3

I just had to restart my content server because it bogged out. Everything was fine after i restarted IIS and SQL Server, but then i opened the task manager and found the following. I've never seen this before, i'm hoping it's not a virus of somesort. Any info on this would be appreciated.

Command lines are: winlogon.exe = winlogon.exe

    logonUI.exe = LogonUI.exe /flags:0x0

    csrss.exe = see image below

enter image description here

enter image description here

Improve this question
4
  • What's the command line? (View, Select Columns)
    – SLaks
    Commented Sep 27, 2011 at 2:39
  • winlogon.exe = winlogon.exe logonUI.exe = LogonUI.exe /flags:0x0
    – Zee Tee
    Commented Sep 27, 2011 at 3:13
  • Is this a machine used as a terminal services server?
    – Remus Rusanu
    Commented Sep 27, 2011 at 5:27
  • its a web/ftp server.. hope that helps.
    – Zee Tee
    Commented Sep 27, 2011 at 7:34

2 Answers 2

Reset to default
4

I just had the same problem on one of my servers - it turned out to be caused by an attempt to get into the server through Remote Desktop/Terminal Services - either a brute-force or massive dictionary attack (every RDP logon attempt causes LogonUI to spawn). Check your System and Security event logs, they'll contain more information (such as the originating IP of any failed remote logon attempts).

Improve this answer
1
  • Tip: if you are concerned about the resources consumed by these processes, you can change the settings to require NLA. This won't stop brute force attacks, but will prevent failed logon attempts from spawning the processes.
    – Yuhong Bao
    Commented Feb 2, 2014 at 9:52
3

I found it was the morto virus

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus:Win32/Morto.A

Malwarebytes fixes it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .