"Endpoint Protection" Symantec CMC - Why are you using this?
If not necessary for daily use try disabling it.

JS

"Phillip Pi" <phillip_pi@symantec.comSYMC> wrote in message
news:%23V$CLQ54IHA.1428@TK2MSFTNGP06.phx.gbl...
> Hello.
>
> I have a strange rare and annoying Windows XP Pro. SP2 (IE6.0 SP2; all
> critical updates and optional softwares for SP2) issue that had been
> around for three years or so, and I can't figure out what's going on.
>
> Once in a while (very rare -- maybe once every one/two months?), I
> winlogon.exe decides to go nuts and take one of my CPU (have a dual core
> Intel P4 Prescott machine). From there, softwares don't respond and some
> can't be shut down (e.g., SeaMonkey.exe, Trillian.exe, Outlook.exe) even
> if I force end task. When I try to shut down Windows to reboot, it gets
> stuck forever and I need to do a force shut down on the power switch on
> the Dell Optiplex GX280 case.
>
> I tried viewing Process Explorer, Process Monitor, event logs, services
> via cmd.exe (administrative method freezes/doesn't respond), etc. and
> found nothing interesting. Here are the Process Explorer exports:
>
> From Process Explorer v11.20:
>
>
> Process PID Description CPU Company Name
> System Idle Process 0 39.13 Interrupts n/a Hardware Interrupts DPCs n/a
> Deferred Procedure Calls System 4 smss.exe 1160 Windows NT Session Manager
> Microsoft Corporation
> csrss.exe 1208 Client Server Runtime Process Microsoft Corporation
> winlogon.exe 1236 Windows NT Logon Application 50.00 Microsoft
> Corporation
> services.exe 1280 Services and Controller app 0.72 Microsoft
> Corporation
> svchost.exe 1480 Generic Host Process for Win32 Services Microsoft
> Corporation
> svchost.exe 1536 Generic Host Process for Win32 Services Microsoft
> Corporation
> svchost.exe 456 Generic Host Process for Win32 Services Microsoft
> Corporation
> Smc.exe 724 Symantec CMC Smc 0.72 Symantec Corporation
> SmcGui.exe 2168 Symantec CMC SmcGui 4.35 Symantec Corporation
> svchost.exe 780 Generic Host Process for Win32 Services Microsoft
> Corporation
> svchost.exe 892 Generic Host Process for Win32 Services Microsoft
> Corporation
> SNAC.EXE 904 Symantec Network Access Control 0.72 Symantec
> Corporation
> ccSvcHst.exe 1968 Symantec Service Framework Symantec Corporation
> spoolsv.exe 1916 Spooler SubSystem App Microsoft Corporation
> AeXNSAgent.exe 1924 Altiris Agent Altiris, Inc.
> AluSchedulerSvc.exe 524 Automatic LiveUpdate Scheduler Service
> Symantec Corporation
> ntmulti.exe 944 IBM Lotus Notes/Domino IBM Corp
> NMSAccess.exe 968 p4ps.exe 1084 P4Webs.exe 1648 spkrmon.exe 1676
> SoundMAX SpeakerMonitor service Rtvscan.exe 1664 Symantec AntiVirus
> Symantec Corporation
> vmware-authd.exe 2192 VMware Authorization Service VMware, Inc.
> vmount2.exe 2704 virtual disk mount service VMware, Inc.
> vmnat.exe 2904 VMware NAT Service VMware, Inc.
> vmnetdhcp.exe 3180 VMware VMnet DHCP service VMware, Inc.
> alg.exe 2996 Application Layer Gateway Service Microsoft Corporation
> lsass.exe 1292 LSA Shell (Export Version) Microsoft Corporation
> explorer.exe 3228 Windows Explorer Microsoft Corporation
> TaskSwitch.exe 3660 ccApp.exe 3100 Symantec User Session Symantec
> Corporation
> trillian.exe 1700 Trillian Cerulean Studios
> OUTLOOK.EXE 2952 Microsoft Office Outlook Microsoft Corporation
> seamonkey.exe 1012 SeaMonkey mozilla.org
> taskmgr.exe 1616 Windows TaskManager Microsoft Corporation
> procexp.exe 3392 Sysinternals Process Explorer 4.35 Sysinternals -
> www.sysinternals.com
>
> Process: winlogon.exe Pid: 1236
>
> Name Description Company Name Version
> ACTIVEDS.dll ADs Router Layer DLL Microsoft Corporation 5.01.2600.2180
> adsldpc.dll ADs LDAP Provider C DLL Microsoft Corporation 5.01.2600.2180
> ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation
> 5.01.2600.2180
> Apphelp.dll Application Compatibility Client Library Microsoft Corporation
> 5.01.2600.2180
> Ati2evxx.dll ATI External Event Utility DLL Module ATI Technologies Inc.
> 6.14.0010.4123
> ATL.DLL ATL Module for Windows XP (Unicode) Microsoft Corporation
> 3.05.2284.0000
> AUTHZ.dll Authorization Framework Microsoft Corporation 5.01.2600.2622
> Cabinet.dll Microsoft® Cabinet File API Microsoft Corporation
> 5.01.2600.2180
> CLBCATQ.DLL Microsoft Corporation 2001.12.4414.0308
> COMCTL32.dll Common Controls Library Microsoft Corporation 5.82.2900.2982
> comctl32.dll User Experience Controls Library Microsoft Corporation
> 6.00.2900.2982
> comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.00.2900.2180
> COMRes.dll Microsoft Corporation 2001.12.4414.0258
> CRYPT32.dll Crypto API32 Microsoft Corporation 5.131.2600.2180
> cryptdll.dll Cryptography Manager Microsoft Corporation 5.01.2600.2180
> cscdll.dll Offline Network Agent Microsoft Corporation 5.01.2600.2180
> cscui.dll Client Side Caching UI Microsoft Corporation 5.01.2600.2180
> ctype.nls DNSAPI.dll DNS Client API DLL Microsoft Corporation
> 5.01.2600.3394
> fastprox.dll WMI Microsoft Corporation 5.01.2600.2180
> GDI32.dll GDI Client DLL Microsoft Corporation 5.01.2600.3316
> hnetcfg.dll Home Networking Configuration Manager Microsoft Corporation
> 5.01.2600.2180
> icmp.dll ICMP DLL Microsoft Corporation 5.01.2600.2180
> IMAGEHLP.dll Windows NT Image Helper Microsoft Corporation 5.01.2600.2180
> IMM32.DLL Windows XP IMM32 API Client DLL Microsoft Corporation
> 5.01.2600.2180
> iphlpapi.dll IP Helper API Microsoft Corporation 5.01.2600.2912
> kerberos.dll Kerberos Security Package Microsoft Corporation
> 5.01.2600.2698
> kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation
> 5.01.2600.3119
> locale.nls LPK.DLL Language Pack Microsoft Corporation 5.01.2600.2180
> midimap.dll Microsoft MIDI Mapper Microsoft Corporation 5.01.2600.2180
> MPR.dll Multiple Provider Router DLL Microsoft Corporation 5.01.2600.2180
> MPRAPI.dll Windows NT MP Router Administration DLL Microsoft Corporation
> 5.01.2600.2180
> MSACM32.dll Microsoft ACM Audio Filter Microsoft Corporation
> 5.01.2600.2180
> msacm32.drv Microsoft Sound Mapper Microsoft Corporation 5.01.2600.0000
> MSASN1.dll ASN.1 Runtime APIs Microsoft Corporation 5.01.2600.2180
> msctfime.ime Microsoft Text Frame Work Service IME Microsoft Corporation
> 5.01.2600.2180
> MSGINA.dll Windows NT Logon GINA DLL Microsoft Corporation 5.01.2600.2180
> msv1_0.dll Microsoft Authentication Package v1.0 Microsoft Corporation
> 5.01.2600.2180
> MSVCP60.dll Microsoft (R) C++ Runtime Library Microsoft Corporation
> 6.02.3104.0000
> MSVCR70.dll Microsoft® C Runtime Library Microsoft Corporation
> 7.00.9466.0000
> msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.00.2600.3085
> mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft
> Corporation 5.01.2600.3394
> msxml3.dll MSXML 3.0 SP9 Microsoft Corporation 8.90.1101.0000
> msxml3r.dll XML Resources Microsoft Corporation 8.20.8730.0001
> NavLogon.dll Symantec AntiVirus Logon Notification Symantec Corporation
> 10.01.0000.0401
> NDdeApi.dll Network DDE Share Management APIs Microsoft Corporation
> 5.01.2600.2180
> NETAPI32.dll Net Win32 API DLL Microsoft Corporation 5.01.2600.2976
> ntdll.dll NT Layer DLL Microsoft Corporation 5.01.2600.2180
> NTDSAPI.DLL NT5DS Microsoft Corporation 5.01.2600.2180
> NTMARTA.DLL Windows NT MARTA provider Microsoft Corporation 5.01.2600.2180
> ODBC32.dll Microsoft Data Access - ODBC Driver Manager Microsoft
> Corporation 3.525.1117.0000
> odbcint.dll Microsoft Data Access - ODBC Resources Microsoft Corporation
> 3.525.1117.0000
> ole32.dll Microsoft OLE for Windows Microsoft Corporation 5.01.2600.2726
> OLEAUT32.dll Microsoft Corporation 5.01.2600.3266
> PCANotify.dll Winlogon Notification package Symantec Corporation
> 11.00.0001.0764
> PROFMAP.dll Userenv Microsoft Corporation 5.01.2600.2180
> PSAPI.DLL Process Status Helper Microsoft Corporation 5.01.2600.2180
> REGAPI.dll Registry Configuration APIs Microsoft Corporation
> 5.01.2600.2180
> RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation
> 5.01.2600.3173
> rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft Corporation
> 5.01.2600.2161
> rtutils.dll Routing Utilities Microsoft Corporation 5.01.2600.2180
> SAMLIB.dll SAM Library DLL Microsoft Corporation 5.01.2600.2180
> SASWINLO.dll SUPERAntiSpyware WinLogon Processor SUPERAntiSpyware.com
> 1.00.0000.1046
> Secur32.dll Security Support Provider Interface Microsoft Corporation
> 5.01.2600.2180
> SETUPAPI.dll Windows Setup API Microsoft Corporation 5.01.2600.2180
> sfc.dll Windows File Protection Microsoft Corporation 5.01.2600.2180
> sfc_os.dll Windows File Protection Microsoft Corporation 5.01.2600.2180
> SHELL32.dll Windows Shell Common Dll Microsoft Corporation 6.00.2900.3241
> SHLWAPI.dll Shell Light-weight Utility Library Microsoft Corporation
> 6.00.2900.3354
> SHSVCS.dll Windows Shell Services Dll Microsoft Corporation 6.00.2900.3051
> sortkey.nls sorttbls.nls sxs.dll Fusion 2.5 Microsoft Corporation
> 5.01.2600.3019
> unicode.nls USER32.dll Windows XP USER API Client DLL Microsoft
> Corporation 5.01.2600.3099
> USERENV.dll Userenv Microsoft Corporation 5.01.2600.2180
> USP10.dll Uniscribe Unicode script processor Microsoft Corporation
> 1.420.2600.2180
> uxtheme.dll Microsoft UxTheme Library Microsoft Corporation 6.00.2900.2180
> VERSION.dll Version Checking and File Installation Libraries Microsoft
> Corporation 5.01.2600.2180
> wbemcomn.dll WMI Microsoft Corporation 5.01.2600.2180
> wbemprox.dll WMI Microsoft Corporation 5.01.2600.2180
> wbemsvc.dll WMI Microsoft Corporation 5.01.2600.2180
> wdmaud.drv WDM Audio driver mapper Microsoft Corporation 5.01.2600.2180
> WgaLogon.dll Windows Genuine Advantage Notification Microsoft Corporation
> 1.07.0018.0007
> WININET.dll Internet Extensions for Win32 Microsoft Corporation
> 6.00.2900.3354
> winlogon.exe Windows NT Logon Application Microsoft Corporation
> 5.01.2600.2180
> WINMM.dll MCI API DLL Microsoft Corporation 5.01.2600.2180
> WINSCARD.DLL Microsoft Smart Card API Microsoft Corporation 5.01.2600.2180
> WINSPOOL.DRV Windows Spooler Driver Microsoft Corporation 5.01.2600.2180
> WINSTA.dll Winstation Library Microsoft Corporation 5.01.2600.2180
> WINTRUST.dll Microsoft Trust Verification APIs Microsoft Corporation
> 5.131.2600.2180
> WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation 5.01.2600.2180
> WlNotify.dll Common DLL to receive Winlogon notifications Microsoft
> Corporation 5.01.2600.2180
> WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation
> 5.01.2600.2180
> WS2HELP.dll Windows Socket 2.0 Helper for Windows NT Microsoft Corporation
> 5.01.2600.2180
> wshtcpip.dll Windows Sockets Helper DLL Microsoft Corporation
> 5.01.2600.2180
> wsock32.dll Windows Socket 32-Bit DLL Microsoft Corporation 5.01.2600.2180
> WTSAPI32.dll Windows Terminal Server SDK APIs Microsoft Corporation
> 5.01.2600.2180
> xpsp2res.dll Service Pack 2 Messages Microsoft Corporation 5.01.2600.2180
>
> --
>
> Process PID Description CPU Company Name
> System Idle Process 0 41.18 Interrupts n/a Hardware Interrupts DPCs n/a
> Deferred Procedure Calls System 4 smss.exe 1160 Windows NT Session Manager
> Microsoft Corporation
> csrss.exe 1208 Client Server Runtime Process Microsoft Corporation
> winlogon.exe 1236 Windows NT Logon Application 50.00 Microsoft
> Corporation
> services.exe 1280 Services and Controller app 0.74 Microsoft
> Corporation
> svchost.exe 1480 Generic Host Process for Win32 Services 0.74
> Microsoft Corporation
> svchost.exe 1536 Generic Host Process for Win32 Services Microsoft
> Corporation
> svchost.exe 456 Generic Host Process for Win32 Services Microsoft
> Corporation
> Smc.exe 724 Symantec CMC Smc 0.74 Symantec Corporation
> SmcGui.exe 2168 Symantec CMC SmcGui 2.94 Symantec Corporation
> svchost.exe 780 Generic Host Process for Win32 Services Microsoft
> Corporation
> svchost.exe 892 Generic Host Process for Win32 Services Microsoft
> Corporation
> SNAC.EXE 904 Symantec Network Access Control Symantec Corporation
> ccSvcHst.exe 1968 Symantec Service Framework 0.74 Symantec
> Corporation
> spoolsv.exe 1916 Spooler SubSystem App Microsoft Corporation
> AeXNSAgent.exe 1924 Altiris Agent Altiris, Inc.
> AluSchedulerSvc.exe 524 Automatic LiveUpdate Scheduler Service
> Symantec Corporation
> ntmulti.exe 944 IBM Lotus Notes/Domino IBM Corp
> NMSAccess.exe 968 p4ps.exe 1084 P4Webs.exe 1648 spkrmon.exe 1676
> SoundMAX SpeakerMonitor service Rtvscan.exe 1664 Symantec AntiVirus
> Symantec Corporation
> vmware-authd.exe 2192 VMware Authorization Service VMware, Inc.
> vmount2.exe 2704 virtual disk mount service VMware, Inc.
> vmnat.exe 2904 VMware NAT Service VMware, Inc.
> vmnetdhcp.exe 3180 VMware VMnet DHCP service VMware, Inc.
> alg.exe 2996 Application Layer Gateway Service Microsoft Corporation
> lsass.exe 1292 LSA Shell (Export Version) Microsoft Corporation
> explorer.exe 3228 Windows Explorer Microsoft Corporation
> TaskSwitch.exe 3660 ccApp.exe 3100 Symantec User Session Symantec
> Corporation
> trillian.exe 1700 Trillian Cerulean Studios
> OUTLOOK.EXE 2952 Microsoft Office Outlook Microsoft Corporation
> seamonkey.exe 1012 SeaMonkey mozilla.org
> taskmgr.exe 1616 Windows TaskManager Microsoft Corporation
> procexp.exe 3392 Sysinternals Process Explorer 2.94 Sysinternals -
> www.sysinternals.com
>
> Process: winlogon.exe Pid: 1236
>
> Type Name
> Desktop \Winlogon
> Desktop \Disconnect
> Desktop \Default
> Desktop \Default
> Directory \KnownDlls
> Directory \Windows
> Directory \BaseNamedObjects
> Event \BaseNamedObjects\AUTOENRL:TriggerMachineEnrollmen t
> Event \BaseNamedObjects\crypt32LogoffEvent
> Event \BaseNamedObjects\userenv: User Profile setup event
> Event \BaseNamedObjects\userenv: Machine Group Policy has been applied
> Event \BaseNamedObjects\userenv: Machine Group Policy ForcedRefresh Needs
> Foreground Processing
> Event \BaseNamedObjects\userenv: Machine Group Policy Processing is done
> Event \BaseNamedObjects\userenv: Machine Policy Foreground Done Event
> Event \BaseNamedObjects\userenv: User Group Policy has been applied
> Event \BaseNamedObjects\userenv: User Group Policy ForcedRefresh Needs
> Foreground Processing
> Event \BaseNamedObjects\userenv: User Group Policy Processing is done
> Event \BaseNamedObjects\userenv: User Policy Foreground Done Event
> Event \BaseNamedObjects\WinlogonTSSynchronizeEvent
> Event \BaseNamedObjects\TS-WPAAE
> Event \BaseNamedObjects\ReconEvent
> Event \Security\NetworkProviderLoad
> Event \BaseNamedObjects\AtiExtEventGSNotificationEvent
> Event \BaseNamedObjects\jjCSCSharedFillEvent_UM_KM
> Event \BaseNamedObjects\hardwaremixercallback
> Event \BaseNamedObjects\WFP_IDLE_TRIGGER
> Event \BaseNamedObjects\Microsoft Smart Card Resource Manager Started
> Event \BaseNamedObjects\msgina: ReturnToWelcome
> Event \BaseNamedObjects\ThemesStartEvent
> Event \BaseNamedObjects\DINPUTWINMM
> Event \BaseNamedObjects\winlogon: machine GPO Event 70406
> Event \BaseNamedObjects\userenv: Machine Group Policy has been applied
> Event \BaseNamedObjects\userenv: machine policy refresh event
> Event \BaseNamedObjects\userenv: machine policy force refresh event
> Event \BaseNamedObjects\userenv: Machine Group Policy has been applied
> Event \BaseNamedObjects\userenv: Machine Group Policy ForcedRefresh Needs
> Foreground Processing
> Event \BaseNamedObjects\userenv: Machine Group Policy Processing is done
> Event \BaseNamedObjects\AgentExistsEvent
> Event \BaseNamedObjects\WkssvcToAgentStopEvent
> Event \BaseNamedObjects\WkssvcToAgentStartEvent
> Event \BaseNamedObjects\jjCSCSessEvent_UM_KM_0
> Event \BaseNamedObjects\AgentToWkssvcEvent
> Event \BaseNamedObjects\PCA_UnlockWksNotify
> Event \BaseNamedObjects\PCA_LockWksNotify
> Event \BaseNamedObjects\PCA_TAG_TEAM_0
> Event \BaseNamedObjects\SENS Started Event
> Event \BaseNamedObjects\userenv: user policy force refresh event
> Event \BaseNamedObjects\userenv: User Group Policy has been applied
> Event \BaseNamedObjects\userenv: User Group Policy has been applied
> Event \BaseNamedObjects\userenv: User Group Policy Processing is done
> Event \BaseNamedObjects\userenv: User Group Policy ForcedRefresh Needs
> Foreground Processing
> Event \BaseNamedObjects\userenv: user policy refresh event
> Event \BaseNamedObjects\winlogon: User GPO Event 483671
> Event \BaseNamedObjects\WlballoonLogoffNotificationEvent Name
> Event \BaseNamedObjects\AUTOENRL:TriggerUserEnrollment
> Event \BaseNamedObjects\CscCacheInitCompleteEvent
> Event \BaseNamedObjects\ShellReadyEvent
> Event \BaseNamedObjects\WlballoonLogoffNotificationEvent Name
> Event \BaseNamedObjects\mixercallback
> Event
> \BaseNamedObjects\00000000000a359c_WlballoonKerber osNotificationEventName
> File \Device\NamedPipe\TerminalServer\AutoReconnect
> File
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
> File \Device\KsecDD
> File \Device\NamedPipe\InitShutdown
> File \Device\NamedPipe\InitShutdown
> File C:\WINDOWS\system32\dllcache
> File
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
> File C:\WINDOWS\AppPatch
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\isapi\_vti_adm
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\_vti_bin\_vti_adm
> File C:\WINDOWS\system32
> File C:\WINDOWS\Help
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\isapi\_vti_aut
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\_vti_bin\_vti_aut
> File C:\WINDOWS\system32\inetsrv
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\bin
> File C:\WINDOWS\Fonts
> File C:\WINDOWS\system32\drivers
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\servsupp
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\bots\vinavbar
> File C:\Program Files\microsoft frontpage\version3.0\bin
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\_vti_bin
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\bin\1033
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\isapi
> File C:\WINDOWS
> File C:\Program Files\Common Files\Microsoft Shared\DAO
> File C:\Program Files\Windows Media Player
> File C:\Program Files\Common Files\System\msadc
> File C:\Program Files\Common Files\System\ado
> File C:\Program Files\Common Files\System\Ole DB
> File C:\WINDOWS\inf
> File C:\WINDOWS\system
> File C:\WINDOWS\msagent
> File C:\WINDOWS\msagent\intl
> File C:\Program Files\MSN Gaming Zone\Windows
> File C:\WINDOWS\PCHealth\HelpCtr\Binaries
> File C:\Program Files\NetMeeting
> File C:\WINDOWS\system32\drivers\disdn
> File C:\WINDOWS\ime\CHTIME\Applets
> File C:\WINDOWS\system32\wbem
> File C:\WINDOWS\system32\IME\CINTLGNT
> File C:\WINDOWS\system32\Com
> File C:\WINDOWS\system32\Setup
> File C:\WINDOWS\ime\IMJP8_1
> File C:\Program Files\Common Files\Microsoft Shared\Triedit
> File C:\Program Files\Windows NT
> File C:\Program Files\Common Files\System
> File C:\WINDOWS\system32\1033
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\admcgi\scripts
> File C:\Program Files\Common Files\Microsoft Shared\web server
> extensions\40\admisapi\scripts
> File C:\WINDOWS\system32\usmt
> File C:\WINDOWS\ime\IMKR6_1\Dicts
> File C:\WINDOWS\system32\mui\0009
> File C:\Program Files\Internet Explorer
> File C:\WINDOWS\ime\IMJP8_1\APPLETS
> File C:\WINDOWS\ime\IMKR6_1\Applets
> File C:\WINDOWS\system32\xircom
> File C:\Program Files\Internet Explorer\Connection Wizard
> File C:\Program Files\Common Files\Microsoft Shared\MSInfo
> File C:\WINDOWS\ime\IMKR6_1
> File C:\WINDOWS\ime\SHARED
> File C:\WINDOWS\system32\IME\PINTLGNT
> File C:\Program Files\Common Files\SpeechEngines\Microsoft\Lexicon\1033
> File C:\WINDOWS\Resources\Themes\Luna
> File C:\Program Files\Movie Maker
> File C:\WINDOWS\ime
> File C:\WINDOWS\srchasst
> File C:\Program Files\Outlook Express
> File C:\WINDOWS\system32\oobe
> File C:\Program Files\Common Files\MSSoap\Binaries
> File C:\Program Files\Common Files\MSSoap\Binaries\Resources\1033
> File C:\WINDOWS\mui
> File C:\WINDOWS\system32\npp
> File C:\WINDOWS\ime\SHARED\RES
> File C:\Program Files\Windows NT\Pinball
> File C:\WINDOWS\ime\CHSIME\APPLETS
> File C:\WINDOWS\system32\Restore
> File C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS\1033
> File C:\Program Files\Common Files\Microsoft Shared\Speech
> File C:\WINDOWS\Resources\Themes\Luna\Shell\NormalColor
> File C:\WINDOWS\Resources\Themes\Luna\Shell\Homestead
> File C:\WINDOWS\Resources\Themes\Luna\Shell\Metallic
> File C:\WINDOWS\system32\wbem\snmp
> File C:\Program Files\Common Files\SpeechEngines\Microsoft
> File C:\Program Files\Common Files\Microsoft Shared\Speech\1033
> File C:\WINDOWS\PeerNet
> File C:\WINDOWS\system32\spool\drivers\color
> File C:\WINDOWS\system32\IME\TINTLGNT
> File C:\WINDOWS\Help\Tours\mmTour
> File C:\WINDOWS\PCHealth\UploadLB\Binaries
> File C:\Program Files\Common Files\Microsoft Shared\VGX
> File C:\WINDOWS\system32\wbem\xml
> File C:\Program Files\Windows NT\Accessories
> File C:\WINDOWS\system32\mui\0401
> File C:\WINDOWS\system32\mui\0404
> File C:\WINDOWS\system32\mui\0405
> File C:\WINDOWS\system32\mui\0406
> File C:\WINDOWS\system32\mui\0407
> File C:\WINDOWS\system32\mui\0408
> File C:\WINDOWS\system32\mui\040b
> File C:\WINDOWS\system32\mui\040C
> File C:\WINDOWS\system32\mui\040D
> File C:\WINDOWS\system32\mui\040e
> File C:\WINDOWS\system32\mui\0410
> File C:\WINDOWS\system32\mui\0411
> File C:\WINDOWS\system32\mui\0412
> File C:\WINDOWS\system32\mui\0413
> File C:\WINDOWS\system32\mui\0414
> File C:\WINDOWS\system32\mui\0415
> File C:\WINDOWS\system32\mui\0416
> File C:\WINDOWS\system32\mui\0419
> File C:\WINDOWS\system32\mui\041b
> File C:\WINDOWS\system32\mui\041D
> File C:\WINDOWS\system32\mui\041f
> File C:\WINDOWS\system32\mui\0424
> File C:\WINDOWS\system32\mui\0804
> File C:\WINDOWS\system32\mui\0816
> File C:\WINDOWS\system32\mui\0C0A
> File C:\WINDOWS\system32\mui\0402
> File C:\WINDOWS\system32\mui\0418
> File C:\WINDOWS\system32\mui\041a
> File C:\WINDOWS\system32\mui\041e
> File C:\WINDOWS\system32\mui\0425
> File C:\WINDOWS\system32\mui\0426
> File C:\WINDOWS\system32\mui\0427
> File C:\Program Files\xerox\nwwia
> File C:\WINDOWS\WinSxS
> File \Device\NamedPipe\SfcApi
> File \Device\NamedPipe\SfcApi
> File \Device\Tcp
> File \Device\Tcp
> File \Device\Ip
> File \Device\Ip
> File \Device\Ip
> File \Device\Afd\Endpoint
> File \Device\Udp
> File \Device\Afd\AsyncConnectHlp
> File
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
> File \Device\LanmanRedirector
> File \Device\NamedPipe\winlogonrpc
> File
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
> File \Device\NamedPipe\winlogonrpc
> File \Device\NamedPipe\winlogonrpc
> File \Device\KSENUM#00000001\{9B365890-165F-11D0-A195-0020AFD156E4}
> File C:\WINDOWS\system32
> Key HKCR
> Key HKLM\SYSTEM\ControlSet001\Control\Nls\Locale
> Key HKLM\SYSTEM\ControlSet001\Control\Nls\Locale\Alter nate Sorts
> Key HKLM\SYSTEM\ControlSet001\Control\Nls\Language Groups
> Key HKCR
> Key
> HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parame ters\Protocol_Catalog9
> Key
> HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parame ters\NameSpace_Catalog5
> Key HKLM\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify\crypt32chain
> Key HKLM\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify\cryptnet
> Key HKCR\CLSID
> Key HKLM\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify\sclgntfy
> Key HKLM\SYSTEM\ControlSet001\Control\Lsa
> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
> Key HKLM\SYSTEM\Setup
> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Credentials
> Key HKU
> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
> Key HKU
> Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage
> Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameter s
> Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameter s\Interfaces
> Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameter s
> Key HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVer sion\Internet
> Settings
> Key HKLM
> Key HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\ HwOrder
> Key HKLM\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify\WgaLogon
> Key HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoa m\MUICache
> Key HKCU
> Key HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoa m
> Key HKU\.DEFAULT
> Key HKCR
> Key HKCR
> Key HKCR
> Key HKLM\SOFTWARE\Microsoft\COM3
> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
> Key HKLM\SOFTWARE\Microsoft\COM3
> Key HKLM\SOFTWARE\Microsoft\COM3
> Key HKU
> Key HKU
> Key HKLM\SOFTWARE\Microsoft\COM3
> Key HKCR
> Key HKLM\SOFTWARE\Microsoft\COM3
> Key HKLM\SOFTWARE\Microsoft\COM3
> Key HKCR
> Key HKCR
> Key HKCR\CLSID
> Key HKCR
> Key HKCR
> Key HKCR
> Key HKCR
> Key HKCR
> Key HKCR
> Key HKCR
> KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent
> Mutant \BaseNamedObjects\userenv: machine policy mutex
> Mutant \BaseNamedObjects\userenv: Machine Registry policy mutex
> Mutant \BaseNamedObjects\userenv: user policy mutex
> Mutant \BaseNamedObjects\userenv: User Registry policy mutex
> Mutant \BaseNamedObjects\SingleSesMutex
> Mutant \BaseNamedObjects\winlogon: Logon UserProfileMapping Mutex
> Mutant \BaseNamedObjects\ShimCacheMutex
> Mutant \BaseNamedObjects\WPA_PR_MUTEX
> Mutant \BaseNamedObjects\WPA_RT_MUTEX
> Mutant \BaseNamedObjects\WPA_LT_MUTEX
> Mutant \BaseNamedObjects\WPA_HWID_MUTEX
> Mutant \BaseNamedObjects\WPA_LICSTORE_MUTEX
> Port \RPC Control\sclogonrpc
> Port \RPC Control\IUserProfile
> Port \RPC Control\OLE273DB90569D049E7BB5A549E0AAA
> Process services.exe(1280)
> Process lsass.exe(1292)
> Section \BaseNamedObjects\ShimSharedMemory
> Section \BaseNamedObjects\Debug.Memory.4d4
> Section \BaseNamedObjects\WDMAUD_Callbacks
> Section \BaseNamedObjects\mmGlobalPnpInfo
> Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
> Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
> Semaphore \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
> Thread winlogon.exe(1236): 1240
> Thread winlogon.exe(1236): 1644
> Thread winlogon.exe(1236): 3668
> Thread winlogon.exe(1236): 1240
> Thread winlogon.exe(1236): 1260
> Thread winlogon.exe(1236): 2404
> Thread winlogon.exe(1236): 1268
> Thread winlogon.exe(1236): 1276
> Thread winlogon.exe(1236): 1288
> Thread winlogon.exe(1236): 1380
> Thread winlogon.exe(1236): 1380
> Thread winlogon.exe(1236): 1384
> Thread winlogon.exe(1236): 1388
> Thread winlogon.exe(1236): 1420
> Thread winlogon.exe(1236): 1524
> Thread winlogon.exe(1236): 2448
> Thread winlogon.exe(1236): 2212
> Thread winlogon.exe(1236): 1272
> Thread winlogon.exe(1236): 2208
> Thread winlogon.exe(1236): 2004
> Thread winlogon.exe(1236): 1644
> Thread winlogon.exe(1236): 2212
> Thread winlogon.exe(1236): 3516
> Thread winlogon.exe(1236): 2220
> Thread winlogon.exe(1236): 1644
> Thread winlogon.exe(1236): 2220
> Thread winlogon.exe(1236): 2140
> Thread winlogon.exe(1236): 2676
> Thread winlogon.exe(1236): 1644
> Thread winlogon.exe(1236): 2404
> Thread winlogon.exe(1236): 2216
> Thread winlogon.exe(1236): 2404
> Thread winlogon.exe(1236): 3216
> Thread winlogon.exe(1236): 328
> Thread winlogon.exe(1236): 2404
> Thread winlogon.exe(1236): 3492
> Timer \BaseNamedObjects\userenv: refresh timer for 1236:1644
> Timer \BaseNamedObjects\AUTOENRL:MachineEnrollmentTimer
> Timer \BaseNamedObjects\userenv: refresh timer for 1236:2404
> Timer \BaseNamedObjects\AUTOENRL:UserEnrollmentShellTime r
> Timer \BaseNamedObjects\AUTOENRL:UserEnrollmentTimer
> Token domain\phil:a359c
> Token NT AUTHORITY\NETWORK SERVICE:3e4
> Token NT AUTHORITY\SYSTEM:3e7
> Token NT AUTHORITY\SYSTEM:3e7
> Token NT AUTHORITY\SYSTEM:3e7
> Token domain\phil:a359c
> Token domain\phil:a359c
> Token domain\phil:a359c
> Token domain\phil:a359c
> Token domain\phil:a359c
> Token NT AUTHORITY\SYSTEM:3e7
> WindowStation \Windows\WindowStations\WinSta0
> WindowStation \Windows\WindowStations\WinSta0n
>
> Is there a fix for this or a way to calm winlogon.exe down? It doesn't
> seem to matter how long my session uptime is either since this was only
> three days old.
>
> Thank you in advance. :)
> --
> Phillip Pi
> Senior Software Quality Assurance Analyst
> ISP/Symantec Online Services, Consumer Business Unit
> Symantec Corporation
> www.symantec.com
> -----------------------------------------------------
> Email: phillip_pi@symantec.comSYMC (remove SYMC to reply by e-mail)
> -----------------------------------------------------
> Please do NOT e-mail me for technical support. DISCLAIMER: The views
> expressed in this posting are mine, and do not necessarily reflect the
> views of my employer. Thank you.