WINLOGON>EXE problem when shutting down

  • Thread starter Thread starter Tim Parr
  • Start date Start date
T

Tim Parr

Hi everyone.

My PC (running XP Pro with SP1) hangs on shutdown due to above, giving me
the chance to "end now". I do and it shuts down ok. Any ideas. I have 2
Winlogn in task manager, 1 is winlogon.exe system and the other WINLOGON.EXE
Tim. I don't seem to have any viruses according to an up-to-date Norton AV.
I'm wondering if it's not getting time to shutdown and then hanging. Just
started out of the blue. I have searched for instances of winlogon.exe and
there is the system, prefetch and windows update I386 entries.

Thanks in anticiation.

Tim
 
You should only see *one* winlogon.exe running, the one under System.

If you have two winlogon.exes running, one of them may be
W32.Netsky.D@mm worm.

[[This virus is distributed via the Internet through e-mail and comes in the
form of an e-mail message, in the hopes that you open it’s hostile
attachment. The worm has it’s own SMTP engine which means it gathers E-mails
from your local computer and re-distributes itself. In worst cases this worm
can allow attackers to access your computer, stealing passwords and personal
data. It is a registered security risk and should be removed immediately.]]

The original Winlogon.exe from Microsoft gets placed in %Windir%\System32\
and %Windir%\system32\dllcache. If you find it anywhere else you should
be suspicious.

[[Copies itself as %Windir%\winlogon.exe]]
Symantec Security Response - W32.Netsky.D@mm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

The winlogon.exe that's hanging is probably the virus.

Update Norton and run a full system scan.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
Back
Top