Member Avatar for Kedhrin

Windows XP Pro Service Pack 1
Amd Xp 2000+
Nforce 2 MSI-K7n2G motherboard
Geforce Fx 5200
1 30 gb hd
1 80 gb hd
DVD Rom

ok, the problem i am having is that if i open up a program like 3D Studio Max, or anything that requires a lot of resources, winlogon.exe goes crazy and just sucks up all my cpu and the only way to stop it is a restart. I'm having very hard times with this and i don't know where else to look for help.

  • 3 Contributors
  • 4 Replies
  • 242 Views
  • 7 Years Discussion Span
  • Latest Post Latest Post by caperjack

Dani AI

Generated

This thread describes an XP Pro SP1 box (AMD XP 2000+, nForce2, GeForce FX 5200) where launching heavy apps like 3D Studio Max makes the winlogon.exe in System32 consume CPU until a restart. rightly raised malware as one possibility and already ran Norton in Safe Mode, but that outcome points toward a need for deeper, low-risk diagnostics to tell whether winlogon is executing Microsoft code or a misbehaving third‑party component (hooks, notify/GINA DLLs, or drivers).

Practical diagnostic steps that are quick and non-destructive:

  • Inspect winlogon with Process Explorer (Sysinternals): open winlogon.exe → Properties → Threads → sort by CPU → click Stack. A non‑Microsoft DLL at the top of a hot stack identifies the offending component.
  • Enumerate Winlogon hooks/GINA entries with Autoruns (Winlogon tab) or query the registry:
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"
  • Check Event Viewer (System/Application) for Winlogon or userenv errors around the time of the spike. Try launching the heavy app under a fresh local user profile to rule out profile corruption.

Remediation notes:

  • If Process Explorer implicates a third‑party DLL, disable its Winlogon/Notify entry in Autoruns or uninstall/rename the DLL from Safe Mode and reboot.
  • If stacks show only Microsoft modules, focus on drivers (video/chipset) and profile/userenv issues; reinstalling GPU and chipset drivers is a sensible next step because 3D apps trigger driver code paths.
  • Run focused rootkit/boot‑time scanners only if suspicious hooks remain after the above.

Caution: editing the registry or renaming system DLLs can brick an XP install—export affected keys and create a restore point before changes. Capturing and saving the Process Explorer stack is the single most useful artifact for diagnosis: stacks dominated by Microsoft modules point to drivers/profile causes; any third‑party DLL points to that vendor component as the primary suspect.

Recommended Answers

All 4 Replies

Member Avatar for caperjack

Do a search for winlogon.exe ,if you find more than one you have avirus\trojan .The good one is in c:\windows\system32 ,folder
So do a virus scan if you find more than one file .

Member Avatar for Kedhrin

well i've done virus scans, with norton antivirus updated definitions and all, even in safe-mode, done an anti-spam ware check to, cleared all them out, its a problem with the winlogon.exe in system32.

Member Avatar for kokokol

I'm having the same problem, and the only solution i´v found is format D:


;(

commented: Don't revive a necrothread -1
Member Avatar for caperjack

I'm having the same problem, and the only solution i´v found is format D:


;(

wow 7 yrs later and people are still having the same type problems ,haven't gone far have we .
check the date of orignal poster

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.