Current Microsoft® Windows NT® architecture stipulates that any extensible performance counters added by a service will run in the process context of the Windows NT Winlogon process. Because Winlogon is a vital component of the operating system, a bug or resource leak in any performance counter DLL may disrupt Winlogon, and hence the operating system. The Microsoft SQL Server™ extensible performance counter DLL is called Sqlctr70.dll, and it exports several SQL Server-specific objects from SQL Server to the operating system. You can use Windows NT Performance Monitor to monitor these objects.
Although it is very rare for Sqlctr70.dll to cause a Winlogon problem, you can expedite problem identification when pursuing a Windows NT failure or blue screen problem on a computer running SQL Server by renaming this DLL. This eliminates the use of SQL Server performance counters; however, you can still use Windows NT Performance Monitor to monitor SQL Server by using regular Windows NT performance counters (such as threads, process, memory, and so on).
If renaming Sqlctr70.dll fixes the problem, and if this is confirmed by reinstating and removing the DLL several times, the problem should be pursued as a SQL Server issue. Otherwise, it should be pursued as a system layer issue.