winlogon.exe high page faults and VM usage



I_Like_XP
07-10-2005, 12:35 AM
I'm having a problem with a few of my XP machines. Winlogon.exe is causing
page faults and eating up alot of memory. This builds-up over a period of
time. I scanned the PC for viruses/spyware to no avail.

One of the PCs is currently reporting WINLOGON.EXE using 1,089,812 K of VM
and has 60,061,307 page faults. !! Ofcourse a reboot always fixes the
problem, but only temporarly.

The PC is Delll GX270 1G of memory, XP Pro w/ SP1

Any ideas ?

molecular
07-10-2005, 12:35 AM
"I_Like_XP" schreef:

> I'm having a problem with a few of my XP machines. Winlogon.exe is causing
> page faults and eating up alot of memory. This builds-up over a period of
> time. I scanned the PC for viruses/spyware to no avail.
>
> One of the PCs is currently reporting WINLOGON.EXE using 1,089,812 K of VM
> and has 60,061,307 page faults. !! Ofcourse a reboot always fixes the
> problem, but only temporarly.
>
> The PC is Delll GX270 1G of memory, XP Pro w/ SP1
>
> Any ideas ?

Try turning off your virusscanner.....
If the problem is gone now, you need to update your virusscanner...
McAfee had a issue a while ago.....

succes

Benno

I_Like_XP
07-10-2005, 12:35 AM
"molecular" wrote:

>Try turning off your virusscanner.....
> If the problem is gone now, you need to update your virusscanner...
> McAfee had a issue a while ago.....
>
> succes
>
> Benno

Thanks Benno,

I don't have any virus scanner on the machines. I only installed it once to
scan it and then removed it.

Yves Leclerc
07-10-2005, 12:35 AM
You are playing with "fire" if you do not:

1) Have any anti-virus on your PC.
2) Have no "firewall" for you PC.
3) Run spyware removals periodically (usually weekly).

Viruses, trojans and spywares can, and will, change the standard Windows
files. Then, it will take away resources when you least expect.

"I_Like_XP" <ILikeXP@discussions.microsoft.com> wrote in message
news:DB47DFF2-F8AD-4059-AF89-A951ADF9AB3B@microsoft.com...
> "molecular" wrote:
>
>>Try turning off your virusscanner.....
>> If the problem is gone now, you need to update your virusscanner...
>> McAfee had a issue a while ago.....
>>
>> succes
>>
>> Benno
>
> Thanks Benno,
>
> I don't have any virus scanner on the machines. I only installed it once
> to
> scan it and then removed it.

I_Like_XP
07-10-2005, 12:36 AM
They were removed to eliminate them from being the root cause of the problem.
My PCs only run a specific application on a private Network. IE is not used
and no user ever loggs-on unless its for trouble shooting.

"Yves Leclerc" wrote:

> You are playing with "fire" if you do not:
>
> 1) Have any anti-virus on your PC.
> 2) Have no "firewall" for you PC.
> 3) Run spyware removals periodically (usually weekly).
>
> Viruses, trojans and spywares can, and will, change the standard Windows
> files. Then, it will take away resources when you least expect.

Norrec
07-10-2005, 01:04 AM
I am having a very similar problem and so far this is the only post I've
found remotely close to what I'm experiencing. Hopefully our combined data
will provide some answers.

I have two production servers, both in the Windows 2003 Server family that
are experiencing this problem. I also have two more servers in a test
environment setup almost identical to the production servers so I can test
changes and updates. The two test servers are not experiencing this problem.

I've found that winlogon.exe is using a large amount of memory on both
servers. After watching the process for some time, it appears to gain 8K in
memory usage per minute. I restarted the servers almost 20 days ago and the
memory usage went back down to 20MB or so. Now it is up to 245MB.

Since the problem is not occuring on my test servers (keep in mind they're
not under any significant load like the production servers), I wanted to see
if the Veritas client could be the culprit. I wouldn't expect it to use any
memory while not backing up anything, but I disabled the service for several
hours anyways and winlogon.exe continued to eat up memory.

There are no page faults or errors in the event logs for either server, and
the memory usage is pretty much the same on both servers. They even increase
at the same pace of 8K/m.




I've added a description of the production servers below. The test servers
have some different hardware, but the software is the same, minus the Veritas
client.


Database Server
=============================================================================

Hardware:
---------
Intel Xeon 3.60GHz CPU - CPU Usage averages between 0%-5% during peak hours.
4.00 GB RAM - 3.25 detected without using /PAE or /3GB in boot.ini

Software:
---------
Microsoft Windows Server 2003 Standard Edition SP1
Microsoft SQL Server 2000 Standard Edition SP3
Symantec Antivirus Corporate Edition Version 10.0
Veritas NetBackup Client 4.5FP_6



Web Server
=============================================================================

Hardware:
---------
Intel Xeon 3.60GHz CPU - CPU Usage averages between 5%-10% during peak hours.
2.00 GB RAM

Software:
---------
Microsoft Windows Server 2003 Web Edition SP1
Microsoft IIS 6.0
Mail Enable Professional Edition Version 1.54
Symantec Antivirus Corporate Edition Version 10.0
Veritas NetBackup Client 4.5FP_6




"I_Like_XP" wrote:

> I'm having a problem with a few of my XP machines. Winlogon.exe is causing
> page faults and eating up alot of memory. This builds-up over a period of
> time. I scanned the PC for viruses/spyware to no avail.
>
> One of the PCs is currently reporting WINLOGON.EXE using 1,089,812 K of VM
> and has 60,061,307 page faults. !! Ofcourse a reboot always fixes the
> problem, but only temporarly.
>
> The PC is Delll GX270 1G of memory, XP Pro w/ SP1
>
> Any ideas ?


winlogon.exe high page faults and VM usage