Winlogon.exe is the process that manages your logon and logout. Maybe the AV must be blocking it because it thinks it's register as a spyware or virus. There's a way to replace the winlogon.exe if it's bad from the cab file on the CD. I forgot how to do it right now.
You can boot into the recovery console, then do a cd\ to get to the root. then do dir *winlogon*.* /s for search for the file and determine where it's at.
Let me know what service pack you have on the computer, is it SP1 or SP2. Hopefully I can remember how to replace that file.