winlogon.exe crashes on logging off or shutting down

[Ron Hirsch]

I've had an ongoing problem for about 7 months. My system is a high end
system running XP Pro, which I built 2 years ago. It runs flawlessly, but
when shutting down, since the fall of 2007, winlogon.exe crashes. It also
crashes if I just log off, and don't shutdown.

In Safe Mode, it never crashes during shutdown or logging off. Periodically,
after taking some specific action such as uninstalling a piece of software
or hardware, or running RegCure, the shutdowns may become normal. And that
may last for 1 hour, 1 day or up to 3 weeks. But then things return to
crashing.

When the system is running, it runs very smoothly, with no problems visible
of any kind.

I have played around with most of the non Microsoft items in the Startup
listing (I use WinPatrol), but that has not really uncovered anything. I've
scanned the sytem with a wide range of security software scanners - but
nothing has ever been discovered.

I have a HiJackThis log just in case. but I cannot locate a good place to
post it, and actually have it read.

I have looked in the event viewer, but have not spotted anything that seems
to be a cause for this.

Does anyone have any ideas that I could follow up on.

As I noted, the system runs flawlessly - never crashes during normal
operations - only on shutdown.

Ron Hirsch

 

[Thee Chicago Wolf]

I've had an ongoing problem for about 7 months. My system is a high end

system running XP Pro, which I built 2 years ago. It runs flawlessly, but
when shutting down, since the fall of 2007, winlogon.exe crashes. It also
crashes if I just log off, and don't shutdown.

In Safe Mode, it never crashes during shutdown or logging off. Periodically,
after taking some specific action such as uninstalling a piece of software
or hardware, or running RegCure, the shutdowns may become normal. And that
may last for 1 hour, 1 day or up to 3 weeks. But then things return to
crashing.

When the system is running, it runs very smoothly, with no problems visible
of any kind.

I have played around with most of the non Microsoft items in the Startup
listing (I use WinPatrol), but that has not really uncovered anything. I've
scanned the sytem with a wide range of security software scanners - but
nothing has ever been discovered.

I have a HiJackThis log just in case. but I cannot locate a good place to
post it, and actually have it read.

I have looked in the event viewer, but have not spotted anything that seems
to be a cause for this.

Does anyone have any ideas that I could follow up on.

As I noted, the system runs flawlessly - never crashes during normal
operations - only on shutdown.

Is this your issue? http://support.microsoft.com/kb/903251

I would try installing the current winlogon.exe from the following KB
article:
http://support.microsoft.com/kb/938375

Some slightly older KB article about problems with winlogon.exe:

http://support.microsoft.com/kb/912354
http://support.microsoft.com/kb/900903
http://support.microsoft.com/kb/906277
http://support.microsoft.com/kb/910849
http://support.microsoft.com/kb/910482
http://support.microsoft.com/kb/938375
http://support.microsoft.com/kb/922410

- Thee Chicago Wolf

 

[Ron Hirsch]

Thanks for the links. But my problem is not the one discussed in
http://support.microsoft.com/kb/903251.

As I noted in my message, my system runs fine, and does not crash while in
operation.

The crash occurs when Windows is shut down, or if I log off prior to
shutting down. So it is my logging off that precipitates the crash, since
logging off occurs automatically when shutting down.

Also, the "fix" noted in http://support.microsoft.com/kb/938375 states
clearly that it should not be used unless the problem specifically is as
noted, and that that fix will be incorporated in a future patch. And, that
message was back in 9/2207, and noted that the fix would be incorporated
into a forthcoming MS patch/fix.

Ron Hirsch

+++++++++++++++++++++++++++

I've had an ongoing problem for about 7 months. My system is a high end
system running XP Pro, which I built 2 years ago. It runs flawlessly, but
when shutting down, since the fall of 2007, winlogon.exe crashes. It also
crashes if I just log off, and don't shutdown.

In Safe Mode, it never crashes during shutdown or logging off.
Periodically,
after taking some specific action such as uninstalling a piece of software
or hardware, or running RegCure, the shutdowns may become normal. And that
may last for 1 hour, 1 day or up to 3 weeks. But then things return to
crashing.

When the system is running, it runs very smoothly, with no problems visible
of any kind.

I have played around with most of the non Microsoft items in the Startup
listing (I use WinPatrol), but that has not really uncovered anything. I've
scanned the sytem with a wide range of security software scanners - but
nothing has ever been discovered.

I have a HiJackThis log just in case. but I cannot locate a good place to
post it, and actually have it read.

I have looked in the event viewer, but have not spotted anything that seems
to be a cause for this.

Does anyone have any ideas that I could follow up on.

As I noted, the system runs flawlessly - never crashes during normal
operations - only on shutdown.

Is this your issue? http://support.microsoft.com/kb/903251

I would try installing the current winlogon.exe from the following KB
article:
http://support.microsoft.com/kb/938375

Some slightly older KB article about problems with winlogon.exe:

http://support.microsoft.com/kb/912354
http://support.microsoft.com/kb/900903
http://support.microsoft.com/kb/906277
http://support.microsoft.com/kb/910849
http://support.microsoft.com/kb/910482
http://support.microsoft.com/kb/938375
http://support.microsoft.com/kb/922410

- Thee Chicago Wolf

 

[Thee Chicago Wolf]

Thanks for the links. But my problem is not the one discussed in

http://support.microsoft.com/kb/903251.

As I noted in my message, my system runs fine, and does not crash while in
operation.

The crash occurs when Windows is shut down, or if I log off prior to
shutting down. So it is my logging off that precipitates the crash, since
logging off occurs automatically when shutting down.

Also, the "fix" noted in http://support.microsoft.com/kb/938375 states
clearly that it should not be used unless the problem specifically is as
noted, and that that fix will be incorporated in a future patch. And, that
message was back in 9/2207, and noted that the fix would be incorporated
into a forthcoming MS patch/fix.

Ron Hirsch

I know what the fix says and I also know many issues with winlogon.exe
have been addresses since the original version that was in XP Service
Pack 2. That it doesn't explicitly speak to your issue doesn't mean it
won't help you. What is address in that KB article. and prior, will be
integrated into Service Pack 3. That will not be released for at least
4 more weeks. You can always request and try KB938375 and see if it
helps you. If not, you can always uninstall it. Or you can wait until
SP3 is released. Don't shoot the messenger.

- Thee Chicago Wolf

 

[Ron Hirsch]

Hey, I'm not shooting the messenger. <G>

As I noted in my original message, the crashing goes through its cycles.
Right now, the crashing is taking a holiday. What's strange is that in the
past, the situation was impacted by any one or more of the following, which
would often cause a cessaton of the crashes.

Installing or uninstalling programs
Uninstalling or installing hardware
Running my Registry cleaner (RegCure)

The crash would never happen when in Safe Mode. But I could never pinpoint
any non MS item in the startup folder which really impacted things.

The one MS startup item that I have disabled is CTFMON.EXE. MS states that
this is used for various Office programs. But I have no office programs
installed, other than viewers for Word, PP, and Excel.

But, every time I disable it, apparently MS tries to reactivate it again.
But, one of my security programs now signals me on bootup that MS is trying
to change the Registry to reinstall it, so I've left "firm instructions" to
not allow that. But it retries on each bootup, and I get a small window
(displayed for a few seconds) telling me that my instructions are being
followed on each bootup.

However, I do not have any real indication that CTFMON.EXE is in any way
related to the crashing.

I've also edited the Registry to set "AutoEndTasks" = 1, and set the time
delay for "WaittoKillApp" and "HungAppTimeout" down to just a few seconds

So, lately there haven't been any crashes. But every time I say that, they
start again. :-(

So, if SP 3 is coming out in the near future, I'll wait and see if
installing helps the situation.

Thanks for your help

Ron Hirsch

+++++++++++++++++++

Thanks for the links. But my problem is not the one discussed in
http://support.microsoft.com/kb/903251.

As I noted in my message, my system runs fine, and does not crash while in
operation.

The crash occurs when Windows is shut down, or if I log off prior to
shutting down. So it is my logging off that precipitates the crash, since
logging off occurs automatically when shutting down.

Also, the "fix" noted in http://support.microsoft.com/kb/938375 states
clearly that it should not be used unless the problem specifically is as
noted, and that that fix will be incorporated in a future patch. And, that
message was back in 9/2207, and noted that the fix would be incorporated
into a forthcoming MS patch/fix.

Ron Hirsch

I know what the fix says and I also know many issues with winlogon.exe
have been addresses since the original version that was in XP Service
Pack 2. That it doesn't explicitly speak to your issue doesn't mean it
won't help you. What is address in that KB article. and prior, will be
integrated into Service Pack 3. That will not be released for at least
4 more weeks. You can always request and try KB938375 and see if it
helps you. If not, you can always uninstall it. Or you can wait until
SP3 is released. Don't shoot the messenger.

- Thee Chicago Wolf