Application Error Winlogon.exe

[zainulpatel]

Dear Friends;

While Shutting Down or Restarting Windows 2003 Server I get a Error Message like this:

Application popup: winlogon.exe - Application Error : The instruction at "0x3bf22d74" referenced memory at "0x000018a1". The memory could not be "read". and immediately blue screen appears

First i thought that it might be a virus/Antivirus problem also

I checked for memory

I am using Microworld escan corporate edition.

Can Anyone please help me out before the server Crashes!!!!!!!

[allen2]

Check if there is enought space on the system hard drive. And and give us more informations:

- did you checked the eventlogs ?

- does the system boot in safe mode ?

- did you do something just before the server began to do this ?

[cluberti]

Since winlogon is a critical system application, it crashing for ANY reason will cause a STOP 0x21a bugcheck (as will a crash of csrss.exe or lsass.exe). Do you have any third-party logon clients installed on that server (Citrix, Novell), or perhaps software like PCAnywhere that would hook into winlogon.exe? If all else fails, configure it for a complete dump, and hope the system generates a memory.dmp file the next time it crashes - analysis of the .dmp file will tell us exactly what was loaded at the memory addresses given in the error, and point to the culprit.

Edited October 14, 2006 by cluberti

[LLXX]

The first thing you should do is restore an uncorrupted version from the install CD using extract command.

[cluberti]

That's assuming winlogon is corrupt, and some 3rd party hook isn't causing the crash. Replacing winlogon.exe from the CD might help, but it would be safer to do an sfc /scannow from within the OS if possible, as replacing winlogon.exe from an older version will definitely have dire consequences (you'll get mismatched .exe/.dll versions), and cause even more system instability. Unless he has the exact version of winlogon on the CD as is on the disk, that is not advisable.

[zainulpatel]

Thanks all Guys!!!

As all of you Know that a Server isnt mean to Shut Down, But keep Running. Before Giving Such type of error I had Installed Escan Antivirus Workstation Server Suite

I am Using Intel P4 Machine 915 Gig. Motherboard, 1 GB Ram, all Clients are Windows XP with Escan Client Installed.

Also While Running Escan Antivirus Full System Scan It Would Give me Error Like This and the Scan Terminated

Application popup: mwavscan.com - Application Error : The instruction at "0x00465964" referenced memory at "0x38643869". The memory could not be "read".

Click on OK to terminate the program

Click on CANCEL to debug the program

Can This be the problem with Antivirus????