My PC recently became infected with malware and I reformatted my hard drive and noticed that the same conspicuous winlogon.exe file was there. I got its MD5 and it didn't match up with the MD5 I found on another site. Also, the date was 01/15/2011. Right file size though. Am I paranoid or could this thing have punched through the partition into the factory image? Eventually, I got rid of it by reinstalling Windows 7 from the DVD. If I'm right about what this is, who do I turn this file over to?

Michael1414, Winlogon.exe is a system file you will see this executable on every operating system. But if you don't trust this file you can boot from your orginal installation media. Seek for all the winlogon.exe occurences copy the files to a directory e.g. C:\Quartine. Boot again in your windows and upload the files to http://www.virustotal.com/ This website will scan the exe with more then +10 virus scanners. If this site doesn't detect any viruses you know that this process is 100% legit. Kind Regards DFTIM me - TWiTTer: @DFTER

Hi Micheal care to share it please submit it a copy here so it can be evaluated maybe its new or undetected still https://www.microsoft.com/security/portal/Submission/Submit.aspx CEH.ECSA.MVP Windows Security