Winlogon.exe App Err -PLEASE HELP

  • Thread starter Thread starter Rob Karatzas
  • Start date Start date
R

Rob Karatzas

Hi Folks

* Thank You for your time (would be calling MS, but this is probably worst
day of year for support) *

1. During start-up (Windows XP Pro, ALL SPs, Critical Updates, Latest
Antivirus updates, etc.), I get the following error when I click on the
logon for the ONLY user account setup on the PC (other than Administrator):

"SAS Window: Winlogon.exe - Application Error instruction "0x75a90d5F"
referenced memory at "0x0000000d". The memory couldn't be read. (OK to
terminate, CANCEL to debug - debug does do anything)". (Xmas eve the PC
threw an exception in explorer.exe (was only running modem connection,
JBidWatcher & Trillian) so I let the PC shutdown/restart and paid no
attention to it.

2. Christmas morning on start-up I get the error mentioned. Doesn't appear
to be any means for getting into the Administrator account during boot-up
(or ability to reset the user account profile)?

3. From a Win 2K Adv. Srvr PC (on same network/workgroup). I can see the
ENTIRE C: drive (as a share) AND I scanned it with Symantec corporate AV
with NO VIRUS found.

4. I tried to get access to the PC from Computer Management (on both Win2K
Adv Srvr & Win 2003 Ent. Ed. Srvr.), but for most everything (including
account-group reset/create/etc.) I'm denied access.

5. Win XP Pro PC has been running just fine for almost a year now w/o any
issues. Only thing notable about the PC is that I have all of my Whidbey dev
stuff & customer work on it.

Any help or URLs you can provide would be greatly appreciated.

r

Rob Karatzas
(e-mail address removed)
 
Update...

Did the F8 on boot, selected SAFE mode, was prompted with both the
Administrator & User accounts.

BOTH accounts blow up with the same error? (Even though I can see C: drive
share externally. Can even go so far as trying to create a new Group from
other PC AND I authenticate with Administrator & good password - but Access
is still DENIED as far as creating new group or account...)

r

Rob Karatzas
(e-mail address removed)
 
Do you have anything installed that hooks the login
sequence, like VNC or PCanywhere ? If so, you
might try either remotely accessing the registry and
setting it to not load (shut off the services or modify
the boot device setting), or else renaming a key dll
so its load fails.
 
Tried NetMeeting (from Win2K Adv Svr) to WinXP, but no luck (wasn't able to
autopick-up). (never installed either of the products you mention).

This is really wierd... Can authenticate from Computer Managment (on Win2K
Adv Svr) against the WinXP Pro PC (and even see the available groups, except
Administrators), so I know the Administrator password is still good.

Once upon a time, I successfully used this linux technique (
http://www.pc-pipeline.com/modules.php?op=modload&name=News&file=article&sid=15 )
for a customer (termination scenario) for Win 2K Pro access, but I'm VERY
hesitant in doing this just yet (have lots of saved Whidbey dev/testing &
customer development - and can still read the entire drive).

thanks rob

PS Looking for someway to reestablish the Administrator & User profiles,
hosts, etc. from a command prompt (if it'll let me get there).
 
I do not see how setting a password to a known value
is going to fix the issue. Winlogon seems to be making
a call / following a pointer / etc with invalid argument
data. Usually this is some non-MS code that has hooked
into the login sequence. However that you sent link of
does work with XP.
You can list out all groups "except Administrators" ?
Now that is peculiar.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
Rob Karatzas said:
Tried NetMeeting (from Win2K Adv Svr) to WinXP, but no luck (wasn't able to
autopick-up). (never installed either of the products you mention).

This is really wierd... Can authenticate from Computer Managment (on Win2K
Adv Svr) against the WinXP Pro PC (and even see the available groups, except
Administrators), so I know the Administrator password is still good.

Once upon a time, I successfully used this linux technique (
Click to expand...
http://www.pc-pipeline.com/modules.php?op=modload&name=News&file=article&sid=15 )
 
Yes, when I go to create a new group, it prompts for authentication (which
it does OK for Administrator) and shows the following groups only (not
Administrators):

Everyone,
Authenticated Users,
ANONYMOUS LOGON,
BATCH,
CREATOR OWNER,
CREATOR GROUP,
DIALUP,
INTERACTIVE,
NETWORK,
SERVICE,
SYSTEM,
TERMINAL SERVER USER

(then it fails on the Group Create/just like the User, with an Access
Denied.) Just an FYI, I'm running NTFS.

Rob

PS Weird, have never seen anything like this (have heard of some weird
things with my customers, but never believed this kind of thing could happen
until I experienced this myself). Have another Win XP Pro PC in my network
(with this same User & Administrator accounts (passwords are the same too),
but don't have a clue as to what I might be able to overwrite to fix things.
The only 3rd party thing I know of which is in the start-up is Norton AV
2002 Pro - again, everything starts and runs fine, just can't logon?

Roger Abell said:
I do not see how setting a password to a known value
is going to fix the issue. Winlogon seems to be making
a call / following a pointer / etc with invalid argument
data. Usually this is some non-MS code that has hooked
into the login sequence. However that you sent link of
does work with XP.
You can list out all groups "except Administrators" ?
Now that is peculiar.
Click to expand...
http://www.pc-pipeline.com/modules.php?op=modload&name=News&file=article&sid=15 )
 
Back
Top