winlogon.exe in malwarebytes directory

[backyarder1]

I've been having problems for weeks. Keep getting errors that malwarebytes is blocking outgoing malware. I've stopped every process that I can. Should there be a winlogon.exe file WITHIN the malwarebytes directory? That doesn't make sense to me and seems to be one of the only processes that is still running when I get the error messages.

[Maurice Naggar]

Hello and welcome to Malwarebytes forums.

I imagine you saw MBAM notices that it blocked some malicious websites. right?

That's usually a good sign that it is blocking websites that are known to be bad.

Yes, to the exe found in a sub-directory.

I'd recommend you not stop processes if you are not familiar with what belongs to whom.

Q: Is your internet connection to your system behind a hardware router (between the the pc and the incoming internet connection) ?

Highly recommended.

Q: Is your system running a software firewall, or at least, the native Windows firewall?

[backyarder1]

Yes, I have a router. And yes, I have McAfee Antivirus which has the firewall enabled. But there is still some sort of malware or virus on my PC and I have run virus scans and malwarebytes several times. Latest symptom was that my browsers kept redirecting to other pages yesterday and crashing.

Hello and welcome to Malwarebytes forums.

I imagine you saw MBAM notices that it blocked some malicious websites. right?

That's usually a good sign that it is blocking websites that are known to be bad.

Yes, to the exe found in a sub-directory.

I'd recommend you not stop processes if you are not familiar with what belongs to whom.

Q: Is your internet connection to your system behind a hardware router (between the the pc and the incoming internet connection) ?

Highly recommended.

Q: Is your system running a software firewall, or at least, the native Windows firewall?

[Maurice Naggar]

@backyarder1

Have you resolved your issue? Have you perhaps sought guided help elsewhere?

If the redirect issues are still present, it is a hallmark sign of a rogue infection.

In case you need guided help,

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Please post there MBAM log

the DDS logs

Don't post your logs here.

[exile360]

Should there be a winlogon.exe file WITHIN the malwarebytes directory?

Yes, if the file is located within the Chameleon folder, but that particular file should not be running unless you tried to run Malwarebytes Chameleon, which is a new set of technologies we added in 1.60 of Malwarebytes Anti-Malware in order to get the program running when it is being blocked from doing so by infections.

If you are getting IP blocks from a process named winlogon.exe, then that is not normal, neither from the Chameleon file nor from the Windows system process, winlogon.exe so it sounds like an infection, in which case I would highly recommend following the above instructions to get one on one assistance with getting your system checked.