Windows Forum

Ask something
Discussion Locked

winlogon problem on XP Pro SP2

0 helpful
9 replies

by oldbag

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am working on fixing up a friend's system (I know, silly me) and have encountered a problem with winlogon. When the system starts, the following message appears "winlogon.exe has encountered a problem and needed to close" whether a user has logged on or not. If you attempt click OK or close the message, Blue screen of death occurs and the system needs to be restarted. If you do not touch the message, you can work but this is really annoying.

So far, I have cleaned the system of any Spyware, viruses that I have found. I have also done an XP repair (did not format the hard drive) and reloaded all XP updates. I have cleaned up any unnecessary startup applications. I have been searching all the tech sites for a solution but I have not found a satisfactory way to correct this.

I prefer not to format the hard drive if at all possible. Has someone else out there encountered this and have an effective way to correct it?

9 replies

by daven71

I had this exact same issue the other day with another employee's laptop. Had removed all viruses found as well as several instances of spyware/malware. I also discovered in my case, it was related to a trojan embeded in a puzzle game she had downloaded and it was not being picked up by any antivirus program or the like. It was a siduko or whatever that puzzle game is exe that had the trojan embeded in it. Now in your case it may not be this exact game or file, but unfortunately, in the end I had to re-image the laptop. Even after cleaning out that file too and checking everything, the registry was so out of whack from the infection that blue screens kept happening, error messages eventually returned, ect. Since doing this re-image, obviously have had no further instances. The common malicious programs found were QLink32 (Quick links), Internet Optimizer (minor compared to the latter), and a few others. Trend also found TROJ_QOOLOGIC.J and TROJ_DLOADER.ATW. QLINK alone was very deep in the registry and also disguised itself as regular keys in the registry. Just not worth it IF and only if you have this infection.

by sgt_shultz

more details, please. exact bsod error message. boot tapping the f8 key and if it is up on the updates you will get the boot menu which will allow you to select 'do not reboot the system on error' or some such and you can freeze on the bsod and write it down for us. oh, would that 'winlogon error' in win xp sp3 were enuf to go one...
did this used to have pcanywhere installed on it? have you tried a windows repair

by oldbag

I will need to get that BSOD error tonight. I can make it happen, no problem. I have tried the windows repair (which corrected many problems but not this). I will need to check the system regarding PCAnywhere but I seem to recall seeing something to do with it in the registry. I will have to recheck.

by w2ktechman

does the error occur in safe mode as well? Have you tried system restore? is an error in the event viewer?

by oldbag

OK, I have been working on getting my info together on this.

When I first started on this one, the system was seriously infected with several viruses, spyware etc, including SpySherrif. Something had disabled system restore so all restore points were gone.

I did a windows repair on the weekend. This corrected most of the problems but not this one. I have disabled all start up processes that I could, mostly by turning off application options that autostart such as HP Printer software automatic updates.

I checked with the owner and as far as she knows, PCAnywhere was never loaded on the system but she is not sure. The Symantec folder only has WinFax.

I have run s-t-i-n-g-e-r, Microsoft AntiSpyware, Norton Antivirus, Spybot, AdawareSE, Microsoft maleware detector, Registry Checker, Norton WinDoctor. I have gone through add/remove programs and removed the normal suspicious stuff. I have also cleaned up the system and defragged. The system speed is pretty good right now. Windows Update is up to date.

The error does not occur in safe mode but appears when I start in safe mode with networking. The error appears whether or not the network cable is connected.

This is the text of the message:

winlogon.exe - Application error

The instruction at "0x01201c3c" referenced memory at "0x00000016". The memory could not be "written".

Click on OK to terminate the program
Click on CANCELL to debug the program

If I do not attempt to close the message, the PC appears to be operating OK but if I click on OK, CANCELL or the 'X', I get BSOD:

STOP: c000021a {Fatal System Error}
The Windows Logon Process system terminated unexpectedly with a status of: The system has been shut down.

A system event is recorded immediately following the SSDP discovery service starting.

Source: Application Popup
EventID 26

Application Popup: winlogon.exe - Application Error: The instruction "0x00cd1bff" referenced memory at "0x01f77ba4". The memory could not be "written".

I suspect that winlogon.exe has been corrupted in some fashion but the repair did not correct the problem. Is there a way to repair this without formatting?

by w2ktechman

What happens when the network card is removed/disabled? It happens in safe mode only when networking is applied. It may have to do with bad net drivers, infected net drivers, etc. Try removing/disabling the network card and wireless card if avail. The reboot, see if the problem persists. If not, reinstall with newly downloaded drivers. Also, it is likely that the TCP/IP stack was hit as well, it needs to be reinstalled. Since it cannot be uninstalled really, you need to "break it". In the registry (if you are comfortable with it). look for HKLM\system\services\winsock2 and delete it, reboot. Windows tells you on bootup theat TCP/IP is not installed, now it can be installed. when it asks you where the file is, point it to %systemroot%\system32\drivers\tcpip.sys
If the problem does persist, there is a service running which is being called by Winlogon. Best bet is to browse the services and test with disabling some. But this can be tedious, so it might be better to wipe and reload

by oldbag

Thanks to all who attempted to help but after much frustration, I formatted the hard drive and reloaded.

This discussion is closed to new replies.