Multiple Programs – LOGONUI.EXE

Logonui.exe is the executable for the Microsoft Logon User Interface. This program runs when you logon or off or when you switch users via the Microsoft Windows XP user switching screen. Often users will edit this file to change the appearance of the logon screen. This file will appear in your Windows\System or System32 folder. If you run WinPatrol 10.x or later, you may see logonui.exe.manifest under your Hidden files. This is perfectly normal as this is a hidden,system, read-only file.

Unfortunately, this file also installs with the Backdoor.IRC.Zcrew.B virus. This file will appear in a folder called c:\Windows\system32\wbem\repository\fs\macromed\. This virus can allow a remote user to access your PC via IRC chat or FTP. This remote user could download, install, run or delete files. If you have this instance of the program, we'd recommend removing it via WinPatrol. First kill it under Active Tasks then remove it from your Startup Programs. If running WinPatrol 8.x or later, right click the file then select Delete File on Reboot. Additional background info on this virus can be found at http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.zcrew.b.html.

Safe if not Virus

Microsoft