The winlogon.exe could be a NEVEG.A. Sometimes it’s called IRCBOT and ROMARIO-A.
It’s not absolutely clear which product this file is part of and who is its author. It’s a hidden file. This files starts on Windows startup. Winlogon.exe is usually located in the %SYSTEM% sub-folder and its usual size is 57 bytes.
This file is a trojan. Trojans can steal important data from your computer. This file is a network worm. Worms can significantly decrease your Internet connection speed and download new malware onto your computer. This file enables a culprit to access your computer, steal your data, and take total control over your computer.
Disable and delete the winlogon.exe process as soon as possible. Most likely it is a virus, a trojan, or some other malware. Before disabling this file make sure it is not a legitimate file that is also called winlogon.exe.
We also recommend scanning your computer.
Process: NEVEG.ACommon path(s): subfolder in %SYSTEM%
subfolder in %WINDOWS%
subfolder in %DOCS_SETTINGS%
subfolder in C:Keywords(s): worm, startup, trojan, backdoor, monitor, hiddenFilesize(s): 57 bytes, 61,440 bytes, 37,662 bytes, 47,274 bytes, 65,536 bytes, 143,360 bytes, 82,024 bytes, 32,338 bytes, 48,907 bytes, 46,220 bytes, 39,424 bytes, 35,996 bytes, 32,744 bytes, 94,208 bytes, 32,335 bytes, 106,908 bytes, 42,654 bytes, 50,151 bytes, 62,091 bytes, 23,632 bytes, 45,456 bytes, 38,912 bytes, 91,136 bytes, 50,939 bytes, 39,936 bytes, 37,677 bytes, 147,968 bytes, 32,344 bytes, 123,760 bytes, 45,434 bytes, 37,888 bytes, 82,030 bytes, 40,960 bytes, 48,432 bytes