Infected with Winlogon.exe

[amitraina]

hi
plz help me abut this problem .
when i scan my my computer with malwarebyte then it detect this (C:\windows/winkeylogon.exe). .i don't Know if i delete this or not.
also when i scan my pc with bitdefefender 2011 ,trend micro pro2010,AVG 9, Spyware antispyware, Pc tool Internet Security 2010,Norton 360 V4 these Antivirus didn't detect this . and i also consult to the norton technician they said its safe and also when i check it in norton insight aapllication rating its trust level is good.
also trend micro technician said it safe .
plz if anybody know abut this then tell me whether it safe or not

[Boyfriend]

You have not mentioned your OS.
There is no winkeylogon.exe file in default installation of Windows XP or Windows 7. It is suspicious file. Check it via VirusTotal. Also, report at MBAM forum.

[Ande]

I've only seen reports that this is malware. I know I don't have it on my windows 7 machine.
Have you searched the web for this file?

[SomeOne]

Winkeylogon.exe is not detected as threat and is reported as SAFE. You may probably need to check your file details to match this one:

File name: winkeylogon.exe File size: 324 KB (331776 bytes) Md5: 1f03e51fa31bd559b90ab0281734afa1
If the Md5 is indeed different, then you may need to be aware of awkward activities: frequent BSOD or crazy bandwith transfer (based on my quick research). If you feel suspicious, then you need to ask your MBM to just quarantine it instead, making life easier.

[amitraina]

window xp sp3

---------- Post added at 08:09 PM ---------- Previous post was at 07:58 PM ----------

someone its size is 324 KB idon't know abut this MD5 when i scan with virustool then the result is below
Virus Total
Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
winkeylogon.exe
Submission date:
2010-08-28 14:35:29 (UTC)
Current status:
queued queued analysing finished
Result:
0/ 40 (0.0%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.08.29.00 2010.08.28 -
AntiVir 8.2.4.46 2010.08.28 -
Antiy-AVL 2.0.3.7 2010.08.26 -
Authentium 5.2.0.5 2010.08.28 -
Avast 4.8.1351.0 2010.08.28 -
Avast5 5.0.594.0 2010.08.28 -
AVG 9.0.0.851 2010.08.28 -
BitDefender 7.2 2010.08.28 -
CAT-QuickHeal 11.00 2010.08.28 -
ClamAV 0.96.2.0-git 2010.08.28 -
Comodo 5888 2010.08.28 -
DrWeb 5.0.2.03300 2010.08.28 -
Emsisoft 5.0.0.37 2010.08.28 -
eSafe 7.0.17.0 2010.08.26 -
eTrust-Vet 36.1.7823 2010.08.27 -
F-Prot 4.6.1.107 2010.08.28 -
F-Secure 9.0.15370.0 2010.08.28 -
Fortinet 4.1.143.0 2010.08.28 -
GData 21 2010.08.28 -
Ikarus T3.1.1.88.0 2010.08.28 -
Jiangmin 13.0.900 2010.08.28 -
Kaspersky 7.0.0.125 2010.08.28 -
McAfee 5.400.0.1158 2010.08.28 -
Microsoft 1.6103 2010.08.28 -
NOD32 5404 2010.08.28 -
Norman 6.05.11 2010.08.28 -
nProtect 2010-08-28.01 2010.08.28 -
PCTools 7.0.3.5 2010.08.28 -
Prevx 3.0 2010.08.28 -
Rising 22.62.05.03 2010.08.28 -
Sophos 4.56.0 2010.08.28 -
Sunbelt 6806 2010.08.28 -
SUPERAntiSpyware 4.40.0.1006 2010.08.28 -
Symantec 20101.1.1.7 2010.08.28 -
TheHacker 6.5.2.1.356 2010.08.26 -
TrendMicro 9.120.0.1004 2010.08.28 -
TrendMicro-HouseCall 9.120.0.1004 2010.08.28 -
VBA32 3.12.14.0 2010.08.27 -
ViRobot 2010.8.28.4013 2010.08.28 -
VirusBuster 5.0.27.0 2010.08.27 -
Additional information
Show all
MD5 : 1f03e51fa31bd559b90ab0281734afa1
SHA1 : 08e8184fdfe73b2b716111df150e33d9bde545c7
SHA256: 888981cb36d1904aba4fa59e79f6f36a2124fcebbb0150a67b3a7f5271c41570

[excite..]

You take a look here

[amitraina]

nop i didn't search it in on the web

[Boyfriend]

Winlogon.exe is important windows file (also protected by Windows File Protection by default), but winkeylogon.exe is not part of windows installation.

Moreover, in title you have mentioned "Winlogon.exe", while in description you are referring to "winkeylogon.exe". Correctly mention file name for further assistance.

[amitraina]

its winkeylogon.exe

[putingcow]

run task manager if you have only one winlogon then its ok,if there's 2 then the one is a malware. on other hand read about winkeylogon.exe here