1 2 Previous Next 16 Replies Latest reply on Sep 25, 2011 11:26 AM by jrbarrie1

    Excessive Winlogon Activity

      I have a problem with excessive winlogon.exe activity on my PC. It started a few months ago and plenty of other people seem to be complaining of the same thing.


      For example last night I ran MalwareBytes' Anti-Malware program and it took 15 hours to scan 105,000 files and it still wasn't finished. When I turned McAfee real time scanning off (after disabling web access as a security precaution) it scanned 250,000 files in less than an hour. MalwareBytes didn't flag any problems and a virus scan of the laptop is totally clean.


      Looking at windows task manager reveals winlogon.exe activity is oscillating between ~2% and 60% on an almost regular basis.  During peak periods the PC is almost unresponsive.


      What is going on with McAfee and how can I regain normal operating functionality of my PC?



      Details of my PC:

           Windows XP SP3    

           McAfee Internet Security 11.0.578, Virus Scan 15.0.291

        • 1. Re: Excessive Winlogon Activity

          ..what no response to this problem even after 48Hours.....


          Is this a suitable strategy for handling difficult problems caused by the anti-virus program? No wonder so many people are complaining about the issue.


          I am beginning to agree with the sentiments expressed in the following thread, it  reveals a lot about the company attitude


          I'm really tired of the issues - McAfee you lost a longtime customer


          Link is here: https://community.mcafee.com/thread/38356?start=0&tstart=0 


          Come on McAfee prove that you can support customers on this issue.

          • 2. Re: Excessive Winlogon Activity

            I see you're running with Internet Security 11 on an XP machine. From all that I've seen I don't think that version sits well with XP. If it were possible, I would suggest you switch back to version 10, which I still have and which seems (overall) to give fewer problems, and see if makes a difference.


            As to why Internet Security v11 is so unfriendly to XP, I don't know. It may be that with Microsoft's push to kill XP and get users onto Windows 7 (or 8) the developers aren't making too much of an effort to make the product XP-compatible, but it's more likely that it's just been optimised for the PC architecture that is required for Win7. There is a big difference between the two in terms of system requirements - if you want to see just how much, download the Windows 7 update check from Microsoft and let it scan your system. It looked at mine and basically said it's not compatible because of the underlying Intel architecture. Go onto the Intel site and browse around among the chipset specifications, and you'll see that many of the older chipsets won't be supported for Win7, let alone 8.


            It may be that making the product efficient for Win7/8 makes it inherently inefficient on XP :-(


            As for your complaint about not getting a reply from a McAfee person, these forums are - according to the online forum guides - customer self-help spaces. The official support channels are elsewhere. If you get help from the mods, that's not the same as official McAfee support. McAfee people keep an eye on the forums - they need to know what's going on - but they're not necessarily going to answer each and every question.


            Now, back to the original question about winlogon - this is something I don't get with XP and Internet Security 10, so I can't go check it. (My problems are with mcshield, and I'm still running various tests looking for ways to minimise disruption caused by CPU spiking. They might help in cases like this, and if they do I'll pass on anything I find). But system specs could be relevant. So :

            How much RAM have you got and what's your processor type and speed?

            Have you got multi-threading?

            Is your system 32 bit or 64?

            What size is your page file?


            That should give an indication of how well McAfee AV should run. The rest maybe is down to optimisation.


            And the winlogon problem may have little or nothing to do with McAfee anyway. I've been on the Microsoft forums, and it seems that winlogon.exe high CPU problems began (or, rather, re-started) with a Microsoft update that went out at the beginning of July. (See this Microsoft thread, which hasn't been answered). When you Google for the problem ...


            winlogon -high cpu- usage xp sp3 - Google Search.png


            Message was edited by: Hayton on 09/09/11 15:50:48 IST
            • 3. Re: Excessive Winlogon Activity

              Re Malwarebytes is that the paid /registered version that clashes with Mcafee as both have real time scanning.


              on 11/09/11 6:40:12 AM
              • 4. Re: Excessive Winlogon Activity

                You might want to check out the following thread: https://community.mcafee.com/thread/36177


                I've experienced increased activity with winlogon.exe that's associated with System File Check/Windows File Protection due to some issues with the 11.0 version of McAfee. I'd check your Event Viewer for any warnings just before shutdown. You said you have XP SP3 and the correct version of McAfee (11.0) to make me suspect your winlogon.exe activity is a symptom of the McAfee issue.


                Winlogon.exe + Mcshield.exe picks up for me whenever MalwareBytes Anti-Malware is scanning on the session following a McAfee update that requires a restart. In addition, winlogon.exe is active following these restart updates from McAfee in the first 5 minutes that XP SP3 starts. If you happen to run Process Explorer and look at the threads running under winlogon.exe, you'll see sfc_os.dll is causing the activity. This is System File Checker/Windows File Protection. We're still waiting on what's causing McAfee to trigger the WFP warnings, but I suspect winlogon.exe is tied to this. I haven't had much luck in confirmation of the winlogon.exe activity from anyone else though sadly.

                • 5. Re: Excessive Winlogon Activity

                  This doesn't answer anything, but it does confirm the link between winlogon.exe and SFC/WFP issues. It's a copy of a McAfee blog that hasn't been archived, from 2007. See the article ("WFP Hack Redefined") HERE.


                  In it is the throwaway line

                  sfc_os.dll is used by winlogon process to achieve this protection.


                  It's just a bit of background reading, but it also confirms what Microsoft say, that WFP has been targeted by malware.


                  If I find anything else relevant to these threads I'll pass it on.

                  • 6. Re: Excessive Winlogon Activity

                    Thanks to those who replied to my original post, it makes interesting but disappointing reading.


                    At least I've now got a better idea of what is going on, not that I feel anyone is going to produce a viable solution soon. Junking a £1000 XP laptop because a £22 piece of software doesn't like the operating system makes no sense.


                    One of the symptoms I see with this problem is web pages like this taking >4mins to load (hotmail is similar), even viewing/composing forum messages is a frustrating & arduous task. I'll monitor things as suggested.

                    • 7. Re: Excessive Winlogon Activity

                      I, too have experienced excessive winlogon.exe memory usage in Task Manager within the past 10 days. After 24 hours of booting up winlogon.exe will quickly expand to around 1.3 gb. Yes, I've run various anti-spyware software, virus scans (by Norton, too), have checked the registry entry, have verified the file is only under system32, etc. etc.


                      This link also finds users pointing the finger of blame squarely at a McAfee upgrade - <http://answers.microsoft.com/en-us/windows/forum/windows_xp-performance/winlogon exe-memory-leak-and-high-cpu-usage/b3e64e6b-e304-449a-9d5b-a86d3b146ae1>.



                      • 8. Re: Excessive Winlogon Activity


                        As we know Winlogon is that  Microsoft component used in Windows operating systems responsible for handling  loading the user profile on logon, and optionally locking the computer when a screen saver is running etc. Moreover , Im just curios to know if we could overcome this with the  existence of only one antivirus software that is loaded in the OS.

                        scottyboy235/jrbarrie1  can you try to uninstall the other antivirus software from the PC and let us know if you still experience this issue , provided please get back if you did already try this step !

                        • 9. Re: Excessive Winlogon Activity

                          Hi Dinesh,

                          Thank you for your prompt reply. Five hours ago I disengaged my McAfee Real Time Scanning, and activated AVG Anti-Virus. Winlogon.exe in Task Manager has not exceeded 15 mb. It has not increased dramatically as it has been doing recently. My preliminary conclusion is that it's an incompatibility in a recent McAfee software upgrade. I never had this problem prior to the last 10 days. It disappears when I disengage McAfee. What else can I conclude?


                          Please troubleshoot what is causing this error and remedy it. Thank you in advance.

                          1 2 Previous Next