winlogon.exe error followed by 0xc0000005 (Ox0's & 0x0's) BSOD

PC is getting the following (repeatedly) -  winlogon.exe error followed by 0xc0000005 (Ox0's & 0x0's) BSOD .   I have run Virus scans & Malware scans repeatedly - drive is reporting clean.  Will not run long enough to update virus def's or malware def's.  Any suggestions ?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Brian BEE Topic Advisor, Independant Technology ProfessionalCommented:
Try booting the system in safe mode (F5 at boot) then run the AV scan and also defrag.

Try to copy winlogon.exe from another computer or run Repair installation using the install CD.
Check this Microsoft KB article

Good Luck!
PMI ACP® Project Management

Prepare for the PMI Agile Certified Practitioner (PMI-ACP)® exam, which formally recognizes your knowledge of agile principles and your skill with agile techniques.

How long has this been a problem? If not long, I would suggest starting in Safe Mode (turn the computer on and IMMEDIATELY start pressing the F8 key on and off--don't just hold it down, or the computer will report a stuck key) .

Before launching Explorer (the shell program that lets you open files and programs) Windows will ask you if you want to launch System Restore instead by clicking on Cancel.

If this problem has only been happening for a short while, I would recommend using System Restore to go back a few days before the bad stuff started happening. This might clean up the immediate symptoms and let you get started fixing it permanently.

Whether or not System Restore works, I would advise using the same F8 trick to launch Windows in Safe Mode with Networking. This will allow you to update your anti-malware software (note, not all antivirus will run in Safe Mode, however Malwarebytes and Spybot Search and Destroy are two free anti-malware products that will install, run, and update in Safe Mode. You can download those two programs, as well as many others, at

After running your antimalware software in Safe Mode, I recommend setting Checkdisk to run on restart. Go to My Computer, right click on your hard drive icon (the C Drive) and select Properties. A little window will pop up with a pie chart of your drive. Click on the Tools tab, and click the button that says "Scan disk for Errors". When that window opens, check the box that says "Fix Errors Automatically". Don't check the surface scan box unless you can leave the computer alone for a couple hours to complete it.  When you click the Scan Now button, windows will tell you it can't scan the disk while Windows is running, and offer to do a scan on restart.

Say Yes, and restart the computer. When you start up, you'll get a blue windows saying a scan is scheduled, and pressing a any key in the next 8 seconds will cancel it. Don't press any keys, and the scan will start and get finished in about 10 minutes.

If you can't run your antimalware  software, even in Safe Mode, I recommend trying Scan Disk first, and seeing if that helps. It never seems to hurt, and cleans up a lot of annoying glitches caused by crashing and file corruption.

Good Luck!
ftv34p4sAuthor Commented:
Gentlemen -

First & most importantly,  I truly appreciate the responses.  Been out of the office and returned a little while ago.  I had previously booted into "safe mode" and ran all the scans I could - still had the same issue.  I have "defrag'ed" and issue remained.  Have NOT copied another  "winlogon.exe".

When I left this afternoon - I started a fresh scan (Malwarebytes - new defs) in safe mode - WITHOUT any network devices running. When I returned the PC was still running and malwarebytes had finished w/o finding any issues.  I can NOT go to IE or any other network share. But, the PC is running.

I have manually updated MS AV defs and have rebooted (without any network devices running).  The PC is running and the Process window is showing only 33 processes vice 50+ before.  It is running far past the time when it would have rebooted previously.  I am going to let the scan complete and then try one wireless device at a time to see if that is the issue.

Barking up the wrong tree????
I'd be curious to see what the Shell/UserInit/Notify subkeys look like under "hklm/software/microsoft/windows nt/current version/winlogon"

Notify key will have several subkeys, most will either be MS, or video driver related....

Autoruns logfile in an .ARN format would be grand.....

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ftv34p4sAuthor Commented:
I ran the PC for several hours in safe mode w/o issue.  I then rebooted (not safe mode) & ran another full scan w/malwarebytes; but, w/o any network devices.  No problems. PC ran fine.  Inserted a USB wireless NIC and the PC shut down after several minutes.  Rebooted and found two entries in the event log referencing "faulting application winlogon.exe; fauling module "hspdar1.dll"  Did a search & deleted the file from sys32 directory.  Rebooted w/USB NIC and system seems to be running OK.  Looked up the key you referenced and found a folder "hspdar1" - deleted it.  Running Windows update & PC continues to run fine.  But, I am still unsure ............  I am looking up  " .ARN " format.  Again thanks for the support
ftv34p4sAuthor Commented:
Oh, btw ...  these were the entries w/in the Registry key ......

ftv34p4sAuthor Commented:
It was a good (but long) night.  The PC appears to be running w/o issue now.  After numerous scans and reboots through out the evening.  It appears that after I discovered & removed the "hspdar1.dll" - the BSOD went away.  I have run all windows updates without issue.  The PC has been continually running (on the network) since 2am or so.  I am thankful to "johnb6767" for pointing out the need to check the registry keys.  I found & deleted that "hspdar1" folder w/in the registry key.  I do not know why the virus/malware scans did not identify the "hspdar1.dll" issue. Thanks to all who assisted - it is truly appreciated
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.