Winlogon.exe consuming CPU

[Franky]

Hi All

I have a shuttle PC which is causing a bit of a problem.

Every time the PC starts the process "winlogon.exe" consumes 99% of the CPU

I have tried uninstalling any recent updates, rolled back drivers (thinking
it may be an issue) but still occurs.

I have also de-selected all entries in MSCONFIG thinking this would help

I have run chkdsk commands, anti-virus, anti-spyware scans in safe mode but
still no joy

In a last attempt I did a repair option but this did not work either,
however I am able to enter "safe mode" without this problem

Is there a way to "repair" or extract this file to ensure it does not
consume the CPU

Any help greatly appreciated

 

[Kerry Brown]

Some malware hooks into the logon process and causes this symptom. What
anti-malware programs have you used? A good one can be found here:

http://www.ewido.net/en/

An excellent web page about malware can be found here:

http://www.elephantboycomputers.com/page2.html#Removing_Malware

 

[Franky]

Hi

I am not sure if you read what I posted, I advised that I have run
anti-spyware programs (adaware, cclean, MS defender) & these did not locate
any problems therefore I do not think this is a malware problem

Thanks for the help anyhow

 

[Kerry Brown]

None of the programs you mention would be effective in dealing with malware
that exploits the winlogon process. Very few anti-malware programs can deal
with malware that is hooked into the winlogon process. Malware that hooks
into the logon process is active even in safe mode. Ewido will usually
identify the malware but won't remove it. Your symptoms indicate malware.
There obviously could be other causes but malware is the likeliest
possibility. Another way to identify malware hooked into the logon process
is HijackThis (somewhat effective) or Autoruns and ProcessExplorer from
www.sysinternals.com (very effective at identifying the files but not the
name of the malware). Once the malware is identified you can usually find
steps to remove it. Even if it is not malware the programs from sysinternals
will be helpful in diagnosing what the cause is.