When I go to taskmgr and click winlogon.exe... and then right click open file location.. nothing happens. Same with csrss.exe and it doesn't say system beside their names. I am asking because I installed winamp and there was a xbundle_offer.exe that was launched with the installation file and asked my comodo defense to be allowed. I allowed it.. but it was probably some free crap spyware. So is this normal?
The Winlogin.exe is one of the main system files and needed running just to reach the desktop. When opening the location up you simply are viewing the "C:\Windows\System32\" folder as expected.
As far as your firewall prompting you that's part of the security inplace. The xbundle_catalog.exe can easily be seen as a malware but most likely a catalog for option offered by Winamp since the information on that shows "Safe". That would tend to be more of an adware then any harmful element as pointed out by one source seen at Is the Process "xbundle_catalog.exe" Safe or Threat ?
It is actually xbundle_offer.exe ... I was misled by a google search. I found it in temp folder with a bunch of dll's. As for winlogon.exe when I right click in taskmgr and hit open location.. nothing happens.
When you open the file location nothing is supposed to happen. You are simply opening up the location on the drive.
That can be a large help if you do get struck with a malware of some type at times however since you can at least the malware exe file over to a new location if not able to delete it on the spot until you can boot up in safe mode.
As for the xbundle_offer.exe no information found besides an info request in Chinese and most likely something Winamps put in there to offer a full version. I haven't had Winamps on for some time now but never found any bugs to worry about being packed into it. Bing used here!
I am confused. I meant when I click 'open file location'.. it doesn't take me to system32 folder and the location of winlogon.exe. It just does nothing. If I am mistaken.. correct me. Thanks
Process name: Windows Logon Application
Product: Windows
Company: Microsoft
File: winlogon.exe
Security Rating:
The process "winlogon.exe" runs in the background. Winlogon is a part of the Windows Login subsystem, and is necessary for user authorization and Windows activation checks.
Note: The winlogon.exe file is located in the folder C:\Windows\System32. In other cases, winlogon.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.
Virus with same file name:
W32.Netsky.D - see McAfee Symantec Corporation Trend Micro
You have to click the button "Show processes from all users" in order to get details on system processes.
What he means is when right clicking on the process listing the Open File Location option in the right click menu isn't doing anything at all. As for the show all processes check box that doesn't even need to be checked off to see the WinLogon.exe listed there.
The one thing I could recommend dfs4 is running the System File Checker to see if that picks up anything corrupted or missing. Simply open a command prompt and type in sfc /scannow, press enter, and watch it run. When finished you can also schedule the Disk Check tool to run on the next startup y typing in chkdsk /r. The Disk Check will generally clean up any errors on the drive that can cause explorer problems at times.
winlogon.exe may be listed but it runs under the SYSTEM account, getting information about the process requires showing process for all users. winlogon.exe cannot be interacted with in task manager until you do, "show processes from all users" as I said.
If I uncheck the show all option here the file is still listed in the processes tab here. But that may since I am running the 64bit 7 which would explain why it is still being listed.
Quote