What is winlogon86.exe?

winlogon86.exe is part of Microsoft® FrontPage® 2000 and developed by Microsoft Corporation according to the winlogon86.exe version information.

winlogon86.exe's description is "Microsoft FrontPage Server Extensions"

winlogon86.exe is usually located in the 'C:\WINDOWS\system32\' folder.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on winlogon86.exe:

PropertyValue
Product nameMicrosoft® FrontPage® 2000
Company nameMicrosoft Corporation
File descriptionMicrosoft FrontPage Server Extensions
Original filenameADMIN.EXE,AUTHOR.EXE
Legal copyrightCopyright © 1995-1999 Microsoft Corporation, All rights reserved.
File version4.0.2.7523

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product nameMicrosoft® FrontPage® 2000
Company nameMicrosoft Corporation
File descriptionMicrosoft FrontPage Server Extensions
Original filenameADMIN.EXE,AUTHOR.EXE
Legal copyrightCopyright © 1995-1999 Microsoft Cor..
File version4.0.2.7523

Digital signatures [?]

winlogon86.exe is not signed.

Hashes [?]

PropertyValue
MD582a4e271a44203524660dc6797108504
SHA2560f36148422775e5513fcbc62cfa0b1d6f5d21c072be0f1e11b1656c8632e2797

Error Messages

These are some of the error messages that can appear related to winlogon86.exe:

winlogon86.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

winlogon86.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

Microsoft FrontPage Server Extensions has stopped working.

End Program - winlogon86.exe. This program is not responding.

winlogon86.exe is not a valid Win32 application.

winlogon86.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with winlogon86.exe?

To help other users, please let us know what you will do with winlogon86.exe:



What did other users do?

The poll result listed below shows what users chose to do with winlogon86.exe. 80% have voted for removal. Based on votes from 45 users.

User vote results: There were 36 votes to remove and 9 votes to keep

NOTE: Please do not use this poll as the only source of input to determine what you will do with winlogon86.exe.

Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

Please select the option that best describe your thoughts on the information provided on this web page


Free online surveys

And now some shameless self promotion ;)

A screenshot of FreeFixer's scan result.Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.

If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

Roger Karlsson writes

4 thumbs

winlogon86.exe is malware. It came with a faked "Flash Setup" program.

This is the virustotal scan. Only 2/41 anti-virus engine detected this file. It must be a new sample:

http://www.virustotal.com/sv/analisis/0f36148422775e5513fcbc62cfa0b1d6f5d21c072be0f1e11b1656c8632e2797-1258726426

# 20 Nov 2009, 6:17

Roger Karlsson writes

0 thumbs

winlogon86.exe is added to the Windows Registry under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, UserInit

This will start winlogon86.exe right after logging on to the infected system. winlogon86.exe displays the following faked message:

--
Spyware Alert!
Security Warning!

Worm.Win32.NetSky detected on your machine.
This virus is distributed via the internet through e-mail and Active-x objects. The worm has its own SMTP engine which means it gathers e-mails from your local computer and re-distributes itself. In worst cases this worm can allow attacher to access your computer, stealing passwords and personal data. Viruses can damage upir cpnfidential data and work on your computer. Continue working in unprotected mode is very dagnerous.
--

Screenshot here:
http://4.bp.blogspot.com/_tUgxW0VPLAY/SxDl7RfgKCI/AAAAAAAAAKQ/U_y9QK_D6K8/s1600/worm-win32-netsky.spyware-alert.PNG

# 28 Nov 2009, 3:03

.Brian. writes

2 thumbs

Having lots of problems with my wife's computer...

Got winhelper86.dll and ran spybot (norton also running). That seems to have killed the internet connection in removing it. Downloaded and ran freefixer, which turned up winlogon86. I deleted that and now I can't log on to windows (type in password and it starts, then logs out and brings me back to the log on page). I can't boot in safe mode either.

Did I erase the wrong file, causing the log on problems or what?

# 1 Dec 2009, 10:04

PIH writes

1 thumb

I have the same problem, which I haven't been able to fix yet.

# 1 Dec 2009, 11:07

Roger Karlsson writes

5 thumbs

@Briand and PIH: When the winlogon86.exe malware installs itself on the system, it copies itself to c:\windows\system32\winlogon86.exe. It also replaces the following registry value:

"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, UserInit = c:\windows\system32\userinit.exe,"

This is an important registry value. If it is missing or set incorrectly it will result in being logged off right after logging in. The malware replace the UserInit value with:

"UserInit = c:\windows\system32\winlogon86.exe"

Unfortunately, FreeFixer v0.49 is not smart enough to see that it needs to restore the UserInit registry value to its default value when the winlogon86.exe malware file is deleted. This will be fixed in FreeFixer version 0.50.


I installed the winlogon86.exe malware on my Win XP lab machine to recreate the automatic logon/logoff problem. This is how I manually restored the UserInit value:

1. I downloaded UBCD4Win on my second machine from http://download.cnet.com/UBCD4Win/3000-2086_4-10550208.html?part=dl-UltimateB&subj=dl&tag=button
2. I installed UBCD4Win on my second machine. I used the UBCD4Win program to create and burn a bootable CD-rom.
3. I moved the new CD-ROM to the infected machine and rebooted it.
4. The infected machine booted from the CD-rom instead of the hard drive. (You might have to configure the BIOS to boot from the CD-ROM before the hard drive)
5. In the first menu that popped up when booting I chose "Launch the Ultimate Boot CD for Windows"
6. When the CD-rom version of Windows had booted completely I started the "Remote Registry" program, which is located on the desktop.
7. The "Select User Profile" dialog popped up. I chose Roger which is my username and the Registry Editor started.
8. In the left pane I located" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon".
9. In the right pane I right-clicked on UserInit, chose Modify and changed the value data to: c:\windows\system32\userinit.exe,
10. I ejected the CD-rom, and restarted the machine.
11. Now I could log in without any problems.

If you have Windows Vista or Windows 7, I think you can boot directly from your installation disk and start a registry editor and restore UserInit from there.

Did that help you fix the problem?

# 1 Dec 2009, 12:36

.Brian. writes

2 thumbs

I ended up just reformatting and doing a fresh install, but thank you for the quick and detailed response! Hopefully I won't run into this again, but it should help others that have problems.

# 1 Dec 2009, 17:46

Clint writes

0 thumbs

Thanks Roger! I only wish I would have found this article earlier. This helped me save my Boss's computer and he is very grateful about that to say the least.

Thanks also for UBCD reference. I never heard of this tool and it is very interesting.

Is there anything else that needs to be removed that you know of now that I am able to login?

# 2 Dec 2009, 14:24

thomas F writes

0 thumbs

Thanks Roger! Great great great !!!
I followed exactly Your 11 points and I saved an infected XP home sp1 of friend. Btw the infection winlogon86.exe was from facebo.Ok; he clikked yes on some link without thinking were he would be led to...BIG mistake :-) He "accidentaly" downloaded winlogon86.exe and no longer could access his XP couse he was stucked at logon.
winlogon86.exe changed the XP registry value as Roger Karlsson found out!

# 6 Dec 2009, 15:32

shane G writes

1 thumb

The virus is smart and prevents must registry programs from running. Running restore is not possible. Another solution is to copy restore.exe to another name like fixthis.exe. You can then run fixthis.exe which allows you to restore the system to an earlier date and time. This may save the hassle of creating a boot usb. Thanks "Roger Karlsson" for information and userinit.exe, that explained what was really happening.

# 8 Dec 2009, 11:52

TakeNotes writes

-1 thumb

I discovered this page while fighting winupdate86.exe. I deleted that nasty program manually, and found other associated files including WINLOGON86.EXE, which I also deleted. Now I discovered my computer would NEVER BOOT UP AGAIN. I had no idea! Your instructions on how to burn a BOOTABLE CD were very helpful, and got my computer back to life again. Thank you.

I have one remaining problem that I will work on today. My wireless adapter is working just fine, but my computer will not connect to internet. I have checked the settings, IPCONFIG, renew, TCPIP protocol settings are good, etc. I finally found some commands to clear the WINSOCK channels. Now Skype is connecting to the internet, but FireFox and Internet Explorer will NOT connect. Not sure why.

# 12 Dec 2009, 12:44

IVAN from Bulgaria writes

2 thumbs

to fix your internet please write in cmd and then - netsh winsock reset

# 18 Dec 2009, 10:30

Andrew Record writes

1 thumb

Renaming the restore.exe utility sounds like the easiest fix but has anyone conquered this virus using just FreeFixer version 0.50?

A lot of my camera and accessory utility files showed up in the freefixer scan. I think the primary file and registry entry names involved with this hack are.

AVR10.exe
critical_warning.html
winhelper86.dll
winupdate86.exe
winlogon86.exe

# 18 Dec 2009, 18:10

TJBennett writes

2 thumbs

Great information.
I got the winlogon86.exe and the winupdate86.exe on my system. I had to boot up in DOS just to see what had happened. From your information, I decided to copy userinit.exe on top of winlogon86.exe. Just to see what would happen. I also deleted winupdate86.exe. I did not have a reg editor on my boot disk to point back to userinit.exe. The system booted up without a problem. I then corrected the userinit.exe entry in the reg. I also found that the task manager had been disabled in "My Computer\HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Policies\System\DisableTaskMgr" and that the Wallpaper had been disabled "My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\NoChangingWallpaper."
Two other entries that I found were "My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoActiveDesktopChanges" and "My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoSetActiveDesktop." I deleted both.

Again, great information.

# 21 Dec 2009, 23:29

Cathy E writes

1 thumb

THANK YOU for the boot disk info. I used it to restore the registry to an earlier date and am able to boot computer now. I'm back to original problem of winupdate86 and how to remove it. Just downloaded the freefixer program and will try that. Thank you again!!

# 22 Dec 2009, 4:31

-Lawrence- writes

2 thumbs

Basically I've removed all the .exe's and dll's listed above but now when i login it just stays on a black screen and loads forever. I'm on windows 7 so I've put in the CD loaded the regeditor and strangely my userinit entry is correct and i cant find anything for the disable tskmngr thing. Any help would be appreciated.

Cheers

# 26 Dec 2009, 16:56

-Lawrence- writes

1 thumb

After 4 hours of playing about I cracked it!! If your a window's 7 user don't load the registry editor via your windows 7 cd. It will show your userinit entry clean e.g. "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, UserInit = c:\windows\system32\userinit.exe,"

But I was still having problem's logging in. I loaded my pc up into safemode, ctrl alt deleted, went into task manager, started a new task "explorer.exe" from there go into your windows system 32 folder. Load up CMD and type regedit. Once in your regedit follow roger karllson's advice. For some reason the regedit you boot from the windows 7 cd display's everything as if your pc was working.

# 26 Dec 2009, 17:53

-Paul- writes

0 thumbs

My Vista PC was infected with this last night. I've been able to work through most of this, but I'm still suffering from what appears to be a DNS spoofing issue. I'm unable to resolve certain domains (symantec.com, kaspersky.com, trendmicro.com, etc). Other domains resolve fine. Obviously, I'm unable to load/update AV software via the Internet. Google searches via IE will randomly redirect the browser to bogus "security" sites. Any ideas where to go looking to resolve this issue?

# 29 Dec 2009, 8:12

Roger Karlsson writes

0 thumbs

The malware writers has now changed the winlogon86.exe file name to winlogon32.exe:
http://www.freefixer.com/library/file/49088/

# 11 Jan 2010, 1:48

Stephen Abbs writes

-2 thumbs

Hi, my sister got this virus, and thanks so much for all the help!!! But I still have locked wallpaper, cant change it from their warning wallpaper, help please.

# 22 Jan 2010, 13:20

Roger Karlsson writes

0 thumbs

@Stephen: Malware often mess around with these registry values to change and then lock their wallpaper:

HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer,NoActiveDesktopChanges
HKEY_CURRENT_USER\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer,NoActiveDesktopChanges

HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer,NoSetActiveDesktop
HKEY_CURRENT_USER\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer,NoSetActiveDesktop

HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\ActiveDesktop,NoChangingWallpaper
HKEY_CURRENT_USER\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\ActiveDesktop,NoChangingWallpaper

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General,Wallpaper

You can edit these with the Windows Registry Editor, or wait until Monday when I'm release FreeFixer v0.52. It has a new feature that can unlock and change the wallpaper.

# 22 Jan 2010, 13:57

regets writes

-2 thumbs

problems,problems,laptop,vista, infected with winlogon32, I deleted the file and now I can not get back into the pc. I turn it off it looks like its loading, then nothing but a black screen, I cant get access to anything, just a black screen.I tried downloading fixes on my other pc to disc, then inserted the disc but still black screen ant prompt it to run the disc, very frustrated. Is there anyway to get into my desktop or boot menu, to try and fix this??

# 25 Jan 2010, 8:08

Roger Karlsson writes

1 thumb

@regets: I tried to boot from my Windows Vista installation DVD, and it's possible to fix the Userinit registry value from the System Recover Options:
http://2.bp.blogspot.com/_tUgxW0VPLAY/S14HtyFG9sI/AAAAAAAAAMQ/PWYwcS4mxkQ/s1600-h/fixing-registry-from-windows-vista-installation-dvd.PNG

It's also possible to create a bootable CD with help of the UBCD4Win software and restore the Userinit registry value:
http://www.freefixer.com/library/file/44908/#comment1551

Another way to restore Userinit, although it's quite complicated, is to create a bootable CD with the "chntpw" software:
http://www.freefixer.com/library/file/49088/#comment2061

Hope this helped.

# 25 Jan 2010, 13:17

Rakesh writes

1 thumb

Hi Roger,

I have the same issue. I am not able to logon.
The moment I get it, it loggs me off.
I tried to follow your 11 steps. I downloaded the UBCD4Win. However when I try to set it up on my other machine, my anti virus detects some files MBRFIX.exe and I am not able to complete the setup.
I tried to use Win XP bootable CD, but it directly starts installing new version.
I also booted my PC with a frnds USB drive. I was able to login. I also reset my reg entry. But probably this was the reg entry for that USB drive.
Please help me out. Thanks in advance.

# 26 Jan 2010, 9:49

Roger Karlsson writes

0 thumbs

@Rakesh: There's a discussion over at the UBCD4Win forum about MBRFIX.exe that might be useful:
http://ubcd4win.com/forum/index.php?showtopic=13372

# 26 Jan 2010, 12:51

Jean D writes

1 thumb

Roger
your the coolest dude, everything you said works great..
thanks for your commitment in helping the PC community

# 30 Jan 2010, 19:53

Josh C writes

-1 thumb

I've tried this, but my computer won't boot off a CD. I put it in, go to the boot menu and select the CD drive, but it still boots off the HDD. I've changed the order of preference and even told it not to boot off anything other than a CD, but no joy. Any suggestions?

# 8 Feb 2010, 9:41

Roger Karlsson writes

1 thumb

@Josh: Going into the BIOS and changing the boot order usually solves the problem, but I hear you already done that. Have you tried the CD-ROM in another PC to see if it works there? That would at least rule out the possibility that there is something wrong with the CD.

# 15 Feb 2010, 14:38

Leave a reply