already installed Damn Microsoft - why isn't the preview pane desabled by default, particularly in the junk folder

Iain Young

I stopped using McAfee and switched to Norton on my home machines because I found it let several viruses through. Not tried Panda, but a friend has, and has had similar problems, (resorted to a reformat of the drive and starting again in the end because the infection was so bad).

Basically there is not a 100% reliable virus checker on the market today, and even the most reliable ones are only as good as the last time you updated them....

Edited to add that we use norton (corporate edition) on our machines at work, (which total well over a thousand in offices around the globe), and have never had a virus infection problem in the 4+ years we've been using it. We may have been lucky, but to say that Norton is rubbish is simply incorrect.

Iain

ozzy

As Iain has already pointed out there's nothing out there that can guarantee 100% protection. The effectiveness of any anti-virus software is how frequently it's updated to check for new viruses. I have to say that McAfee have been very good on releasing updates if the threat is severe.

We use McAfee and our Corporate network has never been infected in the 3yrs I've been here.

I do know of two extremely large corporates (10,000+ users Worldwide who've had a few infections simply because the software wasn't kept up-to-date).

Stefan