WINLOGON.exe runs a long time at startup

Guest · Guest

Win2k SP4. Brand new install. 300Mhz, 96Mb; Also installed:
Windows2000-KB823980-x86-ENU.exe

When the system boots up, it seems that WINLOGON.EXE actively runs longer than it should.

Any thoughts?

Logfile of HijackThis v1.97.7
Scan saved at 11:05:05 AM, on 1/29/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\drivers\dcfssvc.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\KODAK\KODAK EASYSHARE Software\bin\ptssvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\WINNT\system32\MsgSys.EXE
C:\Apps\Apps_4\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/My%20Documents/web/index.htm
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

Guest · Guest

If I turn off Norton AV (7.60.926) realtime checking, the system boots as expected.

I read somewhere that this problem could occur b/c WINLOGON is trying to copy files over from DLLCACHE while NAV is trying to check them ... or something like that. NAV site doesn't tell me anything.

Thanks,
scott

helpless · Posted: Fri Jan 30, 2004 5:50 am Post subject:

FYI :

The Windows subsystem automatically starts Winlogon.exe, and Winlogon.exe starts the Local Security Administration (Lsass.exe). You now see the Begin Logon dialog box, which contains the text Press Ctrl+Alt+Delete to log on. At this time, Windows might still be initializing network device drivers, but you can logon now.
Next the Service Controller (Screg.exe) executes, which makes a final pass through the Registry looking for services that are marked to load automatically.
The services that are loaded during this phase are loaded based on their dependencies, because they are loaded in parallel. The dependencies are described in the DependOnGroup and DependOnService entries in Registry

Note: Windows startup is not considered good until a user successfully logs on to the system. After a successful logon, the Clone control set is copied to the LastKnownGood control set. and this is what NAV is chekking/scanning[/b]

saucydad · 1st Responder Joined: Jan 13, 2004 Posts: 67 Location: USA

Hi,
I saw this in some other forums and think there is some confusion about (Lass.exe and Iass.exe). Dont know much about it myself
saucydad

http://www.sophos.com/virusinfo/analyses/trojglitcha.html

Troj/Glitch-A
Type
Trojan

Detection
Detected by Sophos Anti-Virus since March 2002.

Description
Troj/Glitch-A is a backdoor Trojan that targets IRC and Instant Messaging clients. The Trojan may be disguised as a program, e.g. an update patch. This program when executed extracts a number of files that are actually the Trojan to the folder C:\Windows\Java\Trustlib\com. These files include a hidden mIRC chat client, a shutdown application and executables and text files. Troj/Glitch-A changes the registry, adding the keyHKLM\Software\Microsoft\Windows\CurrentVersion\Run "LASS"="C:\\WINDOWS\\JAVA\\TRUSTLIB\\COM\\LASS.exe"to run it on startup. It also adds other keys associated with the hidden mIRC client. These keys to enable it to run in the background. Troj/Glitch-A also establishes TCP port connections and waits to be contacted by the attacker.

http://translate.google.com/translate?h...oe%3DUTF-8

But do not confound please with:

lsass - lsass.exe - Process information

Process file: lsass or lsass.exe
Process name: Local Security Authority service
Description: The Windows local Security Authority server Process Handles Windows Security Mechanisms
Common error: N/A
System Process: Yes

Guest · Guest

Thanks for the replies.

I have other Win2K PCs with NAV that I do not see this extended scanning behavior from NAV.

I wonder why this PC shows this behavior.

Is there a way to tell NAV to not scan?
Is the copying of the "clone" set to "lastknow" a set of files or registry entries?

Thanks,
Scott


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 1095 pages served in previous 5 minutes. Page Rendered: 0.468 seconds.