Winlogon.exe???

I have a client with Win XP Pro on a p2p network. They went to lunch and when they came back, they could no longer get on the internet, "page cannot be displayed." I found by pinging I still got replies from google.com. Checking in Task Manager process, I found (2) winlogon.exe running. I logged the person off and then back on. This got rid of the extra winlogon.exe and was able to get web pages to display, however this lasted on 3-5 minutes, then back to (2) winlogon.exe.

Started the system up in safe mode w/networking and did not have a problem. Ran spyware removers and housecall, the system came back clean. I am at a loss. Any suggestions????

Are they both SYSTEM services? or is one of them a user service?

Unclean! Unclean! Here's a list of some of the malware that inserts a bogus winlogon.exe process into a system: http://www.hardavenue.com/startup/winlogon.exe.php

You don't mention what you used for the scans, but right now my top 5 products are Ewido, Ad Aware, Spybot, Windows Defender, & Spycatcher. The current demo version of Spysweeper doesn't actually do anything. It reports infections but won't remove anything until you buy it. How bogus! I also haven't found it to outperform the current version of Ewido, so if I were buying one...

When scanning for malware, you should first disable system restore, run disk cleanup to remove browser cache files, temp files, etc. then shut the computer down for 30 seconds minimum, boot into Safe Mode and run your scans.

I've found this tool can help locate many of those sorts of problems:

http://www.sysinternals.com/utilities/autoruns.html

Thanks for the suggestions everyone. Turned out even though the system is not on a domain, it does log into the server to access other programs shared by all. It seems the server became trapped and needed rebooted. Once this was done the problem went away. The Winlogon.exe was both "system" processes. All I can guess is the workstation somehow was being caused to login twice.