[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Winlogon.exe using excessive CPU

Posted on 2006-06-08
8
Medium Priority
?
568 Views
Last Modified: 2008-02-20
This is a windows XP Home edition computer, HP Pavilion a610 n. The system is sitting on the desktop and you can hear the hard drive chugging along in short bursts. If you watch the process list, you can watch the winlongon procecess averaging around 60% with each hard drive burst. I have check for spyware and removed anything unessacary. Also removed all items from msconfig. Any help would be appreciated. Thanks
0
Comment
Question by:bagged2drag
  • 4
  • 4
8 Comments
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16862437
Does winlogon.exe appear in your MSCONFIG?  If so, it is a worm, according to this page:

http://www.sysinfo.org/startuplist.php?filter=&letter=W

0
 
LVL 6

Author Comment

by:bagged2drag
ID: 16862449
I checked to make sure, but it doesn't list it there.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16862527
What spyware checkers have you used?

Here is another page where it says Winlogon.exe may be another malware if it is in the wrong folder (C:\Windows or C:\WinNT instead of C:\Windows\System32 or C:\WinNT\System32):

http://www.answersthatwork.com/Tasklist_pages/tasklist_w.htm
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 6

Author Comment

by:bagged2drag
ID: 16862555
I booted safe mode command prompt - Removed a few things out of program files and common files. Went through the registry to the run in both user and system keys. Ran ewido, adaware, and The avast boot-time scan
0
 
LVL 59

Accepted Solution

by:
LeeTutor earned 2000 total points
ID: 16862616
Besides Adaware, I also like to use SpyBot Search & Destroy. What one program misses, the other often finds...

http://download.com.com/3000-2144-10194058.html?tag=lst-0-1
Spybot - Search & Destroy

Be sure to update the data definitions.
0
 
LVL 6

Author Comment

by:bagged2drag
ID: 16862656
I'll run that and I check the C:\windows folder and didn't see that file. I also made sure show hidden files and folders were on.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 16862720
If SpyBot Search & Destroy doesn't catch it, you might also try this free program (HijackThis):

http://www.spychecker.com/download/download_hijackthis.html

HijackThis is a tool that is for advanced users, because it lists all the installed browser add-on and startup items, allowing you to inspect them and then optionally remove any ones you select.  You must be careful in choosing what to remove, although the program can create a backup of your original settings.  But put a check mark to fix any home page or search page setting that HijackThis detects which you have not entered yourself.  The program has an option to download online updates of the hijack data.

You should first post the log at this site:  

http://www.hijackthis.de/index.php?langselect=english

and it will be automatically analyzed for you (after you click on the button labeled "Analyze" near the bottom of the page), telling you which entries (called "Nasty") should be fixed.  You will also be told if you have any items that are "Possibly Nasty", or "Unnecessary", or "Unknown". If you don't know what to do about these, you might find something on the module name by doing a Google search of the internet.

If you have any questions about what it is asking you to fix that you would like the E-E experts to comment on, then do this:  scroll down where you will see a Save Analysis button, hit it and it will save your Log Analysis (for a period of three days), then copy the link of that page and paste it here, and experts can check it for you.  (Please DON'T post the entire log itself in your question.)

In case you would like to learn more yourself how to use HijackThis, here are a couple of urls:

http://www.tomcoyote.org/hjt/
HijackThis Quick Start

http://www.spywareinfo.com/~merijn/htlogtutorial.html
HijackThis log tutorial
0
 
LVL 6

Author Comment

by:bagged2drag
ID: 16862920
I ran hijack this and spybot and that took care of it. Winlongon.exe is stable and heardly using any cpu now. Thanks so much.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disclosure: Use this tutorial only when no other options helps to get Windows XP running without any problems and you don't want to format the drive. The back up of the data is the responsible of the user, however there is a description of how t…
If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article (http://rdsrc.us/u3GP7A) first and run the tool TDSSKiller (http://rdsrc.us/GDBBs4) to get rid of the infection. Once done, and if the …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…

825 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question