Results 1 to 6 of 6

Thread: www.notyourbusiness.com - winlogon.exe is trying to connect to this site

  1. #1
    hjpnj Guest

    Default www.notyourbusiness.com - winlogon.exe is trying to connect to this site

    I been receiving an alerts that winlogon.exe is trying to connect to 67.19.31.194:53 and 67.19.31.194:80 (www.notyourbusiness.com). I checked to make sure that winlogon.exe is in the proper location: c:\windows\system32\winlogon.exe. I've blocked the IP address so it won't allow any outgoing messages. I ran full Symantec Norton Antivirus (2006) and Webroot Spy Sweeper v4.5 scans and found no viruses, spyware or malware. Any Ideas on how I can stop these outgoing connection attempts?
    Thanks,
    Hank



    Operating System:Windows XP Pro
    Product Name:ZoneAlarm Internet Security Suite
    Software Version:6.1

  2. #2
    billc Guest

    Default Re: www.notyourbusiness.com - winlogon.exe is trying to connect to this site

    As you probably know, there is a valid winlog.exe application that is part of your Microsoft OS, and a Trojan by the same name. It is in the right place to be valid, but just for kicks, I'd suggest you use the Kaspersky online file scan to scan this particular file. If all is well, then go to your Zone Alarm Programs list, right click on winlog.exe then click to 'remove it. If it tries to get out again, you should get a new Zone Alarm program alert, click 'deny' and the 'remember this' box. See if that works.

  3. #3
    hjpnj Guest

    Default Re: www.notyourbusiness.com - winlogon.exe is trying to connect to this site



    Bill,

    Thanks
    for your response... I ran the online scan as you suggested and the file came up clean. I'm aware if that if
    winlogon.exe is located any
    place other
    than in the c:/windows/system32/ directory it's probably a Trojan. As for deleting winlogon.exe from the program list in ZoneAlarm Pro; when I blocked access to it I was no longer able to connect to the internet. In order to
    reconnect I had to change the setting from AUTO
    to CUSTOM.


    I'm baffled...If you think of anything else please let me know.

    Thanks again,




    Hank

  4. #4
    billc Guest

    Default Re: www.notyourbusiness.com - winlogon.exe is trying to connect to this site

    Hank. I looked at the IP you posted and it belongs to ThePlanet.com Internet Services, Inc. in Texas. Is this associated with your ISP or business in any fashion?

  5. #5
    hjpnj Guest

    Default Re: www.notyourbusiness.com - winlogon.exe is trying to connect to this site



    Bill,

    My ISP is
    Comcast broadband and I'm located in central New Jersey. If I work from home I VPN
    using a
    company asset (laptop). I don't see any reason that I would be associated with that ISP. My desktop is the only PC
    connected to a
    hardwired Linksys router with the latest firmware updates.
    Are there any (hopefully freeware) network traffic monitoring and packet sniffing
    apps that you would recommend? I'd really hate to have to reformat the PC without finding out the root cause of this.

    Thanks again,

    Hank

    P.S.

    I use the Microsoft fingerprint reader to login to various sites. Am I correct to assume that
    if I setup my
    logins and passwords PRIOR to the instillation of a keylogger
    that I would be safe because I'm not using any keystrokes?



  6. #6
    billc Guest

    Default Re: www.notyourbusiness.com - winlogon.exe is trying to connect to this site

    Yes, as a matter of fact I've used NetworkActiv and found it to be most helpful. I'm talking about the freeware version.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •