up vote 1 down vote favorite
share [g+] share [fb]

I just had to restart my content server because it bogged out. Everything was fine after i restarted IIS and SQL Server, but then i opened the task manager and found the following. I've never seen this before, i'm hoping it's not a virus of somesort. Any info on this would be appreciated.

Command lines are: winlogon.exe = winlogon.exe

    logonUI.exe = LogonUI.exe /flags:0x0

    csrss.exe = see image below

enter image description here

enter image description here

link|improve this question
What's the command line? (View, Select Columns) – SLaks Sep 27 '11 at 2:39
winlogon.exe = winlogon.exe logonUI.exe = LogonUI.exe /flags:0x0 – Zee Tee Sep 27 '11 at 3:13
Is this a machine used as a terminal services server? – Remus Rusanu Sep 27 '11 at 5:27
its a web/ftp server.. hope that helps. – Zee Tee Sep 27 '11 at 7:34
feedback

migrated from stackoverflow.com Sep 27 '11 at 5:55

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 1 down vote

I just had the same problem on one of my servers - it turned out to be caused by an attempt to get into the server through Remote Desktop/Terminal Services - either a brute-force or massive dictionary attack (every RDP logon attempt causes LogonUI to spawn). Check your System and Security event logs, they'll contain more information (such as the originating IP of any failed remote logon attempts).

link|improve this answer
feedback
up vote 0 down vote

I would type msconfig into Run in the Startmenu that way you can see what is starting on start up in your server. try googleing all the user/start up services this way you will know exactly what is starting up. hope this helps

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.