What is "Windows NT Logon Application"?

I run Zone Alarm to monitor traffic in and out. I have marked most regular applications as OK (authorized) to send and receive regularly. But other apps, I like to watch until I know what they are. One that shows up every day is "Windows NT Logon Application" (winlogon.exe). It asks for internet access each day and runs a few seconds, then it's quiet. What is it? Am I safe to give it permanent access? -thanx, GG.

 

Forgot to mention this: I am running Windows 2000 Pro, and The Zone Alarm version is 3.7.202. --GG

 

The answer is yes/no/sorta/maybe/it depends.

First step is to check for occurances of winlogon.exe on your PC. You absolutely should have a copy in \winnt\system32. However, if you also have a copy in \winnt then you almost certainly have a worm and probably Netsky.

If that is clean, I'd suspect that winlogon.exe is doing checks based on mapped network drives (including desktop shortcuts to network resources and I'm guessing, internet as well). Default behavior is for the PC to look for shared printers and scheduled tasks on the network resources when connecting and I think this may be a function of the winlogon.exe. If so, this behavior can (and IMO should) be stopped unless you know you need it. Couple of registry tweaks that will take care of it.

 

Newt: The exe file was found where it belongs. The only other copies were in two backup folders (uninstall something and service pack something). They were older versions. I deleted them and I am still alive. Thanks/ GG

 

Glad to hear that.

You might want to take a look at This thread for some tweaks you can make. It's in the XP section but I think the same instructions will work for either OS.