WINLOGON3.EXE is Trojan Qhost

The file WINLOGON3.EXE is identified as a virus dropper.
The dropper WINLOGON3.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file WINLOGON3.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the WINLOGON3.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the WINLOGON3.EXE process and delete the file WINLOGON3.EXE.

Malware Analysis of WINLOGON3.EXE
Full path on a computer: %WinDir%\winlogon3.exe

How to quickly detect WINLOGON3.EXE presence?

Registry:

• HKLM\Software\Microsoft\Windows\CurrentVersion\Run\winupdate: “C:\Windows\winlogon3.exe”

Files:

• %Temp%\~DF738B.tmp
• %WinDir%\winlogon3.exe