Current version of winmm.dll for Windows SP2 is: "5.1.2600.2180"
Located in C:\Windows\sytem32

JS

"Phillip Pi" <phillip_pi@symantec.comSYMC> wrote in message
news:%234aDdIU5IHA.2348@TK2MSFTNGP06.phx.gbl...
>I did more research today since I had another one earlier today. :(
>According to Process Explorer v11.20's winlogon.exe's threads properties,
>WINMM.dll!PlaySoundW+0x77f was the one hogging the CPU (not sure if this
>was the same as before since I never went this deep). Here's Process
>Explorer exported log: http://pastebin.ca/1071193 (no wordwrapping since
>this is wide and expires in 30 days). That sounds like audio so I check my
>headphones and heard NO sounds. I tried disabling and enabling SoundMAX
>Integrated Digital Audio in device manager, but that didn't help. I believe
>I have the latest drivers (2004).
>
>
> On 7/11/2008 1:23 PM PT, Phillip Pi wrote:
>
>> Hello.
>>
>> I have a strange rare and annoying Windows XP Pro. SP2 (IE6.0 SP2; all
>> critical updates and optional softwares for SP2) issue that had been
>> around for three years or so, and I can't figure out what's going on.
>>
>> Once in a while (very rare -- maybe once every one/two months?), I
>> winlogon.exe decides to go nuts and take one of my CPU (have a dual core
>> Intel P4 Prescott machine). From there, softwares don't respond and some
>> can't be shut down (e.g., SeaMonkey.exe, Trillian.exe, Outlook.exe) even
>> if I force end task. When I try to shut down Windows to reboot, it gets
>> stuck forever and I need to do a force shut down on the power switch on
>> the Dell Optiplex GX280 case.
>>
>> I tried viewing Process Explorer, Process Monitor, event logs, services
>> via cmd.exe (administrative method freezes/doesn't respond), etc. and
>> found nothing interesting. Here are the Process Explorer exports:
>>
>> From Process Explorer v11.20:
>>
>>
>> Process PID Description CPU Company Name
>> System Idle Process 0 39.13 Interrupts n/a Hardware
>> Interrupts DPCs n/a Deferred Procedure Calls System
>> 4 smss.exe 1160 Windows NT Session Manager
>> Microsoft Corporation
>> csrss.exe 1208 Client Server Runtime Process Microsoft
>> Corporation
>> winlogon.exe 1236 Windows NT Logon Application 50.00
>> Microsoft Corporation
>> services.exe 1280 Services and Controller app 0.72
>> Microsoft Corporation
>> svchost.exe 1480 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> svchost.exe 1536 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> svchost.exe 456 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> Smc.exe 724 Symantec CMC Smc 0.72 Symantec Corporation
>> SmcGui.exe 2168 Symantec CMC SmcGui 4.35 Symantec
>> Corporation
>> svchost.exe 780 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> svchost.exe 892 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> SNAC.EXE 904 Symantec Network Access Control 0.72
>> Symantec Corporation
>> ccSvcHst.exe 1968 Symantec Service Framework Symantec
>> Corporation
>> spoolsv.exe 1916 Spooler SubSystem App Microsoft
>> Corporation
>> AeXNSAgent.exe 1924 Altiris Agent Altiris, Inc.
>> AluSchedulerSvc.exe 524 Automatic LiveUpdate Scheduler Service
>> Symantec Corporation
>> ntmulti.exe 944 IBM Lotus Notes/Domino IBM Corp
>> NMSAccess.exe 968 p4ps.exe 1084 P4Webs.exe
>> 1648 spkrmon.exe 1676 SoundMAX SpeakerMonitor service
>> Rtvscan.exe 1664 Symantec AntiVirus Symantec Corporation
>> vmware-authd.exe 2192 VMware Authorization Service
>> VMware, Inc.
>> vmount2.exe 2704 virtual disk mount service VMware,
>> Inc.
>> vmnat.exe 2904 VMware NAT Service VMware, Inc.
>> vmnetdhcp.exe 3180 VMware VMnet DHCP service VMware,
>> Inc.
>> alg.exe 2996 Application Layer Gateway Service
>> Microsoft Corporation
>> lsass.exe 1292 LSA Shell (Export Version) Microsoft
>> Corporation
>> explorer.exe 3228 Windows Explorer Microsoft Corporation
>> TaskSwitch.exe 3660 ccApp.exe 3100 Symantec User
>> Session Symantec Corporation
>> trillian.exe 1700 Trillian Cerulean Studios
>> OUTLOOK.EXE 2952 Microsoft Office Outlook Microsoft
>> Corporation
>> seamonkey.exe 1012 SeaMonkey mozilla.org
>> taskmgr.exe 1616 Windows TaskManager Microsoft Corporation
>> procexp.exe 3392 Sysinternals Process Explorer 4.35
>> Sysinternals - www.sysinternals.com
>>
>> Process: winlogon.exe Pid: 1236
>>
>> Name Description Company Name Version
>> ACTIVEDS.dll ADs Router Layer DLL Microsoft Corporation
>> 5.01.2600.2180
>> adsldpc.dll ADs LDAP Provider C DLL Microsoft Corporation
>> 5.01.2600.2180
>> ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation
>> 5.01.2600.2180
>> Apphelp.dll Application Compatibility Client Library Microsoft
>> Corporation 5.01.2600.2180
>> Ati2evxx.dll ATI External Event Utility DLL Module ATI Technologies
>> Inc. 6.14.0010.4123
>> ATL.DLL ATL Module for Windows XP (Unicode) Microsoft Corporation
>> 3.05.2284.0000
>> AUTHZ.dll Authorization Framework Microsoft Corporation
>> 5.01.2600.2622
>> Cabinet.dll Microsoft® Cabinet File API Microsoft Corporation
>> 5.01.2600.2180
>> CLBCATQ.DLL Microsoft Corporation 2001.12.4414.0308
>> COMCTL32.dll Common Controls Library Microsoft Corporation
>> 5.82.2900.2982
>> comctl32.dll User Experience Controls Library Microsoft Corporation
>> 6.00.2900.2982
>> comdlg32.dll Common Dialogs DLL Microsoft Corporation
>> 6.00.2900.2180
>> COMRes.dll Microsoft Corporation 2001.12.4414.0258
>> CRYPT32.dll Crypto API32 Microsoft Corporation 5.131.2600.2180
>> cryptdll.dll Cryptography Manager Microsoft Corporation
>> 5.01.2600.2180
>> cscdll.dll Offline Network Agent Microsoft Corporation
>> 5.01.2600.2180
>> cscui.dll Client Side Caching UI Microsoft Corporation
>> 5.01.2600.2180
>> ctype.nls DNSAPI.dll DNS Client API DLL Microsoft
>> Corporation 5.01.2600.3394
>> fastprox.dll WMI Microsoft Corporation 5.01.2600.2180
>> GDI32.dll GDI Client DLL Microsoft Corporation 5.01.2600.3316
>> hnetcfg.dll Home Networking Configuration Manager Microsoft
>> Corporation 5.01.2600.2180
>> icmp.dll ICMP DLL Microsoft Corporation 5.01.2600.2180
>> IMAGEHLP.dll Windows NT Image Helper Microsoft Corporation
>> 5.01.2600.2180
>> IMM32.DLL Windows XP IMM32 API Client DLL Microsoft Corporation
>> 5.01.2600.2180
>> iphlpapi.dll IP Helper API Microsoft Corporation 5.01.2600.2912
>> kerberos.dll Kerberos Security Package Microsoft Corporation
>> 5.01.2600.2698
>> kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation
>> 5.01.2600.3119
>> locale.nls LPK.DLL Language Pack Microsoft Corporation
>> 5.01.2600.2180
>> midimap.dll Microsoft MIDI Mapper Microsoft Corporation
>> 5.01.2600.2180
>> MPR.dll Multiple Provider Router DLL Microsoft Corporation
>> 5.01.2600.2180
>> MPRAPI.dll Windows NT MP Router Administration DLL Microsoft
>> Corporation 5.01.2600.2180
>> MSACM32.dll Microsoft ACM Audio Filter Microsoft Corporation
>> 5.01.2600.2180
>> msacm32.drv Microsoft Sound Mapper Microsoft Corporation
>> 5.01.2600.0000
>> MSASN1.dll ASN.1 Runtime APIs Microsoft Corporation
>> 5.01.2600.2180
>> msctfime.ime Microsoft Text Frame Work Service IME Microsoft
>> Corporation 5.01.2600.2180
>> MSGINA.dll Windows NT Logon GINA DLL Microsoft Corporation
>> 5.01.2600.2180
>> msv1_0.dll Microsoft Authentication Package v1.0 Microsoft
>> Corporation 5.01.2600.2180
>> MSVCP60.dll Microsoft (R) C++ Runtime Library Microsoft Corporation
>> 6.02.3104.0000
>> MSVCR70.dll Microsoft® C Runtime Library Microsoft Corporation
>> 7.00.9466.0000
>> msvcrt.dll Windows NT CRT DLL Microsoft Corporation
>> 7.00.2600.3085
>> mswsock.dll Microsoft Windows Sockets 2.0 Service Provider
>> Microsoft Corporation 5.01.2600.3394
>> msxml3.dll MSXML 3.0 SP9 Microsoft Corporation 8.90.1101.0000
>> msxml3r.dll XML Resources Microsoft Corporation 8.20.8730.0001
>> NavLogon.dll Symantec AntiVirus Logon Notification Symantec
>> Corporation 10.01.0000.0401
>> NDdeApi.dll Network DDE Share Management APIs Microsoft Corporation
>> 5.01.2600.2180
>> NETAPI32.dll Net Win32 API DLL Microsoft Corporation
>> 5.01.2600.2976
>> ntdll.dll NT Layer DLL Microsoft Corporation 5.01.2600.2180
>> NTDSAPI.DLL NT5DS Microsoft Corporation 5.01.2600.2180
>> NTMARTA.DLL Windows NT MARTA provider Microsoft Corporation
>> 5.01.2600.2180
>> ODBC32.dll Microsoft Data Access - ODBC Driver Manager Microsoft
>> Corporation 3.525.1117.0000
>> odbcint.dll Microsoft Data Access - ODBC Resources Microsoft
>> Corporation 3.525.1117.0000
>> ole32.dll Microsoft OLE for Windows Microsoft Corporation
>> 5.01.2600.2726
>> OLEAUT32.dll Microsoft Corporation 5.01.2600.3266
>> PCANotify.dll Winlogon Notification package Symantec Corporation
>> 11.00.0001.0764
>> PROFMAP.dll Userenv Microsoft Corporation 5.01.2600.2180
>> PSAPI.DLL Process Status Helper Microsoft Corporation
>> 5.01.2600.2180
>> REGAPI.dll Registry Configuration APIs Microsoft Corporation
>> 5.01.2600.2180
>> RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation
>> 5.01.2600.3173
>> rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft
>> Corporation 5.01.2600.2161
>> rtutils.dll Routing Utilities Microsoft Corporation
>> 5.01.2600.2180
>> SAMLIB.dll SAM Library DLL Microsoft Corporation 5.01.2600.2180
>> SASWINLO.dll SUPERAntiSpyware WinLogon Processor
>> SUPERAntiSpyware.com 1.00.0000.1046
>> Secur32.dll Security Support Provider Interface Microsoft
>> Corporation 5.01.2600.2180
>> SETUPAPI.dll Windows Setup API Microsoft Corporation
>> 5.01.2600.2180
>> sfc.dll Windows File Protection Microsoft Corporation
>> 5.01.2600.2180
>> sfc_os.dll Windows File Protection Microsoft Corporation
>> 5.01.2600.2180
>> SHELL32.dll Windows Shell Common Dll Microsoft Corporation
>> 6.00.2900.3241
>> SHLWAPI.dll Shell Light-weight Utility Library Microsoft
>> Corporation 6.00.2900.3354
>> SHSVCS.dll Windows Shell Services Dll Microsoft Corporation
>> 6.00.2900.3051
>> sortkey.nls sorttbls.nls sxs.dll Fusion 2.5
>> Microsoft Corporation 5.01.2600.3019
>> unicode.nls USER32.dll Windows XP USER API Client DLL
>> Microsoft Corporation 5.01.2600.3099
>> USERENV.dll Userenv Microsoft Corporation 5.01.2600.2180
>> USP10.dll Uniscribe Unicode script processor Microsoft Corporation
>> 1.420.2600.2180
>> uxtheme.dll Microsoft UxTheme Library Microsoft Corporation
>> 6.00.2900.2180
>> VERSION.dll Version Checking and File Installation Libraries
>> Microsoft Corporation 5.01.2600.2180
>> wbemcomn.dll WMI Microsoft Corporation 5.01.2600.2180
>> wbemprox.dll WMI Microsoft Corporation 5.01.2600.2180
>> wbemsvc.dll WMI Microsoft Corporation 5.01.2600.2180
>> wdmaud.drv WDM Audio driver mapper Microsoft Corporation
>> 5.01.2600.2180
>> WgaLogon.dll Windows Genuine Advantage Notification Microsoft
>> Corporation 1.07.0018.0007
>> WININET.dll Internet Extensions for Win32 Microsoft Corporation
>> 6.00.2900.3354
>> winlogon.exe Windows NT Logon Application Microsoft Corporation
>> 5.01.2600.2180
>> WINMM.dll MCI API DLL Microsoft Corporation 5.01.2600.2180
>> WINSCARD.DLL Microsoft Smart Card API Microsoft Corporation
>> 5.01.2600.2180
>> WINSPOOL.DRV Windows Spooler Driver Microsoft Corporation
>> 5.01.2600.2180
>> WINSTA.dll Winstation Library Microsoft Corporation
>> 5.01.2600.2180
>> WINTRUST.dll Microsoft Trust Verification APIs Microsoft
>> Corporation 5.131.2600.2180
>> WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation
>> 5.01.2600.2180
>> WlNotify.dll Common DLL to receive Winlogon notifications Microsoft
>> Corporation 5.01.2600.2180
>> WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation
>> 5.01.2600.2180
>> WS2HELP.dll Windows Socket 2.0 Helper for Windows NT Microsoft
>> Corporation 5.01.2600.2180
>> wshtcpip.dll Windows Sockets Helper DLL Microsoft Corporation
>> 5.01.2600.2180
>> wsock32.dll Windows Socket 32-Bit DLL Microsoft Corporation
>> 5.01.2600.2180
>> WTSAPI32.dll Windows Terminal Server SDK APIs Microsoft Corporation
>> 5.01.2600.2180
>> xpsp2res.dll Service Pack 2 Messages Microsoft Corporation
>> 5.01.2600.2180
>>
>> --
>>
>> Process PID Description CPU Company Name
>> System Idle Process 0 41.18 Interrupts n/a Hardware
>> Interrupts DPCs n/a Deferred Procedure Calls System
>> 4 smss.exe 1160 Windows NT Session Manager
>> Microsoft Corporation
>> csrss.exe 1208 Client Server Runtime Process Microsoft
>> Corporation
>> winlogon.exe 1236 Windows NT Logon Application 50.00
>> Microsoft Corporation
>> services.exe 1280 Services and Controller app 0.74
>> Microsoft Corporation
>> svchost.exe 1480 Generic Host Process for Win32 Services
>> 0.74 Microsoft Corporation
>> svchost.exe 1536 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> svchost.exe 456 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> Smc.exe 724 Symantec CMC Smc 0.74 Symantec Corporation
>> SmcGui.exe 2168 Symantec CMC SmcGui 2.94 Symantec
>> Corporation
>> svchost.exe 780 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> svchost.exe 892 Generic Host Process for Win32 Services
>> Microsoft Corporation
>> SNAC.EXE 904 Symantec Network Access Control Symantec
>> Corporation
>> ccSvcHst.exe 1968 Symantec Service Framework 0.74
>> Symantec Corporation
>> spoolsv.exe 1916 Spooler SubSystem App Microsoft
>> Corporation
>> AeXNSAgent.exe 1924 Altiris Agent Altiris, Inc.
>> AluSchedulerSvc.exe 524 Automatic LiveUpdate Scheduler Service
>> Symantec Corporation
>> ntmulti.exe 944 IBM Lotus Notes/Domino IBM Corp
>> NMSAccess.exe 968 p4ps.exe 1084 P4Webs.exe
>> 1648 spkrmon.exe 1676 SoundMAX SpeakerMonitor service
>> Rtvscan.exe 1664 Symantec AntiVirus Symantec Corporation
>> vmware-authd.exe 2192 VMware Authorization Service
>> VMware, Inc.
>> vmount2.exe 2704 virtual disk mount service VMware,
>> Inc.
>> vmnat.exe 2904 VMware NAT Service VMware, Inc.
>> vmnetdhcp.exe 3180 VMware VMnet DHCP service VMware,
>> Inc.
>> alg.exe 2996 Application Layer Gateway Service
>> Microsoft Corporation
>> lsass.exe 1292 LSA Shell (Export Version) Microsoft
>> Corporation
>> explorer.exe 3228 Windows Explorer Microsoft Corporation
>> TaskSwitch.exe 3660 ccApp.exe 3100 Symantec User
>> Session Symantec Corporation
>> trillian.exe 1700 Trillian Cerulean Studios
>> OUTLOOK.EXE 2952 Microsoft Office Outlook Microsoft
>> Corporation
>> seamonkey.exe 1012 SeaMonkey mozilla.org
>> taskmgr.exe 1616 Windows TaskManager Microsoft Corporation
>> procexp.exe 3392 Sysinternals Process Explorer 2.94
>> Sysinternals - www.sysinternals.com
>>
>> Process: winlogon.exe Pid: 1236
>>
>> Type Name
>> Desktop \Winlogon
>> Desktop \Disconnect
>> Desktop \Default
>> Desktop \Default
>> Directory \KnownDlls
>> Directory \Windows
>> Directory \BaseNamedObjects
>> Event \BaseNamedObjects\AUTOENRL:TriggerMachineEnrollmen t
>> Event \BaseNamedObjects\crypt32LogoffEvent
>> Event \BaseNamedObjects\userenv: User Profile setup event
>> Event \BaseNamedObjects\userenv: Machine Group Policy has been applied
>> Event \BaseNamedObjects\userenv: Machine Group Policy ForcedRefresh
>> Needs Foreground Processing
>> Event \BaseNamedObjects\userenv: Machine Group Policy Processing is
>> done
>> Event \BaseNamedObjects\userenv: Machine Policy Foreground Done Event
>> Event \BaseNamedObjects\userenv: User Group Policy has been applied
>> Event \BaseNamedObjects\userenv: User Group Policy ForcedRefresh Needs
>> Foreground Processing
>> Event \BaseNamedObjects\userenv: User Group Policy Processing is done
>> Event \BaseNamedObjects\userenv: User Policy Foreground Done Event
>> Event \BaseNamedObjects\WinlogonTSSynchronizeEvent
>> Event \BaseNamedObjects\TS-WPAAE
>> Event \BaseNamedObjects\ReconEvent
>> Event \Security\NetworkProviderLoad
>> Event \BaseNamedObjects\AtiExtEventGSNotificationEvent
>> Event \BaseNamedObjects\jjCSCSharedFillEvent_UM_KM
>> Event \BaseNamedObjects\hardwaremixercallback
>> Event \BaseNamedObjects\WFP_IDLE_TRIGGER
>> Event \BaseNamedObjects\Microsoft Smart Card Resource Manager Started
>> Event \BaseNamedObjects\msgina: ReturnToWelcome
>> Event \BaseNamedObjects\ThemesStartEvent
>> Event \BaseNamedObjects\DINPUTWINMM
>> Event \BaseNamedObjects\winlogon: machine GPO Event 70406
>> Event \BaseNamedObjects\userenv: Machine Group Policy has been applied
>> Event \BaseNamedObjects\userenv: machine policy refresh event
>> Event \BaseNamedObjects\userenv: machine policy force refresh event
>> Event \BaseNamedObjects\userenv: Machine Group Policy has been applied
>> Event \BaseNamedObjects\userenv: Machine Group Policy ForcedRefresh
>> Needs Foreground Processing
>> Event \BaseNamedObjects\userenv: Machine Group Policy Processing is
>> done
>> Event \BaseNamedObjects\AgentExistsEvent
>> Event \BaseNamedObjects\WkssvcToAgentStopEvent
>> Event \BaseNamedObjects\WkssvcToAgentStartEvent
>> Event \BaseNamedObjects\jjCSCSessEvent_UM_KM_0
>> Event \BaseNamedObjects\AgentToWkssvcEvent
>> Event \BaseNamedObjects\PCA_UnlockWksNotify
>> Event \BaseNamedObjects\PCA_LockWksNotify
>> Event \BaseNamedObjects\PCA_TAG_TEAM_0
>> Event \BaseNamedObjects\SENS Started Event
>> Event \BaseNamedObjects\userenv: user policy force refresh event
>> Event \BaseNamedObjects\userenv: User Group Policy has been applied
>> Event \BaseNamedObjects\userenv: User Group Policy has been applied
>> Event \BaseNamedObjects\userenv: User Group Policy Processing is done
>> Event \BaseNamedObjects\userenv: User Group Policy ForcedRefresh Needs
>> Foreground Processing
>> Event \BaseNamedObjects\userenv: user policy refresh event
>> Event \BaseNamedObjects\winlogon: User GPO Event 483671
>> Event \BaseNamedObjects\WlballoonLogoffNotificationEvent Name
>> Event \BaseNamedObjects\AUTOENRL:TriggerUserEnrollment
>> Event \BaseNamedObjects\CscCacheInitCompleteEvent
>> Event \BaseNamedObjects\ShellReadyEvent
>> Event \BaseNamedObjects\WlballoonLogoffNotificationEvent Name
>> Event \BaseNamedObjects\mixercallback
>> Event
>> \BaseNamedObjects\00000000000a359c_WlballoonKerber osNotificationEventName
>> File \Device\NamedPipe\TerminalServer\AutoReconnect
>> File
>> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
>> File \Device\KsecDD
>> File \Device\NamedPipe\InitShutdown
>> File \Device\NamedPipe\InitShutdown
>> File C:\WINDOWS\system32\dllcache
>> File
>> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
>> File C:\WINDOWS\AppPatch
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\isapi\_vti_adm
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\_vti_bin\_vti_adm
>> File C:\WINDOWS\system32
>> File C:\WINDOWS\Help
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\isapi\_vti_aut
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\_vti_bin\_vti_aut
>> File C:\WINDOWS\system32\inetsrv
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\bin
>> File C:\WINDOWS\Fonts
>> File C:\WINDOWS\system32\drivers
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\servsupp
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\bots\vinavbar
>> File C:\Program Files\microsoft frontpage\version3.0\bin
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\_vti_bin
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\bin\1033
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\isapi
>> File C:\WINDOWS
>> File C:\Program Files\Common Files\Microsoft Shared\DAO
>> File C:\Program Files\Windows Media Player
>> File C:\Program Files\Common Files\System\msadc
>> File C:\Program Files\Common Files\System\ado
>> File C:\Program Files\Common Files\System\Ole DB
>> File C:\WINDOWS\inf
>> File C:\WINDOWS\system
>> File C:\WINDOWS\msagent
>> File C:\WINDOWS\msagent\intl
>> File C:\Program Files\MSN Gaming Zone\Windows
>> File C:\WINDOWS\PCHealth\HelpCtr\Binaries
>> File C:\Program Files\NetMeeting
>> File C:\WINDOWS\system32\drivers\disdn
>> File C:\WINDOWS\ime\CHTIME\Applets
>> File C:\WINDOWS\system32\wbem
>> File C:\WINDOWS\system32\IME\CINTLGNT
>> File C:\WINDOWS\system32\Com
>> File C:\WINDOWS\system32\Setup
>> File C:\WINDOWS\ime\IMJP8_1
>> File C:\Program Files\Common Files\Microsoft Shared\Triedit
>> File C:\Program Files\Windows NT
>> File C:\Program Files\Common Files\System
>> File C:\WINDOWS\system32\1033
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\admcgi\scripts
>> File C:\Program Files\Common Files\Microsoft Shared\web server
>> extensions\40\admisapi\scripts
>> File C:\WINDOWS\system32\usmt
>> File C:\WINDOWS\ime\IMKR6_1\Dicts
>> File C:\WINDOWS\system32\mui\0009
>> File C:\Program Files\Internet Explorer
>> File C:\WINDOWS\ime\IMJP8_1\APPLETS
>> File C:\WINDOWS\ime\IMKR6_1\Applets
>> File C:\WINDOWS\system32\xircom
>> File C:\Program Files\Internet Explorer\Connection Wizard
>> File C:\Program Files\Common Files\Microsoft Shared\MSInfo
>> File C:\WINDOWS\ime\IMKR6_1
>> File C:\WINDOWS\ime\SHARED
>> File C:\WINDOWS\system32\IME\PINTLGNT
>> File C:\Program Files\Common
>> Files\SpeechEngines\Microsoft\Lexicon\1033
>> File C:\WINDOWS\Resources\Themes\Luna
>> File C:\Program Files\Movie Maker
>> File C:\WINDOWS\ime
>> File C:\WINDOWS\srchasst
>> File C:\Program Files\Outlook Express
>> File C:\WINDOWS\system32\oobe
>> File C:\Program Files\Common Files\MSSoap\Binaries
>> File C:\Program Files\Common Files\MSSoap\Binaries\Resources\1033
>> File C:\WINDOWS\mui
>> File C:\WINDOWS\system32\npp
>> File C:\WINDOWS\ime\SHARED\RES
>> File C:\Program Files\Windows NT\Pinball
>> File C:\WINDOWS\ime\CHSIME\APPLETS
>> File C:\WINDOWS\system32\Restore
>> File C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS\1033
>> File C:\Program Files\Common Files\Microsoft Shared\Speech
>> File C:\WINDOWS\Resources\Themes\Luna\Shell\NormalColor
>> File C:\WINDOWS\Resources\Themes\Luna\Shell\Homestead
>> File C:\WINDOWS\Resources\Themes\Luna\Shell\Metallic
>> File C:\WINDOWS\system32\wbem\snmp
>> File C:\Program Files\Common Files\SpeechEngines\Microsoft
>> File C:\Program Files\Common Files\Microsoft Shared\Speech\1033
>> File C:\WINDOWS\PeerNet
>> File C:\WINDOWS\system32\spool\drivers\color
>> File C:\WINDOWS\system32\IME\TINTLGNT
>> File C:\WINDOWS\Help\Tours\mmTour
>> File C:\WINDOWS\PCHealth\UploadLB\Binaries
>> File C:\Program Files\Common Files\Microsoft Shared\VGX
>> File C:\WINDOWS\system32\wbem\xml
>> File C:\Program Files\Windows NT\Accessories
>> File C:\WINDOWS\system32\mui\0401
>> File C:\WINDOWS\system32\mui\0404
>> File C:\WINDOWS\system32\mui\0405
>> File C:\WINDOWS\system32\mui\0406
>> File C:\WINDOWS\system32\mui\0407
>> File C:\WINDOWS\system32\mui\0408
>> File C:\WINDOWS\system32\mui\040b
>> File C:\WINDOWS\system32\mui\040C
>> File C:\WINDOWS\system32\mui\040D
>> File C:\WINDOWS\system32\mui\040e
>> File C:\WINDOWS\system32\mui\0410
>> File C:\WINDOWS\system32\mui\0411
>> File C:\WINDOWS\system32\mui\0412
>> File C:\WINDOWS\system32\mui\0413
>> File C:\WINDOWS\system32\mui\0414
>> File C:\WINDOWS\system32\mui\0415
>> File C:\WINDOWS\system32\mui\0416
>> File C:\WINDOWS\system32\mui\0419
>> File C:\WINDOWS\system32\mui\041b
>> File C:\WINDOWS\system32\mui\041D
>> File C:\WINDOWS\system32\mui\041f
>> File C:\WINDOWS\system32\mui\0424
>> File C:\WINDOWS\system32\mui\0804
>> File C:\WINDOWS\system32\mui\0816
>> File C:\WINDOWS\system32\mui\0C0A
>> File C:\WINDOWS\system32\mui\0402
>> File C:\WINDOWS\system32\mui\0418
>> File C:\WINDOWS\system32\mui\041a
>> File C:\WINDOWS\system32\mui\041e
>> File C:\WINDOWS\system32\mui\0425
>> File C:\WINDOWS\system32\mui\0426
>> File C:\WINDOWS\system32\mui\0427
>> File C:\Program Files\xerox\nwwia
>> File C:\WINDOWS\WinSxS
>> File \Device\NamedPipe\SfcApi
>> File \Device\NamedPipe\SfcApi
>> File \Device\Tcp
>> File \Device\Tcp
>> File \Device\Ip
>> File \Device\Ip
>> File \Device\Ip
>> File \Device\Afd\Endpoint
>> File \Device\Udp
>> File \Device\Afd\AsyncConnectHlp
>> File
>> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
>> File \Device\LanmanRedirector
>> File \Device\NamedPipe\winlogonrpc
>> File
>> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
>> File \Device\NamedPipe\winlogonrpc
>> File \Device\NamedPipe\winlogonrpc
>> File \Device\KSENUM#00000001\{9B365890-165F-11D0-A195-0020AFD156E4}
>> File C:\WINDOWS\system32
>> Key HKCR
>> Key HKLM\SYSTEM\ControlSet001\Control\Nls\Locale
>> Key HKLM\SYSTEM\ControlSet001\Control\Nls\Locale\Alter nate Sorts
>> Key HKLM\SYSTEM\ControlSet001\Control\Nls\Language Groups
>> Key HKCR
>> Key
>> HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parame ters\Protocol_Catalog9
>> Key
>> HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parame ters\NameSpace_Catalog5
>> Key HKLM\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\Winlogon\Notify\crypt32chain
>> Key HKLM\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\Winlogon\Notify\cryptnet
>> Key HKCR\CLSID
>> Key HKLM\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\Winlogon\Notify\sclgntfy
>> Key HKLM\SYSTEM\ControlSet001\Control\Lsa
>> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
>> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
>> Key HKLM\SYSTEM\Setup
>> Key HKLM\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\Winlogon\Credentials
>> Key HKU
>> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
>> Key HKU
>> Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage
>> Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameter s
>> Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameter s\Interfaces
>> Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameter s
>> Key HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVer sion\Internet
>> Settings
>> Key HKLM
>> Key HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\ HwOrder
>> Key HKLM\SOFTWARE\Microsoft\Windows
>> NT\CurrentVersion\Winlogon\Notify\WgaLogon
>> Key HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoa m\MUICache
>> Key HKCU
>> Key HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoa m
>> Key HKU\.DEFAULT
>> Key HKCR
>> Key HKCR
>> Key HKCR
>> Key HKLM\SOFTWARE\Microsoft\COM3
>> Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
>> Key HKLM\SOFTWARE\Microsoft\COM3
>> Key HKLM\SOFTWARE\Microsoft\COM3
>> Key HKU
>> Key HKU
>> Key HKLM\SOFTWARE\Microsoft\COM3
>> Key HKCR
>> Key HKLM\SOFTWARE\Microsoft\COM3
>> Key HKLM\SOFTWARE\Microsoft\COM3
>> Key HKCR
>> Key HKCR
>> Key HKCR\CLSID
>> Key HKCR
>> Key HKCR
>> Key HKCR
>> Key HKCR
>> Key HKCR
>> Key HKCR
>> Key HKCR
>> KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent
>> Mutant \BaseNamedObjects\userenv: machine policy mutex
>> Mutant \BaseNamedObjects\userenv: Machine Registry policy mutex
>> Mutant \BaseNamedObjects\userenv: user policy mutex
>> Mutant \BaseNamedObjects\userenv: User Registry policy mutex
>> Mutant \BaseNamedObjects\SingleSesMutex
>> Mutant \BaseNamedObjects\winlogon: Logon UserProfileMapping Mutex
>> Mutant \BaseNamedObjects\ShimCacheMutex
>> Mutant \BaseNamedObjects\WPA_PR_MUTEX
>> Mutant \BaseNamedObjects\WPA_RT_MUTEX
>> Mutant \BaseNamedObjects\WPA_LT_MUTEX
>> Mutant \BaseNamedObjects\WPA_HWID_MUTEX
>> Mutant \BaseNamedObjects\WPA_LICSTORE_MUTEX
>> Port \RPC Control\sclogonrpc
>> Port \RPC Control\IUserProfile
>> Port \RPC Control\OLE273DB90569D049E7BB5A549E0AAA
>> Process services.exe(1280)
>> Process lsass.exe(1292)
>> Section \BaseNamedObjects\ShimSharedMemory
>> Section \BaseNamedObjects\Debug.Memory.4d4
>> Section \BaseNamedObjects\WDMAUD_Callbacks
>> Section \BaseNamedObjects\mmGlobalPnpInfo
>> Semaphore
>> \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
>> Semaphore
>> \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
>> Semaphore
>> \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
>> Thread winlogon.exe(1236): 1240
>> Thread winlogon.exe(1236): 1644
>> Thread winlogon.exe(1236): 3668
>> Thread winlogon.exe(1236): 1240
>> Thread winlogon.exe(1236): 1260
>> Thread winlogon.exe(1236): 2404
>> Thread winlogon.exe(1236): 1268
>> Thread winlogon.exe(1236): 1276
>> Thread winlogon.exe(1236): 1288
>> Thread winlogon.exe(1236): 1380
>> Thread winlogon.exe(1236): 1380
>> Thread winlogon.exe(1236): 1384
>> Thread winlogon.exe(1236): 1388
>> Thread winlogon.exe(1236): 1420
>> Thread winlogon.exe(1236): 1524
>> Thread winlogon.exe(1236): 2448
>> Thread winlogon.exe(1236): 2212
>> Thread winlogon.exe(1236): 1272
>> Thread winlogon.exe(1236): 2208
>> Thread winlogon.exe(1236): 2004
>> Thread winlogon.exe(1236): 1644
>> Thread winlogon.exe(1236): 2212
>> Thread winlogon.exe(1236): 3516
>> Thread winlogon.exe(1236): 2220
>> Thread winlogon.exe(1236): 1644
>> Thread winlogon.exe(1236): 2220
>> Thread winlogon.exe(1236): 2140
>> Thread winlogon.exe(1236): 2676
>> Thread winlogon.exe(1236): 1644
>> Thread winlogon.exe(1236): 2404
>> Thread winlogon.exe(1236): 2216
>> Thread winlogon.exe(1236): 2404
>> Thread winlogon.exe(1236): 3216
>> Thread winlogon.exe(1236): 328
>> Thread winlogon.exe(1236): 2404
>> Thread winlogon.exe(1236): 3492
>> Timer \BaseNamedObjects\userenv: refresh timer for 1236:1644
>> Timer \BaseNamedObjects\AUTOENRL:MachineEnrollmentTimer
>> Timer \BaseNamedObjects\userenv: refresh timer for 1236:2404
>> Timer \BaseNamedObjects\AUTOENRL:UserEnrollmentShellTime r
>> Timer \BaseNamedObjects\AUTOENRL:UserEnrollmentTimer
>> Token domain\phil:a359c
>> Token NT AUTHORITY\NETWORK SERVICE:3e4
>> Token NT AUTHORITY\SYSTEM:3e7
>> Token NT AUTHORITY\SYSTEM:3e7
>> Token NT AUTHORITY\SYSTEM:3e7
>> Token domain\phil:a359c
>> Token domain\phil:a359c
>> Token domain\phil:a359c
>> Token domain\phil:a359c
>> Token domain\phil:a359c
>> Token NT AUTHORITY\SYSTEM:3e7
>> WindowStation \Windows\WindowStations\WinSta0
>> WindowStation \Windows\WindowStations\WinSta0n
>>
>> Is there a fix for this or a way to calm winlogon.exe down? It doesn't
>> seem to matter how long my session uptime is either since this was only
>> three days old.
>>
>> Thank you in advance. :)
> --
> Phillip Pi
> Senior Software Quality Assurance Analyst
> ISP/Symantec Online Services, Consumer Business Unit
> Symantec Corporation
> www.symantec.com
> -----------------------------------------------------
> Email: phillip_pi@symantec.comSYMC (remove SYMC to reply by e-mail)
> -----------------------------------------------------
> Please do NOT e-mail me for technical support. DISCLAIMER: The views
> expressed in this posting are mine, and do not necessarily reflect the
> views of my employer. Thank you.