|  | winlogon.exe consumes 50% CPU after XP Pro SP3 update | | |
| | | Dale Chamberlain |  |
|  Posted: Tue Sep 02, 2008 10:57 am Post subject: winlogon.exe consumes 50% CPU after XP Pro SP3 update |  |
After updating my Windows XP Pro machine from SP2 to SP3, I have run into a
problem where winlogon.exe is consuming 50% CPU on an AMD dual core processor
machine.
Normal windows shutdown does not work. I am forced to hold down on the power
button to shut down the computer.
Any one else experiencing this problem? Any thoughts as to what is causing
it (besides the SP3 update)? |
| |
| | | Thee Chicago Wolf | |
| | Posted: Tue Sep 02, 2008 11:31 am Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
| |  | |
| Quote: | After updating my Windows XP Pro machine from SP2 to SP3, I have run into a
problem where winlogon.exe is consuming 50% CPU on an AMD dual core processor
machine.
Normal windows shutdown does not work. I am forced to hold down on the power
button to shut down the computer.
Any one else experiencing this problem? Any thoughts as to what is causing
it (besides the SP3 update)?
|
Well, I've seen this occur on some machines that have had SP3 just
installed on them. I let the system alone for a few minutes and
eventually it returns to 0% usage. It almost seemed as if it was doing
some sort of update and was using winlogon.exe in the process. The
next time I rebooted the computer it did not have any high CPU
utilization. Is it continuing to be at 50% even after a long duration
of use or time has passed?
A couple of KB articles have been released since SP3 was released. One
remains published and the other is still not yet available in the KB.
Go to Control Panel > Administrative Tools > Event Viewer and see if
there's anything weird in there (Red flags, yellow flags) relating to
the winlogon.exe process.
- Thee Chicago Wolf |
| |
| | | Dale Chamberlain | |
| | Posted: Tue Sep 02, 2008 11:52 am Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
| | | |
I have left the machine run all day (12 hours or more) and it shows that
winlogon.exe continues to consume 50% of the CPU. Most of the time when I
boot up the machine, winlogon seems to behave normally. But then something
later triggers it to go into the 50% consumption mode and it won't stop until
I physically power off the computer. I can't even shut down normally; I have
to hold down on the power button to shut it down.
I looked at the Event Viewer and it shows no red or yellow flags related to
winlogon.exe. Today's session is clear of any flags, but yesterday's shows
where I had to crash Windows Media Player since it wouldn't end normally. I
don't know if that is related to the winlogon problem or not.
I fear I may have to reload Windows to get rid of this problem.
Dale
"Thee Chicago Wolf" wrote:
| Quote: | After updating my Windows XP Pro machine from SP2 to SP3, I have run into a
problem where winlogon.exe is consuming 50% CPU on an AMD dual core processor
machine.
Normal windows shutdown does not work. I am forced to hold down on the power
button to shut down the computer.
Any one else experiencing this problem? Any thoughts as to what is causing
it (besides the SP3 update)?
Well, I've seen this occur on some machines that have had SP3 just
installed on them. I let the system alone for a few minutes and
eventually it returns to 0% usage. It almost seemed as if it was doing
some sort of update and was using winlogon.exe in the process. The
next time I rebooted the computer it did not have any high CPU
utilization. Is it continuing to be at 50% even after a long duration
of use or time has passed?
A couple of KB articles have been released since SP3 was released. One
remains published and the other is still not yet available in the KB.
Go to Control Panel > Administrative Tools > Event Viewer and see if
there's anything weird in there (Red flags, yellow flags) relating to
the winlogon.exe process.
- Thee Chicago Wolf
|
|
| |
| | | PA Bear [MS MVP] | |
| | Posted: Tue Sep 02, 2008 12:21 pm Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
Free unlimited installation and compatibility support is available for
Windows XP, but only for Service Pack 3 (SP3), until 14 Apr-09. Chat and
e-mail support is available only in the United States and Canada. Go to
LINK | select "Windows
XP" then select "Windows XP Service Pack 3"
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin LINK
DTS-L LINK
Dale Chamberlain wrote:
| Quote: | After updating my Windows XP Pro machine from SP2 to SP3, I have run into
a
problem where winlogon.exe is consuming 50% CPU on an AMD dual core
processor machine.
Normal windows shutdown does not work. I am forced to hold down on the
power
button to shut down the computer.
Any one else experiencing this problem? Any thoughts as to what is causing
it (besides the SP3 update)? |
|
| |
| | | Thee Chicago Wolf | |
| | Posted: Tue Sep 02, 2008 12:26 pm Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
| | | |
| Quote: | I have left the machine run all day (12 hours or more) and it shows that
winlogon.exe continues to consume 50% of the CPU. Most of the time when I
boot up the machine, winlogon seems to behave normally. But then something
later triggers it to go into the 50% consumption mode and it won't stop until
I physically power off the computer. I can't even shut down normally; I have
to hold down on the power button to shut it down.
I looked at the Event Viewer and it shows no red or yellow flags related to
winlogon.exe. Today's session is clear of any flags, but yesterday's shows
where I had to crash Windows Media Player since it wouldn't end normally. I
don't know if that is related to the winlogon problem or not.
I fear I may have to reload Windows to get rid of this problem.
|
That's very suspicious behavior if winlogon.exe starts consuming CPU
cycles. We can surely see what's attached to Winlogon that may or may
not be causing it by downloading Process Explorer (Free, grab it here:
LINK), firing
it up, and looking at the Winlogon.exe process and anything attached
to it.
I opened up Process Explorer on my PC and can see services.exe, 5
instances of SVChost, spoolsv, mdm, and lsass.exe. I would guess yours
would look the same but my hunch is you'll see that one of the
svchost.exe's is doing some kind of monkey business. Try that next and
let me know what you find.
- Thee Chicago Wolf |
| |
| | | Dale Chamberlain | |
| | Posted: Tue Sep 02, 2008 7:54 pm Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
| | | |
Here is what Process Explorer is showing for winlogon.exe:
winlogon.exe
services.exe
svchost.exe
obroker.exe
rapimgr.exe
hpdarc.exe
svchost.exe
svchost.exe
wuauclt.exe
TPSrv.exe
svchost.exe
svchost.exe
spoolsv.exe
schedul2.exe
AppleMobileDeviceService.exe
mDNSResponder.exe
CepstralLicSrv.exe
cisvc.exe
cidaemon.exe
cidaemon.exe
DkService.exe
GoogleUpdaterService.exe
LSSrvc.exe
MDM.EXE
NBService.exe
nvsvc32.exe
PsCtrlS.exe
apvxdwin.exe
SrvLoad.exe
WebProxy.exe
PavBckPT.exe
PAVFNSVR.EXE
PavPrSrv.exe
PAVSRV51.EXE
AVENGINE.EXE
HPZipm12.exe
pskmssvc.exe
PSIService.exe
PSHost.exe
PsImSvc.exe
svchost.exe
ULCDRSvr.exe
nmsrvc.exe
alg.exe
FNPLicensingService.exe
dllhost.exe
msdtc.exe
lsass.exe
"Thee Chicago Wolf" wrote:
| Quote: | I have left the machine run all day (12 hours or more) and it shows that
winlogon.exe continues to consume 50% of the CPU. Most of the time when I
boot up the machine, winlogon seems to behave normally. But then something
later triggers it to go into the 50% consumption mode and it won't stop until
I physically power off the computer. I can't even shut down normally; I have
to hold down on the power button to shut it down.
I looked at the Event Viewer and it shows no red or yellow flags related to
winlogon.exe. Today's session is clear of any flags, but yesterday's shows
where I had to crash Windows Media Player since it wouldn't end normally. I
don't know if that is related to the winlogon problem or not.
I fear I may have to reload Windows to get rid of this problem.
That's very suspicious behavior if winlogon.exe starts consuming CPU
cycles. We can surely see what's attached to Winlogon that may or may
not be causing it by downloading Process Explorer (Free, grab it here:
LINK), firing
it up, and looking at the Winlogon.exe process and anything attached
to it.
I opened up Process Explorer on my PC and can see services.exe, 5
instances of SVChost, spoolsv, mdm, and lsass.exe. I would guess yours
would look the same but my hunch is you'll see that one of the
svchost.exe's is doing some kind of monkey business. Try that next and
let me know what you find.
- Thee Chicago Wolf
|
|
| |
| | | Thee Chicago Wolf | |
| | Posted: Wed Sep 03, 2008 11:08 am Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
| | | |
| Quote: | Here is what Process Explorer is showing for winlogon.exe:
winlogon.exe
services.exe
svchost.exe
obroker.exe
rapimgr.exe
hpdarc.exe
svchost.exe
svchost.exe
wuauclt.exe
TPSrv.exe
svchost.exe
svchost.exe
spoolsv.exe
schedul2.exe
AppleMobileDeviceService.exe
mDNSResponder.exe
CepstralLicSrv.exe
cisvc.exe
cidaemon.exe
cidaemon.exe
DkService.exe
GoogleUpdaterService.exe
LSSrvc.exe
MDM.EXE
NBService.exe
nvsvc32.exe
PsCtrlS.exe
apvxdwin.exe
SrvLoad.exe
WebProxy.exe
PavBckPT.exe
PAVFNSVR.EXE
PavPrSrv.exe
PAVSRV51.EXE
AVENGINE.EXE
HPZipm12.exe
pskmssvc.exe
PSIService.exe
PSHost.exe
PsImSvc.exe
svchost.exe
ULCDRSvr.exe
nmsrvc.exe
alg.exe
FNPLicensingService.exe
dllhost.exe
msdtc.exe
lsass.exe
|
All that is beneath the winlogon.exe branch as shown in Process
Explorer!? That seems like a lot. In any case, when you have Process
Explorer open, watch for any specific application beneath winlogon.exe
that might be causing usage specifically. I don't suspect winlogon.exe
itself is doing this. Keep an eye on the CPU column and see if a
specific app in that list of yours is gobbling up cycles. In the
column to the right of the application, you can see some specifics
such Description and Company name. Note that info in your reply.
- Thee Chicago Wolf |
| |
| | | Dale Chamberlain | |
| | Posted: Wed Sep 03, 2008 11:36 am Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
| | | |
Yes, all of these are listed under winlogon.exe. When I was running Process
Explorer, winlogon.exe itself was showing 49-50% CPU utilization, and
occassionally a process under it would flash .77% utilization. I never saw
any one process continually using CPU for long periods of time, except for
winlogon.exe.
I've run virus scans, spyware scans and nothing was found.
However, the last 3 times I've booted the machine everything seemed to be
normal. Then suddenly I get a popup "winlogon.exe - Application error
The instruction at "0x011bcad4" referenced memory at "0x011bcad4". The
memory could not be "written"
Click on OK to terminate the program
Click on CANCEL to debug the program"
Sometimes the addresses displayed are different, but in each case both the
"instruction at" and the "referenced memory" addresses are the same. Of
course, clicking on OK causes the system to reboot.
I'm thinking that it is time for the annual "Reload Windows" routine. Thank
you Microsoft!
"Thee Chicago Wolf" wrote:
| Quote: | Here is what Process Explorer is showing for winlogon.exe:
winlogon.exe
services.exe
svchost.exe
obroker.exe
rapimgr.exe
hpdarc.exe
svchost.exe
svchost.exe
wuauclt.exe
TPSrv.exe
svchost.exe
svchost.exe
spoolsv.exe
schedul2.exe
AppleMobileDeviceService.exe
mDNSResponder.exe
CepstralLicSrv.exe
cisvc.exe
cidaemon.exe
cidaemon.exe
DkService.exe
GoogleUpdaterService.exe
LSSrvc.exe
MDM.EXE
NBService.exe
nvsvc32.exe
PsCtrlS.exe
apvxdwin.exe
SrvLoad.exe
WebProxy.exe
PavBckPT.exe
PAVFNSVR.EXE
PavPrSrv.exe
PAVSRV51.EXE
AVENGINE.EXE
HPZipm12.exe
pskmssvc.exe
PSIService.exe
PSHost.exe
PsImSvc.exe
svchost.exe
ULCDRSvr.exe
nmsrvc.exe
alg.exe
FNPLicensingService.exe
dllhost.exe
msdtc.exe
lsass.exe
All that is beneath the winlogon.exe branch as shown in Process
Explorer!? That seems like a lot. In any case, when you have Process
Explorer open, watch for any specific application beneath winlogon.exe
that might be causing usage specifically. I don't suspect winlogon.exe
itself is doing this. Keep an eye on the CPU column and see if a
specific app in that list of yours is gobbling up cycles. In the
column to the right of the application, you can see some specifics
such Description and Company name. Note that info in your reply.
- Thee Chicago Wolf
|
|
| |
| | | PA Bear [MS MVP] | |
| | Posted: Wed Sep 03, 2008 11:45 am Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
| | | |
1. Free unlimited installation and compatibility support is available for
Windows XP, but only for Service Pack 3 (SP3), until 14 Apr-09. Chat and
e-mail support is available only in the United States and Canada. Go to
LINK | select "Windows
XP" then select "Windows XP Service Pack 3"
2. The behavior could be totally unrelated to the install of WinXP SP3.
Unexplained computer behavior may be caused by deceptive software
LINK
Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.
Checking for/Help with Hijackware
LINK
LINK
LINK
LINK
LINK
LINK
LINK
LINK
LINK
LINK
When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
LINK
LINK
LINK or other appropriate forums for review
by an expert in such matters, not here.**
If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin LINK
DTS-L LINK
Dale Chamberlain wrote:
| Quote: | Yes, all of these are listed under winlogon.exe. When I was running
Process
Explorer, winlogon.exe itself was showing 49-50% CPU utilization, and
occassionally a process under it would flash .77% utilization. I never saw
any one process continually using CPU for long periods of time, except for
winlogon.exe.
I've run virus scans, spyware scans and nothing was found.
However, the last 3 times I've booted the machine everything seemed to be
normal. Then suddenly I get a popup "winlogon.exe - Application error
The instruction at "0x011bcad4" referenced memory at "0x011bcad4". The
memory could not be "written"
Click on OK to terminate the program
Click on CANCEL to debug the program"
Sometimes the addresses displayed are different, but in each case both the
"instruction at" and the "referenced memory" addresses are the same. Of
course, clicking on OK causes the system to reboot.
I'm thinking that it is time for the annual "Reload Windows" routine.
Thank
you Microsoft!
"Thee Chicago Wolf" wrote:
Here is what Process Explorer is showing for winlogon.exe:
winlogon.exe
services.exe
svchost.exe
obroker.exe
rapimgr.exe
hpdarc.exe
svchost.exe
svchost.exe
wuauclt.exe
TPSrv.exe
svchost.exe
svchost.exe
spoolsv.exe
schedul2.exe
AppleMobileDeviceService.exe
mDNSResponder.exe
CepstralLicSrv.exe
cisvc.exe
cidaemon.exe
cidaemon.exe
DkService.exe
GoogleUpdaterService.exe
LSSrvc.exe
MDM.EXE
NBService.exe
nvsvc32.exe
PsCtrlS.exe
apvxdwin.exe
SrvLoad.exe
WebProxy.exe
PavBckPT.exe
PAVFNSVR.EXE
PavPrSrv.exe
PAVSRV51.EXE
AVENGINE.EXE
HPZipm12.exe
pskmssvc.exe
PSIService.exe
PSHost.exe
PsImSvc.exe
svchost.exe
ULCDRSvr.exe
nmsrvc.exe
alg.exe
FNPLicensingService.exe
dllhost.exe
msdtc.exe
lsass.exe
All that is beneath the winlogon.exe branch as shown in Process
Explorer!? That seems like a lot. In any case, when you have Process
Explorer open, watch for any specific application beneath winlogon.exe
that might be causing usage specifically. I don't suspect winlogon.exe
itself is doing this. Keep an eye on the CPU column and see if a
specific app in that list of yours is gobbling up cycles. In the
column to the right of the application, you can see some specifics
such Description and Company name. Note that info in your reply.
- Thee Chicago Wolf |
|
| |
| | | Thee Chicago Wolf | |
| | Posted: Wed Sep 03, 2008 12:01 pm Post subject: Re: winlogon.exe consumes 50% CPU after XP Pro SP3 update | |
| | | |
| Quote: | Yes, all of these are listed under winlogon.exe. When I was running Process
Explorer, winlogon.exe itself was showing 49-50% CPU utilization, and
occassionally a process under it would flash .77% utilization. I never saw
any one process continually using CPU for long periods of time, except for
winlogon.exe.
I've run virus scans, spyware scans and nothing was found.
However, the last 3 times I've booted the machine everything seemed to be
normal. Then suddenly I get a popup "winlogon.exe - Application error
The instruction at "0x011bcad4" referenced memory at "0x011bcad4". The
memory could not be "written"
Click on OK to terminate the program
Click on CANCEL to debug the program"
Sometimes the addresses displayed are different, but in each case both the
"instruction at" and the "referenced memory" addresses are the same. Of
course, clicking on OK causes the system to reboot.
I'm thinking that it is time for the annual "Reload Windows" routine. Thank
you Microsoft!
|
Well, maybe you don't have to throw in the towel just yet. Now if it
threw and exception, that should be in the Event Viewer and perhaps
even reference some other service (EXE) or perhaps a DLL it doesn't
like. Check event viewer again and see if there's anything there now.
There has been one update to winlogon.exe that was released since SP3
came out. If event viewer doesn't yield anything, visit
LINK While you aren't experiencing
the issue mentioned, it certainly would not hurt to get the fix and
apply it to see if it remedies your issue. You never know and I'm
hoping to spare you the trouble of reloading Windows.
If you want to try it, click the link "View and request hotfix
downloads" at the top of the page, accept the agreement, and fill in
the form. When you click submit, they send a link to the fix to the
e-mail address you supply within a minute or two. It'll be a password
protected file but they supply you with the password. Download,
extract the file, install the patch, reboot. Let me know how it goes.
- Thee Chicago Wolf |
| |
| Page 1 of 3 .:. Goto page 1, 2, 3 Next | |
|
|
