winlogon.exe error

  hardtofind 20:59 02 Sep 2008

I am running Win XP Pro. After logging on to one of the users at the logon screen the desktop starts OK and after a short time the computer shuts down and restarts. This sometimes happens a couple of times and then everything seems alright.
After the restart I get the error message 'winlogon.exe encountered a problem and had to shut down'
The taskbar at the bottom of the screen has changed to white/grey instead of blue and seems to stay that way.
If I click on details of the error I get a stream of numbers which I can list if anyone is interested.
Any help would be appreciated.

  Technotiger 21:22 02 Sep 2008

winlogon.exe is a process belonging to the Windows login manager. It handles the login and logout procedures on your system. This program is important for the stable and secure running of your computer and should not be terminated.

Note: winlogon.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

I would suggest to be safe pulling out your windows xp disc....
if you boot from the disc (put the disc in, reboot the computer, when it asks to boot from cd hit enter)...
you will be brought to the setup
hit enter to install windows... (dont hit R to repair!) it will scan your drive for windows installations...
you will see that you have an NTFS partiton installed on your C: drive, select this partition and hit repair on the partition... windows will go through and replace all the vital system files and will leave your system in tact! after the 'install/repair' is done, you will be able to log into windows again and it should be fixed... .if this seems to complicated you can try system restore...

goto start -> programs -> accessories -> system tools -> system restore... select a previous date for the system restore to restore to and it SHOULD work for you.

- - - - - - - - - - - - - - - - - - - - - - - --

I hope it helps.

  hardtofind 21:27 02 Sep 2008

Thanks for that Technotiger. From your description the two things seem to contradict one another. How can it be important and yet be a trojan?
Could that not be removed?
Thanks again.

  Technotiger 21:39 02 Sep 2008

Not my description - as I said, I found it on another forum.

I would advise you to try a System Restore, back to before this started on your PC.

  hardtofind 21:55 02 Sep 2008

Yes thankyou. I will try that.

  Sea Urchin 22:22 02 Sep 2008

"From your description the two things seem to contradict one another. How can it be important and yet be a Trojan?"

This is the way that Trojans work - they enter your system in the guise of a legitimate file. So this means that the GENUINE file is an important program, but there is known to be a Trojan masquerading as this program. Hence the warning that it may or may not be genuine, and therefore all possibilities should be considered.

  hardtofind 16:43 03 Sep 2008

Sea Urchin
Thanks for the info. I checked and found winlogon.exe in the systems32 folder where I understand it should be but I don't know how to check and find out if there is a rogue one somewhere else. Does anyone know please?

  Technotiger 16:49 03 Sep 2008

Did you try the System Restore as above?

  hardtofind 16:13 04 Sep 2008

Well I was about to but at the moment it seems to be behaving itself. If it starts again I will do as suggested. Thanks for all the help.

  PhiltheFragger 16:16 04 Sep 2008

Download and run some antispyware programs
Adaware, Spybot search & destroy and Superantispyware should be on everybodies Pc as a matter of course.

Did you recently open an email in the form of an Ecard
there are loads of these around with trojans, so be carefull


  hardtofind 23:14 05 Sep 2008


Thanks, I do run Spybot and Superantispyware. No, no Ecards recently.
I find now that I log on, the machine shuts down once, restarts, and is ok thereafter.
I understand from other sources that this may be something to do with Software Distribution Service 3 which is suddenly appearing in my system restore. It prevents using any restore points and is a Microsoft program to do with automatic updates and cannot be got rid of.
Don't know if anyone can add anything to that.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Honor 9 Lite review

How Social Media has Propelled Political Graphic Design and Art in the Last Decade

The best kids apps for iPhone & iPad 2018

HomePod d’Apple : date de sortie, prix et fiche technique