modified winlogon is this a real threat

[Guest]

[donut53]

After running CCE quick scan it showed one threat. I choose to ignore the threat for now and ran a scan using CIS. The results of CIS scan were no threats found. Here is the text info from the CCE scan.

====== System Information ======
Computer Name:   HPDESKTOP
Log on User:   John
Memory Size:   7.75 GB.
Windows Directory:   C:\Windows
Windows Version:   7 (64bit)
CCE Version:   2.5.242177.201

Virus database version: 13147

[12:45:29] Scan started.
====== Cleanup results ======
Global   WINLOGON   SYSCHANGE   Ignore   OK

What should I do?

[EricJH]

Please check the digital signature of the winlogon file to see it has a valid digital signature by Microsoft.

To know for sure that winlogon.exe is the original file you can use Sigcheck to see if it is digitally signed by Microsoft.

Download this zip archive and unpack it to C:\Program Files\SysinternalsSuite\ . When done run sigcheck.reg to add it to the registry.

When this is done navigate to the system32 folder, look up and select winlogon.exe click right and choose  Signature from the context menu. A black command box will pop up. See if it is signed or not.

[donut53]

Please check the digital signature of the winlogon file to see it has a valid digital signature by Microsoft.

To know for sure that winlogon.exe is the original file you can use Sigcheck to see if it is digitally signed by Microsoft.

Download this zip archive and unpack it to C:\Program Files\SysinternalsSuite\ . When done run sigcheck.reg to add it to the registry.

When this is done navigate to the system32 folder, look up and select winlogon.exe click right and choose  Signature from the context menu. A black command box will pop up. See if it is signed or not.

I am unable to get a black command box to open.. I right click on the file and select signature but then I get a box asking what program to open the mui file..

[EricJH]

That's odd and has me stuck for answer....  

I asked the other mods to take a look at this problem.

[Ronny]

Please run the extra tool 'Autoruns' and click on the 'Winlogon' part in the left menu.
Then post a screenshot of the results please so we might see what has been changed.

[donut53]

Please run the extra tool 'Autoruns' and click on the 'Winlogon' part in the left menu.
Then post a screenshot of the results please so we might see what has been changed.

Here it is and I also provided screenshot of the cce scan..

Does it make sense to you that CCE would show a threat but CIS does not?

[jay2007tech]

how about this

Click on "start"
Click on "All Programs"
Click on "Accessories"
Click on "Command Prompt"  <---------Right Click on - RUN AS ADMIN
type in  "sfc /scannow"       <----without the "      "

[donut53]

how about this

Click on "start"
Click on "All Programs"
Click on "Accessories"
Click on "Command Prompt"  <---------Right Click on - RUN AS ADMIN
type in  "sfc /scannow"       <----without the "      "

Ran sfc /scannow earlier today and no problems or issues were found..

[jay2007tech]

Ran sfc /scannow earlier today and no problems or issues were found..

If thats your only issue, I wouldn't worry about it

[languy99]

go to start and type msconfig,  please post a pic of each tab. Thanks

[Ronny]

There are several stages of 'winlogon' e.g. in win.ini and system.ini, registry etc.
The CCE entrie doesn't show a clue where to look for modified things, I'd suggest to run a MBAM scan to see if that shows more details.

[EricJH]

Just thinking out loud. May be it is responding to the file not found situation? Try disabling the autorun entry with the file not found error and try again.

Also try running checkdisk to see if the file system is intact. Run chkdsk /f from the command prompt and allow Windows to run chkdsk on the next boot.

[donut53]

go to start and type msconfig,  please post a pic of each tab. Thanks

Here they are

[donut53]

Just thinking out loud. May be it is responding to the file not found situation? Try disabling the autorun entry with the file not found error and try again.

Not sure what you want me to do.. Please help me understand.. ty


Fixed the quote. Eric

[donut53]

There are several stages of 'winlogon' e.g. in win.ini and system.ini, registry etc.
The CCE entrie doesn't show a clue where to look for modified things, I'd suggest to run a MBAM scan to see if that shows more details.

Do you think this is even an issue.. MBAM and CIS do not find any threats.. Only CCE

[Tags:]