I had this trojan on a private system that I worked on and the only thing I could identify this with was process explorer.
Stu At 02:08 PM 3/1/2005 -0500, you wrote: >Don't know about the 22MB of RAM, but it is possible to have multiple >WinLogon's under normal conditions...for example TermServ will create an >additional one. > >Try using Process Explorer from sysinternals to determine if one of the >WinLogon's is not the standard windows process. > >Darin. > > >----- Original Message ----- >From: "Matrosity Tech Support" <[EMAIL PROTECTED]> >To: <[email protected]> >Sent: Tuesday, March 01, 2005 1:55 PM >Subject: [IMail Forum] OT: Winlogon.exe > > >I'm at a loss this afternoon with regard to having two winlogon.exe's >running on our mail server. I'm read A LOT about the winlogon trojan but >every test I can find doesn't detect it on my server. I've run two virus >scanners on the box, downloaded Symantec's detector but I still cannot >find that I have the trjoan but I have a winlogon.exe that's using 22 >MB's of ram? > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
