Winlogon.exe @ 100%

[Alshrim]

Hey all -- .
Ok i have a quirky lil problem with my PC.

My winlogon.exe after about 10 minutes maxes to 100% and uses 50MB of Ram - I have installed Spybot and immunized, run ad-aware and deleted all malware on the machine and have spyware blaster on my pc preventing anymore from coming on .. but still - it maxes.

I run McAfee - fully updated - and have no virus' to my knowledge...

Anyone have this?? and has anyone fixed it?!

Alshrim
System Administrator
MCSE, MCP+Internet

 

[mjbianco15]

What user is calling winlogon.exe...in other words is it System or the username when you look under Task Manager. We had a similar problem with a winlogon.exe process that was spyware and was not detected by Spybot, Adaware, etc...

 

[carrr]

Winlogon.exe can be a number of things, you'll need to do some sleuthing on your end and narrow it down. It can Netsky, or various malwares. Most likely the latter as your McAfee is not getting tripped. Look here for some starting info:

http://www.sysinfo.org/startuplist.php?filter=winlogon.exe&count=&type=

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[Alshrim]

It's the system that's calling the winlogon.exe ...

I have CWShredder - which kills malwares associated with CoolSearch - and it keeps killing CWSBootConf - but even after cleaning it.. if i run it again - it still has to remove it...

Alshrim
System Administrator
MCSE, MCP+Internet

 

[carrr]

Are you shutting down system restore before running CoolWebShredder? If you're not, that's why you're getting the recurrence.

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[Alshrim]

Where do i shut down system restore??

Alshrim
System Administrator
MCSE, MCP+Internet

 

[carrr]

Read here:

http://service1.symantec.com/SUPPOR...2001111912274039?OpenDocument&src=sec_doc_nam

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[Alshrim]

ok.. I'll try that...

but what i meant was... I'll run the Shredder... and then it will say it removed 2 items...and then - without rebooting.. i'll run it again - and it says it had to remove it AGAIN...

so.. i find that a little curious..

Alshrim
System Administrator
MCSE, MCP+Internet

 

[Alshrim]

actually.. it was indeed turned off...

Getting weirder all the time...



Alshrim
System Administrator
MCSE, MCP+Internet

 

[carrr]

THis isn't the appropriate forum for log posting, but you might want to download Hijack This! (

http://tomcoyote.com/hjt/),

scan your pc, and then paste the log into a post in forum760

"'Tis an ill wind that blows no minds." - Malaclypse the Younger