winlogon.exe - cpu at 100%

[Jasonchatham]

Hi

My W2000 machine has recently started have a slow startup.
In task manager the winlogon.exe process has about 40-50% CPU useage and System idle process about has about 40-50% CPU useage. This displays on the graph as about 90-100% total usage.

After about 2-3 mins the winlogon.exe process finishes what it is doing and the PC then returns to 0% useage and the graph falls as well. System idle process is 99%.

I have ran various scans for the Klez virus but found none.

I have ran Spybot and AD-ware personal SE.

Is there a way to monitor what winlogon.exe is trying to do ?

 

[bcastner]

822834 - Spooler Failure Causes High CPU Usage in the Winlogon.exe and Spoolsv.exe Processes on a Windows 2000 Terminal Server

http://support.microsoft.com/?kbid=822834

There are many sources for this issue:

. AV software. Inoculan IT is often mentioned
. The process is malware, see if there is a winlogin.exe process and/or firedaemon.exe process running as well
. Your DNS settings are incorrect, or missing, requiring the client to use Netbios name resolution

 

[Jasonchatham]

Bcastner

The pc is only running W2000 Pro, and its only during the startup / login process this is happening.

What can i check on the DNS settings ?

Jason

 

[bcastner]

For DNS related issues:

. disable (not uninstall) any unused network adapters. Windows can spend a lot of time trying to initialize unused adapters.

. Other DNS issues are only relevant in a Domain setting.

. If you have no firewalls enabled, this is a mistake. There are excellent freeware firewalls available from Zone Alarm, Sygate, Tiny and others. Do a Google search.

. Do a malware check/cleanup. The fastest way at the moment is to use a trial version of a good antispyware program. My recommendation of the month: Giant Antispyware:

http://www.snapfiles.com/get/giantantispyware.html

This is not a substitute for the need for other utilities. But it is a good start to see if there is a malware issue responsible for your slow startup. See faq608-4650

 

[Jasonchatham]

Bill

If I log off then re log on as the same user i dont get the delay or see the winlogon.exe using the CPU.

I will try some of your suggestions

Thanks.

 

[bcastner]

That strongly points to a startup program issue as responsible for the delay.

Your antivirus program would be a good bet.

 

[Jasonchatham]

OK

I have Symantec Norton Internet Security Pro 2004.

I will try their web site for support ideas.

Jason

 

[michbar]

I have had the same problem periodically for the last three weeks. I have been removing one program from startup a day to see if that is the offending app but no joy. Today I got three error messages in Event Viewer>System. All have to do with BITS (Background Intelligent Transfer Service). As far as I know, only two programs in my Startup that could use that service, E-trust antivirus and Automatic Update. I located a fix for BITS for XP but have not found much related to Win2000 Pro.

 

[Jasonchatham]

Sorry I dont get the BITS one but I am looking into the following ;

Event ID 1005 - Source SAVRT

Symantec AntiVirus Auto-Protect could not scan file C:\WINNT\System32\ati3d1ag.dll for viruses due to low kernel stack. - appears 20 times

Symantec AntiVirus Auto-Protect could not scan file C:\WINNT\System32\ati3d1ag.dll for viruses due to low kernel stack. - appears once

Thinking of excluding these from the scan - Any Comments anyone.

Jason

 

[bcastner]

http://service1.symantec.com/SUPPOR...88256bf40056e227?OpenDocument&src=bar_sch_nam

Even though the error messages do not exactly match, start with the changes suggested in the Symantec article.

 

[Jasonchatham]

Bill

I have disabled the Autoprotect feature from being started at boot up and the problem has gone away!

This is obviously not the ideal way to start up the PC but it identifies that your earlier comments were once again correct.

I have followed the link you sent me and looked at some others with reference to winlogon.exe/C-Dilla.(I have an AutoCAD license on this machine and this I think uses C-Dilla for licence management)

I am currently trying to exclude these two file from the auto-protect scan but although both listed in the exclusion list the two items still appear in the event log and also the delay happens.

Maybe because its Sunday I am not quite on the ball !

Many thanks for your help.

Jason