WINLOGON.EXE delays login

After installing a fresh clean install of Win2k Pro SP3 I have noticed that the Hard Drive light has been quite active for almost 5-6 minutes after logging into the domain. When I looked to see what "Processes" were running I found that the "Winlogon.exe" was the culprit. It was only using up approx 40% but it still ran for 5-6 minutes.

I have scanned the PC for virii and have found nothing. This PC is running SAVCE (Symantec AV Corp. Ed 8.0)

Any thoughts?

 

Do you get the same delay if you logon with different accounts (an ordinary user or administrator)? Are you running a software firewall like ZoneAlarm? See also Symantec KB

 

Thanks for the REPLY...

Yes, on all accts (user & admin).

No to Firewall software.

Yes, I have looked at the KB you mentioned. This wrkstn is not running the C-Dilla software.

 

ProcKill-AF is a new trojan that puts a copy of winlogon.exe on the system.

And I gather from reading that some other programs will replace the original with their own version which can cause problems. But for that you'd either need to have turned off system file protection or to have installed the app in safe mode.

My suggestions at this point would be to do some cleaning on the system if it has ever been connected to the internet or even to a LAN.

Turn off the normal AV protection and run a full scan from an on-line app like housecall.

Run sfc /scannow to repair/replace any bad system files.

Otherwise - and especially if this is a brand new install, I think I'd be very tempted to start over. Boot from CD, remove all partitions, create & format a new one, and load the OS again.

Most of the folks who have tried to fix this particular annoyance haven't had much luck unless a specific cause could be found.

 

Thanks

Sorry to take so long to answer...I finally got a chance to get on the PC in question...

Newt...I tried as you suggestted with the SFC /SCANNOW but no go...

I guess I going to to another fresh clean install. THis time I'm going to log everything as it is installed to see when and if this happens again.

Thanks for all the info...