mEtRiX, our forum moderator had an annoying computer problem for weeks which is it takes longer than usual to log on to Windows. He has already scanned his computer with Kaspersky Internet Security 2009 and Spybot but it did not fix the problem. He was only able to tell me that this slow logon issue is caused by executing wlnotify.dll file on startup. Searching in Google about wlnotify.dll reveals that it is a process info for Common DLL to receive Winlogon notifications.
To know which file is causing the slow logon problem, you’ll have to enable verbose status message, a hidden feature in Microsoft Windows. Although we already know which file is the cause of the problem, we’ve had a pretty tough time trying to fix it as it wasn’t that easy. We couldn’t even find any solution to this problem in Google and other tech forums. So it’s up to us and yes, we finally found the reason why the “Windows is starting” screen get stuck because of wlnotify.dll file.
I’ll write the troubleshooting steps so you’d know what to do when you have a similar problem. Sometimes when we need to troubleshoot a problem, we’ll have to go through step by step to narrow down the problem.
1. Virus, trojans and spywares.
– I know mEtRiX is very careful not to simply run any untrusted program, so it shouldn’t be a virus or spyware that is causing this. Moreover, he has already ran a full scan with KIS 2009 and Spybot.
2. Windows Safe Mode
– Booting into safe mode is very important because it shows that whether this problem is caused by some software or drivers. Unfortunately the problem still exist when he tried booting into Safe Mode.
3. wlnotify.dll file
– Another possible cause for this problem is a corrupted wlnotify.dll file. We’ve both checked the size of the DLL file and it matches at 92,672 bytes.
4. Deleting wlnotify.dll
– Tried renaming the file and Windows automatically replace a new wlnotify.dll file in C:\Windows\System32\ folder.
5. Disabling Network Adapters
– Safe Mode loads up networking support. Since wlnotify.dll file is for winlogon notifications, so I thought maybe Windows calls home whenever it is trying to log in. Both wireless and wired adapters are disabled in Device Manager, boot to Safe Mode again, still the same problem.
6. TuneUp Utilities
– mEtRiX mentioned that he has TuneUp Utilities and he guessed that it might be the settings there that is causing the problem. So I installed TuneUp Utilities on my test system and configured everything the same as he has configured on his computer. Restarted and my test system was able to boot up without issues.
When I nearly ran out of idea on what else to check, I figure that I should also try to look for any errors in Events Viewer. Went to Control Panel > Administrative Tools > Event Viewer. Clicking on Application, Security, System or Internet Explorer shows “Unable to complete the operation on “System”. The interface is unknown.”. Turns out that mEtRiX had Event Viewer disabled from services. I asked him to enable back Event Viewer from services and then restart. Amazingly the slow logon problem which is caused by wlnotify.dll is gone! I tried replicating the problem on my desktop by disabling Event Viewer on my test system and indeed the log on time did take slightly longer than usual. Re-enabling Event Viewer solved the problem.
If you’ve enable verbose status message and found that wlnotify.dll takes very long to execute, you should check your Event Viewer service and make sure that it is started. To check, go to Start > Run, type services.msc and click OK. Look for Event Log at the name column and double click. Make sure that the Startup type is set as Automatic and Service status is Started.
