userlogon.exe - Dangerous
%windir%\userlogon.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
It logs keystrokes when you visit certain Web pages and emails the log to the attacker.
Web pages that link to .CHM files to exploit the Microsoft Internet Explorer ITS Protocol Zone Bypass Vulnerability are known to distribute Trojan.Gletta.A.
Captures all the keystrokes entered into any windows that match predefined list, and writes them into a log file.
Uses its own SMTP engine to send the log file to an external mail account.
It uses an SMTP server in Russia to send the mail.
The mail has the following characteristics:
Both the FROM and TO addresses have the domain "mail.ru"
The subject starts with "Business News from "
Use RegRun Startup Optimizer to remove it from your system.