PDA

View Full Version : winlogon 100% CPU usage

Stu
05-01-2009, 04:52 PM
Got a customer's machine infected with something. I had removed the hard drive removed for scans with numerous other antivirus/antispyware programs.

Upon replacing the hard drive, I installed SAS Pro and initiated a scan with no problems. When I next checked the machine an hour so later, it was unresponsive and appeared to have crashed. I had no choice but to do a hard reset.

Now, the computer will not properly load up to the Windows desktop of any profile, even in safe mode. Checking task manager shows that the cause is winlogon.exe running constantly at 100% CPU usage.

Unfortunately system restore has been disabled previously, even if I could get it to run.

I have tried replacing winlogon.exe and userinit.exe with clean versions from the XP CD. Also tried a repair install of XP and running ReImage, but nothing has any effect. I have even removed the hard drive to be rescanned externally, but nothing is detected. Also tried running ChkDsk, no joy.

Any ideas?
CPCR
05-01-2009, 04:55 PM
Does it load to XP with the command prompt only?

if so have a look through the autoruns software and see what is loading with XP.

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
Galdorf
05-01-2009, 05:52 PM
I use UBCD4WIN 3.50 i would start with antivir scan followed by malwarebytes and finish off with a2free.

Chances are you have a rootkit all scanning in world won't turn up anything scanning from infected OS you need to use a boot disk.

This can also be caused by a very large hosts file try to disable DnS client under services.
Stu
05-02-2009, 04:39 PM
Does it load to XP with the command prompt only?

if so have a look through the autoruns software and see what is loading with XP.

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Good call, I ran autoruns from cmd prompt, albeit very slowly since CPU use was still 100%. I suspected the problem might have been caused by SAS since this was the application running when the crash happened. I deleted all references to SAS and sure enough the computer booted normally at the next boot.

It turned out an automatic Windows update had gone through during the SAS scan, and rebooted the computer with disasterous results.

Thanks for your help, you saved my bacon today.