Winlogon.exe Error

Hi,

Has anyone experienced an issue with the Winlogon.exe producing an event ID
26 which then in turn reboots the machine, produces a blue screen and there
after the user logs in and is fine?

This issue does not happen consistently but happens often. We are a
networked environment with approximately over 2000 machines. It has happened
in several offices already. Here is the exact error below:


Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 12/03/2008
Time: 9:03:46
User: N/A
Computer: MachineName
Description:
Application popup: winlogon.exe - Application Error : The instruction at
"0x74ef40c3" referenced memory at "0x00000000". The memory could not be
"written".

Click on OK to terminate the program
Click on CANCEL to debug the program


Thank you.

"PBrooke" wrote:

> Hi,
>
> Has anyone experienced an issue with the Winlogon.exe producing an event ID
> 26 which then in turn reboots the machine, produces a blue screen and there
> after the user logs in and is fine?
>
> This issue does not happen consistently but happens often. We are a
> networked environment with approximately over 2000 machines. It has happened
> in several offices already. Here is the exact error below:
>
>
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 12/03/2008
> Time: 9:03:46
> User: N/A
> Computer: MachineName
> Description:
> Application popup: winlogon.exe - Application Error : The instruction at
> "0x74ef40c3" referenced memory at "0x00000000". The memory could not be
> "written".
>
> Click on OK to terminate the program
> Click on CANCEL to debug the program
>
>
> Thank you.

Hi,
First I will make sure the server is clean from malware and Viruses by
running a thorough full scan?.

Then Make all user run a full scan on their machines and configure the scan
to turn OFF the machine after finishing (can make this after working hours)
and see the log in the morning then report back if the scan found some
threats (in private).

Then try to check the Minidump file which will make life easy as the
winlogon.exe can be hooked by many type of applications which can be run as
Admin with full privileges like for example Anti-virus or other third-party
software that used in the business like VPN...etc.
BTW Do you have any third-party logon clients installed on that server?.

You can find the minidump file here:
C:\WINDOWS\Minidump
Or here:
C:\Documents and Settings\All Users\Documents\DrWatson\user.dmp
The dump definitely will show the causer of the error.
NOTE: if you will foloow the advise for the staff to run a full scan and
check the option on the Av Config they will need to uncheck next Day to not
lose their data next time the AV runs!.
HTH.
nass
---
http://www.nasstec.co.uk

Hi,

Thank you for your suggestion. We have run a full scan of the workstations
that experienced this issue and they came back clean. We used Symantec for
the virus scans. We have configured some of the machines to produce the mini
dumps but this issue does not happen every day. As a matter of fact, we had
one user who had the error three days in a row and was fine for the next week
and a half and now it happened again today. It's very weird.

"nass" wrote:

>
>
> "PBrooke" wrote:
>
> > Hi,
> >
> > Has anyone experienced an issue with the Winlogon.exe producing an event ID
> > 26 which then in turn reboots the machine, produces a blue screen and there
> > after the user logs in and is fine?
> >
> > This issue does not happen consistently but happens often. We are a
> > networked environment with approximately over 2000 machines. It has happened
> > in several offices already. Here is the exact error below:
> >
> >
> > Event Type: Information
> > Event Source: Application Popup
> > Event Category: None
> > Event ID: 26
> > Date: 12/03/2008
> > Time: 9:03:46
> > User: N/A
> > Computer: MachineName
> > Description:
> > Application popup: winlogon.exe - Application Error : The instruction at
> > "0x74ef40c3" referenced memory at "0x00000000". The memory could not be
> > "written".
> >
> > Click on OK to terminate the program
> > Click on CANCEL to debug the program
> >
> >
> > Thank you.
>
> Hi,
> First I will make sure the server is clean from malware and Viruses by
> running a thorough full scan?.
>
> Then Make all user run a full scan on their machines and configure the scan
> to turn OFF the machine after finishing (can make this after working hours)
> and see the log in the morning then report back if the scan found some
> threats (in private).
>
> Then try to check the Minidump file which will make life easy as the
> winlogon.exe can be hooked by many type of applications which can be run as
> Admin with full privileges like for example Anti-virus or other third-party
> software that used in the business like VPN...etc.
> BTW Do you have any third-party logon clients installed on that server?.
>
> You can find the minidump file here:
> C:\WINDOWS\Minidump
> Or here:
> C:\Documents and Settings\All Users\Documents\DrWatson\user.dmp
> The dump definitely will show the causer of the error.
> NOTE: if you will foloow the advise for the staff to run a full scan and
> check the option on the Av Config they will need to uncheck next Day to not
> lose their data next time the AV runs!.
> HTH.
> nass
> ---
> http://www.nasstec.co.uk
>

Hello I have a networking that has a handful of pcs experiencing this error
as well exactly as you described. They shut pcs off over night, log in in
the morning and get the error, it blue screens, they restart and relog in and
everything is fine all day. One pc is doing it nearly daily. I've chkdsk
repair installed, cleaned up etc. Any suggestions?

"PBrooke" wrote:

> Hi,
>
> Thank you for your suggestion. We have run a full scan of the workstations
> that experienced this issue and they came back clean. We used Symantec for
> the virus scans. We have configured some of the machines to produce the mini
> dumps but this issue does not happen every day. As a matter of fact, we had
> one user who had the error three days in a row and was fine for the next week
> and a half and now it happened again today. It's very weird.
>
> "nass" wrote:
>
> >
> >
> > "PBrooke" wrote:
> >
> > > Hi,
> > >
> > > Has anyone experienced an issue with the Winlogon.exe producing an event ID
> > > 26 which then in turn reboots the machine, produces a blue screen and there
> > > after the user logs in and is fine?
> > >
> > > This issue does not happen consistently but happens often. We are a
> > > networked environment with approximately over 2000 machines. It has happened
> > > in several offices already. Here is the exact error below:
> > >
> > >
> > > Event Type: Information
> > > Event Source: Application Popup
> > > Event Category: None
> > > Event ID: 26
> > > Date: 12/03/2008
> > > Time: 9:03:46
> > > User: N/A
> > > Computer: MachineName
> > > Description:
> > > Application popup: winlogon.exe - Application Error : The instruction at
> > > "0x74ef40c3" referenced memory at "0x00000000". The memory could not be
> > > "written".
> > >
> > > Click on OK to terminate the program
> > > Click on CANCEL to debug the program
> > >
> > >
> > > Thank you.
> >
> > Hi,
> > First I will make sure the server is clean from malware and Viruses by
> > running a thorough full scan?.
> >
> > Then Make all user run a full scan on their machines and configure the scan
> > to turn OFF the machine after finishing (can make this after working hours)
> > and see the log in the morning then report back if the scan found some
> > threats (in private).
> >
> > Then try to check the Minidump file which will make life easy as the
> > winlogon.exe can be hooked by many type of applications which can be run as
> > Admin with full privileges like for example Anti-virus or other third-party
> > software that used in the business like VPN...etc.
> > BTW Do you have any third-party logon clients installed on that server?.
> >
> > You can find the minidump file here:
> > C:\WINDOWS\Minidump
> > Or here:
> > C:\Documents and Settings\All Users\Documents\DrWatson\user.dmp
> > The dump definitely will show the causer of the error.
> > NOTE: if you will foloow the advise for the staff to run a full scan and
> > check the option on the Av Config they will need to uncheck next Day to not
> > lose their data next time the AV runs!.
> > HTH.
> > nass
> > ---
> > http://www.nasstec.co.uk
> >

Hello all

I have the exact same problem in multiple networks I manage and it's been
something I have never found a solution to. However I would be interested to
know the exact version of Symantec A/V people are running as I have recently
upgraded one site from 10.1.03 to 10.1.7 and it doesn't seem to be happening
as much or at all (Its only been 1 week so far). In my case it happens after
holiday breaks as i look after multiple colleges and happens as mentioned
above at 1st startup and then not again which I think is possibly related to
the automatic internal liveupdate for virus defintions. Any thoughts ?

"KStechman" wrote:

> Hello I have a networking that has a handful of pcs experiencing this error
> as well exactly as you described. They shut pcs off over night, log in in
> the morning and get the error, it blue screens, they restart and relog in and
> everything is fine all day. One pc is doing it nearly daily. I've chkdsk
> repair installed, cleaned up etc. Any suggestions?
>
> "PBrooke" wrote:
>
> > Hi,
> >
> > Thank you for your suggestion. We have run a full scan of the workstations
> > that experienced this issue and they came back clean. We used Symantec for
> > the virus scans. We have configured some of the machines to produce the mini
> > dumps but this issue does not happen every day. As a matter of fact, we had
> > one user who had the error three days in a row and was fine for the next week
> > and a half and now it happened again today. It's very weird.
> >
> > "nass" wrote:
> >
> > >
> > >
> > > "PBrooke" wrote:
> > >
> > > > Hi,
> > > >
> > > > Has anyone experienced an issue with the Winlogon.exe producing an event ID
> > > > 26 which then in turn reboots the machine, produces a blue screen and there
> > > > after the user logs in and is fine?
> > > >
> > > > This issue does not happen consistently but happens often. We are a
> > > > networked environment with approximately over 2000 machines. It has happened
> > > > in several offices already. Here is the exact error below:
> > > >
> > > >
> > > > Event Type: Information
> > > > Event Source: Application Popup
> > > > Event Category: None
> > > > Event ID: 26
> > > > Date: 12/03/2008
> > > > Time: 9:03:46
> > > > User: N/A
> > > > Computer: MachineName
> > > > Description:
> > > > Application popup: winlogon.exe - Application Error : The instruction at
> > > > "0x74ef40c3" referenced memory at "0x00000000". The memory could not be
> > > > "written".
> > > >
> > > > Click on OK to terminate the program
> > > > Click on CANCEL to debug the program
> > > >
> > > >
> > > > Thank you.
> > >
> > > Hi,
> > > First I will make sure the server is clean from malware and Viruses by
> > > running a thorough full scan?.
> > >
> > > Then Make all user run a full scan on their machines and configure the scan
> > > to turn OFF the machine after finishing (can make this after working hours)
> > > and see the log in the morning then report back if the scan found some
> > > threats (in private).
> > >
> > > Then try to check the Minidump file which will make life easy as the
> > > winlogon.exe can be hooked by many type of applications which can be run as
> > > Admin with full privileges like for example Anti-virus or other third-party
> > > software that used in the business like VPN...etc.
> > > BTW Do you have any third-party logon clients installed on that server?.
> > >
> > > You can find the minidump file here:
> > > C:\WINDOWS\Minidump
> > > Or here:
> > > C:\Documents and Settings\All Users\Documents\DrWatson\user.dmp
> > > The dump definitely will show the causer of the error.
> > > NOTE: if you will foloow the advise for the staff to run a full scan and
> > > check the option on the Av Config they will need to uncheck next Day to not
> > > lose their data next time the AV runs!.
> > > HTH.
> > > nass
> > > ---
> > > http://www.nasstec.co.uk
> > >