Solved

HIGH CPU USAGE BY WINLOGON.EXE

Posted on 2001-09-05
16
565 Views
Last Modified: 2007-11-27
Why is it my winlogon.exe keeps going up and down..

About ever minture or so it jumps to 90%+ and down to nothing??

The only think I found about it is...

http://support.ca.com/Download/patches/ilnt/LO88760.html

But this is for NT4 for 2000 SP1, I had SP2
It goes on about a Inoculan Server, wich is not list under servers..

Should I still use this patch??
0
Comment
Question by:dark_shadow_2000
  • 8
  • 7
16 Comments
 
LVL 25

Expert Comment

by:dew_associates
ID: 6459763
Okay, that link does apply to you, even with SP2 installed. Inoculan is not a server, its a service that runs in the background. You should be fine if you follow all of the steps as shown. Don't skip any.

Dennis
0
 

Author Comment

by:dark_shadow_2000
ID: 6459805
OK, my only question now is why is it doing this.

Right now it's behaving it's..

It (winlogon.exe and fpserv.exe) jump up and down abit at boot up but deid down to nothing.

I don't know why but for some reason winlogon will start up again and will not stop ever if I kill everything.

I was told my M$ themselfs to delete both win.sys and system.sys which helped abit but didn't kill the probulem

I was told that it may have something to do with me running a virus scaner and zone alarm (both for which are 2000 verision)
0
 
LVL 25

Expert Comment

by:dew_associates
ID: 6459823
Innoculan requires a tremendous amount of CPU cycles to run, and every time you introduce new files, have email going, have zone alarm running, the cycles will increase as innoculan tries to examine all the possible approaches for virus's etc. Merely working on the system should calm it down, but as soon as you log on and zone alarm begins blocking ports and then people begin hitting those ports, your cycles will rise accordingly. Unfortunately zone alarm hides allot of this activity, so its hard to measure peak periods.
0
 

Author Comment

by:dark_shadow_2000
ID: 6459848
Ok I understand that, but why is winlogon jumping around and not the other programs??

Or is it the after efect or the other programs??

Anyway do I need to use this patch or not??
0
 
LVL 25

Expert Comment

by:dew_associates
ID: 6459858
Winlogon controls the process. In NT (unlike Windows 9x) there is no direct access to hardware resources.

If you intend to keep Win2000, then apply the patch. If this is a temporary setup, then don't worry about it.
0
 

Author Comment

by:dark_shadow_2000
ID: 6459923
Form the web page..

PROBLEM RESOLUTION:

Follow the instructions below:
1. This fix requires the 9808 level of Inoculan be installed.

How do I do this?? Is it what I'm downloding?? LO88760.CAZ

2. Stop the Inoculan Server service from Services in the Control Panel.

What Services??  Where in Contol Panel??

3. Rename INOJOBSV.EXE in X:\INOCULAN to INOJOBSV.LO88760
    Rename SHEXTSCN.EXE in X:\INOCULAN to SHEXTSCN.LO88760
    Rename WSSCAN.DLL in X:\INOCULAN to WSSCAN.LO88760

Did seach and nothing found (all files are showing)

I'm getting confused!!
0
 
LVL 25

Expert Comment

by:dew_associates
ID: 6459937
Do you have a current version of Innoculan installed?
0
 

Author Comment

by:dark_shadow_2000
ID: 6459964
I will assume not, unless it come with win 2000 or I got it tho one of the updates.

Like I said I only installed win 2000 a week ago.

The first think I did was update it from the update site (got all the updates)

Updated my video, monitor and mouse drivers.

Install a few programs and thats it.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 25

Expert Comment

by:dew_associates
ID: 6459974
In that case, than innoculan is not the issue here, paltalk is. It's using one of the Winlogon dll files, which is what is driving your CPU crazy. Aside from the fact that its a 400MHz processor, I have no doubt that paltalk is resource hungry which explains what is happening.
0
 

Author Comment

by:dark_shadow_2000
ID: 6460025
It's not pal talk..

I can boot up and just sit here and watch winlogon.exe go up and down all night.

And thats without out running anything in the background..

The only reason I'm running 2000 is I was told it was better then 98se, so far I don't think alot of it.

Run now the only thing open is the browser and winlogon.exe and PPserv.exe are just going up and down.

*sigh*  I'm going to bed
0
 
LVL 25

Expert Comment

by:dew_associates
ID: 6461529
Check this file and see if it matches yours:

Date        Time    Version      Size    File name
--------------------------------------------------
09/12/2000  6:26P 5.0.2200.2200  87,312  Sfc.dll
0
 
LVL 63

Expert Comment

by:SysExpert
ID: 6461869
1) Did You upgraded from win9x ?
If yes, then

Cleanup the startup stuff. In win2k,
Download the Startup COP a free pcmag utility from
http://www.zdnet.com/downloads/stories/info/0,,77594,.html
 Run it and it will show you everything that is listed in all the possible startup
                        places, and allow you to disable things one at a time until the problem is eliminated.
 A lot of probelms are caused by excess old baggage - programs that have not been properly  un-installed. Startup Cop will eliminate leftovers and un-wanted programs that you no longer want.
Older Antivirus programs and Norton Utilities have been known to cause problems
try disabling them also !

Also try

SFC /scannow to fix any corrupted files.

Lastly - disable any services that you do not need !

IF IIS is running, get the patches for Code RED worm.

its the Code Red worm.
The listing of services that stop :
               WWW publishing service
               MS SMTP service
               FTP Publishing service
               Site Server Authentification service
               Site Server LDAP Service

  http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms01-033.asp


http://www.w2knews.com/rd/rd.cfm?id=061401-W2KSecurity
DOD whitepapaers on how to implement win2k security 35 booklets total.


I hope this helps !

0
 

Author Comment

by:dark_shadow_2000
ID: 6462685
To dew:

sfc.dll is 93kb
ver 5.0.2195.2896

To SysExpert :

No this is a CLEAN install.

To Everyone:

Got I think I found what is going on..
I killed three servers (set them to manual set)

Protector Plus Service (anti-virus)
TrueVector Basic Logging Client (zone alarm)
TrueVector Internet Monitor (zone alarm)

Now my system is running ok, but I guess I'm open to attack.

I'm runing the last NT version of both so why it's it working??
0
 
LVL 25

Expert Comment

by:dew_associates
ID: 6462719
Just check with the vendors for updates, although that Celron 400 might not have the power you need now.
0
 

Author Comment

by:dark_shadow_2000
ID: 6462757
Do you now of any good programs I can use installed that do work in 2000???
0
 
LVL 25

Accepted Solution

by:
dew_associates earned 200 total points
ID: 6462774
Norton has the least problems for Win2000, and Zonealarm has a Win2000 version.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now