Prevx Research Division
LOGONUI.EXE
Cloaked MalwareThe most common objects with the name of LOGONUI.EXE are considered safe.
You can use our free Webroot Cloud AntiVirus Beta to thoroughly check your PC for spyware and other infections. It is free and takes less than 2 minutes to run. To start the scan just click the blue button.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Cloaked Malware
File Behavior
LOGONUI.EXE has been seen to perform the following behavior:
- Registers a Dynamic Link Library File
- The Process is packed and/or encrypted using a software packing process
- Executes a Process
- This process creates other processes on disk
- Can communicate with other computer systems using HTTP protocols
- Downloads hidden code from covert web sites
- Downloads program file(s) and other content from the web
- Creates new folders in the file system
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Includes file creation code which could be used to test for interception by security products
- Visits web sites on your PC without you knowing
- The Process is polymorphic and can change its structure
LOGONUI.EXE has been the subject of the following behavior:
- Deleted as a process from disk
- Created as a process on disk
- Has code inserted into its Virtual Memory space by other programs
- Executed as a Process
- Executed from Temporary Folders
- Registered as a Dynamic Link Library File
- This program is often downloaded from the web
- Added as a Registry auto start to load Program on Boot up
Country Of Origin
The filename LOGONUI.EXE was first seen on May 31 2007 in the following geographical regions of the Webroot community:
- Europe on May 31 2007
- Ethiopia on May 31 2007
- Spain on Jun 2 2007
- Italy on Jun 2 2007
- The United States on Jan 15 2008
- South Africa on May 23 2012
File Name Aliases
LOGONUI.EXE can also use the following file names:
- DVDPLAY.EXE
- SERVICES.EXE
- EXPLORER.EXE
- ATI2EVXX.EXE
- REGSVR32.EXE
- MMC.EXE
- WUACLT.EXE
- ATTRIB.EXE
- CHKDSK.EXE
- IEXPLORE.EXE
- SPOOL32.EXE
- REGEDIT.EXE
- JAVAW.EXE
- WUAUCLT.EXE
- MSIEXEC.EXE
- DEXPLORE.EXE
- NOTEPAD.EXE
- CSRSS.EXE
- CHKNTFS.EXE
- MSDTC.EXE
- RUNDLL.EXE
- SDEXE.EXE
- TASKMGR.EXE
- NSLOOKUP.EXE
- USERINIT .EXE
- PING.EXE
- WUAUBOOT.EXE
- LOGONUI_BLUE.EXE
- LOGONUI_.EXE
- ĄZ
- 3CORONA2KOLD.EXE
- !UPDATE.EXE
Filesizes
The following file size has been seen:
- 592,384 bytes
- 6,029,312 bytes
- 70,656 bytes
- 3,379,200 bytes
- 531,968 bytes
- 515,584 bytes
File Type
The filename LOGONUI.EXE refers to many versions of an executable program.
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.