Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

KEY:

  • L = Legit, O = Open to Debate, X = Malware/Bad

Name Process Details
XNetwork Client (nwclntg)winlogon.exeAdded by the Boxed.E TROJAN!
LNTCHARGEwinlogon.exeRelated to Microsoft Internet Information Services (IIS).
XNTLOADwinlogon.exeOther files in the same directory identified as Win32.Iroffer.b by Kaspersky
XNTP (Network Time Protocol)winlogon.exeAdded by the Troj/Jtram-D TROJAN! Note: This trojan file is found in the System32Client folder.
XNTSVCMGRwinlogon.exeOther files in the same directory identified as Win32.Iroffer.b by Kasperksy
ONTSVCMGRwinlogon.exeCreates a file win32.dll C:windowssystem32 and the old one is renamed win32.dll.bkup
XService)winlogon.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:%WINDIR%
XService)winlogon.exeAdded by the W32/Tilebot-FR WORM!Note: This is not the legitimate Windows process (Which is always f
XWindows Kernel Serviceswinlogon.exeAdded by an unknown variant of a backdoor TROJAN! Note: This worm rojan is located in C:%WINDIR% Do
Xwindows logonwinlogon.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:%WINDIR%
XWindows NTwinlogon.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:%WINDIR%
XWindows NT Logon Application (WINLOGON)winlogon.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:%WINDIR%
XWindows Object Managerwinlogon.exeW32.Banish.A@mm - Symantec Description: Randomly copied characteristics of an already existing servi
XWindows Process Viewer (The Windows Process Viewer)winlogon.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:%WINDIR%
XWindows XP Advanced User LauncherWINLOGON.EXEAdded by the SDBOT.CPV WORM! Note: This is not the legitimate Windows process WINLOGON.EXE (Which is