I have listed several sites as blocked in ZA_Firewall_Zones.
On the log-viewer/programs section, ZA reports it blocked multiple winlogon.exe sending data to two sites that i have blocked.

ZA response seems clear.. My questions:
1. winlogon.exe is supposed to be a legit OS-file
Why would be winlogon such a naughty boy?
Searching my sys-files I find a report of two copies of winlogon,
in C:\WINDOWS\system32 +in C:\WINDOWS\system32\dllcache, both v.5.1.2600.2180
my search-program (locate32=great) reports 2 copies in each of these folders. Opening the
folder, I see only one of course...
2. Could that winlogon-guy send data to other sites that I did not specifically block in ZA and ZA
would not mind?
3. Since the same event repeats, (way after logon), can I stop winlogon and -relieve- ZA?

Thanks!

Operating System:Windows XP Home Edition
Product Name:ZoneAlarm Internet Security Suite
Software Version:6.5