Noo ! Why do you think this ?

[confus-ed]

if you have winlogin.exe running as a process, you have Wintools. (then you give a link for a removal sequence that I didn't cut 'n' paste)..

So why do you think this ? Its meant to run as a process, all the time ? .. isn't it ? It lives in c:\windows\system32, its when you've got 'other' copies its a problem ?

& I'm also confus-ed about 'wintools' whats that ? - I found this (http://www.wintools.net/) which appears to be some utils bundled & looks innocuous ?

[corturbra]

(then you give a link for a removal sequence that I didn't cut 'n' paste)..

So why do you think this ? Its meant to run as a process, all the time ? .. isn't it ? It lives in c:\windows\system32, its when you've got 'other' copies its a problem ?

& I'm also confus-ed about 'wintools' whats that ? - I found this (http://www.wintools.net/) which appears to be some utils bundled & looks innocuous ?

It may be a mis-type but winlogon.exe is required for the Ctrl-Alt-Del screen, not sure about winlogin.exe though. Sorry I'm not Noo Noo by the way but as I was passing thought I'd chuck in some knowledge! ;)

[NooNoo]

Every entry I see with winlogin.exe has an entry for wintools....mebbe coincidence that when you get randex trojan (http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.e.html) you get wintools as well.... or wintools uses the trojan.

[confus-ed]

It may be a mis-type but winlogon.exe is required

Awww well then , you may have a point about MIS-TRIPES & that may be exactly what I'm talking ;) - so in that case only the second bit stands as a question ! :D - bloody confus-ed again - I think I might be needing glasses :rolleyes: (Perhaps for clarity {or other 'blind gits'} then that might be worth noting on that thread ?)

[confus-ed]

Every entry I see with winlogin.exe has an entry for wintools....mebbe coincidence...

Wintools seems to be offered by various folks at various sites for free (Other than the 'official one' I posted), so no doubt some of those aren't 'so nice' & have some trojan lurking in them, it wasn't a thing I was aware of at all until I noted your comments ;)

So I think thats the end of my minor confusion then :thumbs:

[geoscomp]

the WinTools that is spyware is a huntbar /ibis toolbar variation that likes to reinstall itself after removal..not the same as the utilities that are called Wintools

[confus-ed]

the WinTools that is spyware is a huntbar /ibis toolbar variation that likes to reinstall itself after removal..not the same as the utilities that are called Wintools

Ta Geoscomp for the further bit of un-confus-ing :thumbs:

So like this then ! (http://www.kephyr.com/spywarescanner/library/bubba.wintools/index.phtml) (this one calls it 'Bubba.wintools', it was the lack of the word itself in Noo's 'explain' that left me a little confus-ed ;))