winlogon.exe error

Posted on 2007-10-03
Last Modified: 2008-05-30
We have a windows 2003 Server standard edition,  as soon as we logon on to it it starts rerstarting,  when I tried doing remote desktop with alternate admin account ( we had one ) it did the same thing..  it showed winlogon.exe caused error, but then it restarted & now does not allow to stay on longer with logon,   on teh other hand it works fine if i dont logon.. i suspect soem virus.  we dont have any antivirus software installed on the server.

pls. help

Question by:vijaydawda
    LVL 70

    Expert Comment

    Can you start in safe mode ? (press F8 just after boot and select safe mode) and check the event log for anything that might indicate what the problem is.
    LVL 70

    Expert Comment

    check the location of the Winlogon.exe file - if there is one in c:\windows its likely to be a nasty - the real one is in c:\windows\system32 - see
    LVL 1

    Accepted Solution

    Could you install the hard disk as a slave in another machine and run Symantec Antivirus 10.1.5 o later, we can't suggest that the issue is a worm but for sure somekind of worms and viruses installs itself as files.exe idem as the windows files.

    i.e. winlogon.exe can be the system file or a copy of the worm in the system, so if you could get into system you cannot kill that process because it is a system file


    LVL 1

    Author Comment

    Thks. for all quick responses
    Safe mode also not possible,   & this is a server with raid drives so i cant move anything off it.. i tried sharing drive with admin rights from client pc & it was showing some virus in some of the files, i am away from server now but i think it was bontak virus...
    It gives some choice but dont want to take chance to repair otherwise it may mess up windows files on the server & could cause complete loss for the server which is currently running ok except local logon.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Welcome to my series of short tips on migrations. Whilst based on Microsoft migrations the same principles can be applied to any type of migration. My first tip Migration Tip #1 – Source Server Health can be found here: http://www.experts-exchang…
    Learn about cloud computing and its benefits for small business owners.
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now