Mobsync.exe and winlogon.exe taking a lot of memory in task manager

[Siketan]

Hi friends, I am facing a lot of problem in my laptop and I don’t know if the problem is related to each other. My operating system is XP pro, I scanned my laptop and I didn’t find any of the virus and spy ware in it. About a week, I was finding bit difficulties to shut down my computer. Whenever I use to shut down the computer a pop up should come, because of which I had to terminate that by clicking end now. When I investigated in the task manager, I found out that the processes mobsync.exe and winlogon.exe are taking a lot of memory in it. When I tried to end the process it would come again. I tried to delete mobsync.exe from msconfig and it is gone, but winlogon.exe is present. How to remove the winlogon.exe and why it is taking so much of memory.

[Wguy2008]

Hi there, I went to your problem I just wanted to know the exact position of the winlogon.exe, is it in MS config. If yes then it is perfectly fine but if it is somewhere else then it is a malware which your scanner didn’t detect it. Most probably it may be NEVEG.A worm. You can find out the presence of it in the registry. Go in the registry and find out whether the following registry is present or not. To go in the registry click on start, then run and in that type regedit and click ok. Now navigate to the key like “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run”. Once you get the key just check the value in the right hand side panel. Below I have given some values that you have to check in that right and panel, if it is present then you have to delete the values from the registry, after doing that get out of the register. The values are as follows.

".Prog" = "%Windir%\system\winlogon.exe"
"BuildLab" = "%Windir%\system\winlogon.exe"
"ccApps" = "%Windir%\system\winlogon.exe"
"FriendlyTypeName" = "%Windir%\system\winlogon.exe"
"Microsoft Visual SourceSafe"= "%Windir%\system\winlogon.exe"
"RegDone" = "%Windir%\system\winlogon.exe"
"TEXTCONV" = "%Windir%\system\winlogon.exe"
"WMAudio" = "%Windir%\system\winlogon.exe"

[Pabloa]

I too faced a similar problem in my computer. I have installed ASP>NET framework in it and from then it is showing two winlogon. Exe file in it. One of it is using around 2 Megs and other is using around 255 Megs. Everything is fine for the 255 Megs but when I noticed my friend pc it was not showing the 2 Megs one. When I asked my professor in the college he said that having one winlog.exe is perfectly fine but if there is more than one then it may be the issue of Terminal services. He told me that you are using terminal services which lead to the creation of this.

[addie]

In my case I am using a Dell Power Edge Windows 2003 SP1 machine. In this when I installed ASP.NET web services a process known as winlogon.exe is present and it take around 200 plus memory in the task manager. First I thought it was an virus which was introduced in my computer because of installation of the ASP.NET, because of this I re installed the product after uninstalling it. Also tried to search for the virus by various antivirus products but it was not present. So because of which I had to uninstall the ASP.NET web services and did not tried to placed in the computer again, but I want it because it is very important for my project work.

[Lemog]

hi there I did whatever you had told me to do in the above section I went through all the registry key value and found out all the value whatever you have specified in it, but I did not get any of them, it was a relief for me to know that it was not the worm in the system. I had given this issue to my friend and the tech support of windows to help me in coming out of this problem, they identified and claimed it as memory leak problem in the system and they provided me with a latest service pack to be installed in my system to overcome the issue. Thank you once again for showing such interest and giving time for my problem.