HIGH CPU USAGE BY WINLOGON.EXE

Okay, that link does apply to you, even with SP2 installed. Inoculan is not a server, its a service that runs in the background. You should be fine if you follow all of the steps as shown. Don't skip any.

Dennis

OK, my only question now is why is it doing this.

Right now it's behaving it's..

It (winlogon.exe and fpserv.exe) jump up and down abit at boot up but deid down to nothing.

I don't know why but for some reason winlogon will start up again and will not stop ever if I kill everything.

I was told my M$ themselfs to delete both win.sys and system.sys which helped abit but didn't kill the probulem

I was told that it may have something to do with me running a virus scaner and zone alarm (both for which are 2000 verision)

Innoculan requires a tremendous amount of CPU cycles to run, and every time you introduce new files, have email going, have zone alarm running, the cycles will increase as innoculan tries to examine all the possible approaches for virus's etc. Merely working on the system should calm it down, but as soon as you log on and zone alarm begins blocking ports and then people begin hitting those ports, your cycles will rise accordingly. Unfortunately zone alarm hides allot of this activity, so its hard to measure peak periods.

Ok I understand that, but why is winlogon jumping around and not the other programs??

Or is it the after efect or the other programs??

Anyway do I need to use this patch or not??

Winlogon controls the process. In NT (unlike Windows 9x) there is no direct access to hardware resources.

If you intend to keep Win2000, then apply the patch. If this is a temporary setup, then don't worry about it.

Form the web page..

PROBLEM RESOLUTION:

Follow the instructions below:
1. This fix requires the 9808 level of Inoculan be installed.

How do I do this?? Is it what I'm downloding?? LO88760.CAZ

2. Stop the Inoculan Server service from Services in the Control Panel.

What Services??  Where in Contol Panel??

3. Rename INOJOBSV.EXE in X:\INOCULAN to INOJOBSV.LO88760
    Rename SHEXTSCN.EXE in X:\INOCULAN to SHEXTSCN.LO88760
    Rename WSSCAN.DLL in X:\INOCULAN to WSSCAN.LO88760

Did seach and nothing found (all files are showing)

I'm getting confused!!

Do you have a current version of Innoculan installed?

I will assume not, unless it come with win 2000 or I got it tho one of the updates.

Like I said I only installed win 2000 a week ago.

The first think I did was update it from the update site (got all the updates)

Updated my video, monitor and mouse drivers.

Install a few programs and thats it.

In that case, than innoculan is not the issue here, paltalk is. It's using one of the Winlogon dll files, which is what is driving your CPU crazy. Aside from the fact that its a 400MHz processor, I have no doubt that paltalk is resource hungry which explains what is happening.

It's not pal talk..

I can boot up and just sit here and watch winlogon.exe go up and down all night.

And thats without out running anything in the background..

The only reason I'm running 2000 is I was told it was better then 98se, so far I don't think alot of it.

Run now the only thing open is the browser and winlogon.exe and PPserv.exe are just going up and down.

*sigh*  I'm going to bed

Check this file and see if it matches yours:

Date        Time    Version      Size    File name
--------------------------------------------------
09/12/2000  6:26P 5.0.2200.2200  87,312  Sfc.dll

1) Did You upgraded from win9x ?
If yes, then

Cleanup the startup stuff. In win2k,
Download the Startup COP a free pcmag utility from
http://www.zdnet.com/downloads/stories/info/0,,77594,.html
 Run it and it will show you everything that is listed in all the possible startup
                        places, and allow you to disable things one at a time until the problem is eliminated.
 A lot of probelms are caused by excess old baggage - programs that have not been properly  un-installed. Startup Cop will eliminate leftovers and un-wanted programs that you no longer want.
Older Antivirus programs and Norton Utilities have been known to cause problems
try disabling them also !

Also try

SFC /scannow to fix any corrupted files.

Lastly - disable any services that you do not need !

IF IIS is running, get the patches for Code RED worm.

its the Code Red worm.
The listing of services that stop :
               WWW publishing service
               MS SMTP service
               FTP Publishing service
               Site Server Authentification service
               Site Server LDAP Service

  http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms01-033.asp


http://www.w2knews.com/rd/rd.cfm?id=061401-W2KSecurity 
DOD whitepapaers on how to implement win2k security 35 booklets total.


I hope this helps !

To dew:

sfc.dll is 93kb
ver 5.0.2195.2896

To SysExpert :

No this is a CLEAN install.

To Everyone:

Got I think I found what is going on..
I killed three servers (set them to manual set)

Protector Plus Service (anti-virus)
TrueVector Basic Logging Client (zone alarm)
TrueVector Internet Monitor (zone alarm)

Now my system is running ok, but I guess I'm open to attack.

I'm runing the last NT version of both so why it's it working??

Just check with the vendors for updates, although that Celron 400 might not have the power you need now.

Do you now of any good programs I can use installed that do work in 2000???