Windows cannot find "logon.exe"

[artsami2]

Last night my computer got infected by some Trojan virus after listening on a
song. I closed all applications and ran my spyware and anti virus programs
right away. I removed all the infected files to the vault. Now every time I
restart I receive this message " Windows cannot find "logon.exe". Make sure
you typed the name correctly and try again...". I may have moved the
infected file to the vault. How can I fix this? I didn't get the Windows XP
CD when I bought this computer from surplus. Thank you.

 

[Tim Meddick]

The file 'logon.exe' was probably the name of the quarantined virus, but it is still
being called to run by some entry in the registry but is no longer present in it's
original location - so you get an error message.

"Start Menu" > "Run" > msconfig.exe

...and go to the "Startup" tab.

"Logon.exe" should be listed there - simply "uncheck" it and the error message should
stop assaulting you.

==

Cheers, Tim Meddick, Peckham, London.

 

[Tim Meddick]

P.S. "Logon.exe" is not a valid Windows XP Operating System file.

==

Cheers, Tim Meddick, Peckham, London.

 

[LVTravel]

The file 'logon.exe' was probably the name of the quarantined virus, but
it is still being called to run by some entry in the registry but is no
longer present in it's original location - so you get an error message.

"Start Menu" > "Run" > msconfig.exe

..and go to the "Startup" tab.

"Logon.exe" should be listed there - simply "uncheck" it and the error
message should stop assaulting you.

==

Cheers, Tim Meddick, Peckham, London.

MSCONFIG should only be used to diagnose program issues. It should never be
used to totally and permanently stop a program from running at startup. The
proper way to stop a startup program is to find it's location using the
msconfig program to locate the place the errant program is starting from.
See my post to the OP.

 

[Tim Meddick]

Why not?

==

Cheers, Tim Meddick, Peckham, London.

 

[LVTravel]

Last night my computer got infected by some Trojan virus after listening
on a
song. I closed all applications and ran my spyware and anti virus
programs
right away. I removed all the infected files to the vault. Now every
time I
restart I receive this message " Windows cannot find "logon.exe". Make
sure
you typed the name correctly and try again...". I may have moved the
infected file to the vault. How can I fix this? I didn't get the Windows
XP
CD when I bought this computer from surplus. Thank you.

If this program needs to be removed from startup see the below information:

Program initiation on startup is controlled by various locations in Windows.

Using an administrator account start Windows Explorer then go to
1. Documents and Settings\All Users\Start Menu\Programs\Startup to find the
program that is starting. If located delete the program's shortcut.

2. Perform the same for all available ... Settings\username\ .

If you still haven't found the program click Start, Run, type Regedit and
hit enter. Navigate to
HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/Current version/Run and see if
the program is there.

Some programs are also started in HKEY_CURRENT_USER/..... as continued as
above.

Still can't find it click the top of the listing (Computer) in Registry
Editor started above. Click Edit, Find and type logon.exe, click Match
whole string only and then click find. It should find any instances of any
key with it's full phrase. Ensure that only the full phrase shows and it is
not part of a phrase (I.e., winlogon.exe.) If full name you can delete the
entire key.

If you just want to disable it for one time (and also an easier way of
finding where the program is starting from) you can click Start, Run, type
in MSCONFIG and hit enter. Click the startup tab, find the program and undo
it's check box. This should be used for a one time boot only and not a fix
for the startup program.

To find out where it is started from, find the program and then drag the
sizing line at the top right edge for the location heading to the right.
You can repeatedly drag the sizing line if more space is needed and then a
scroll bar at the bottom will appear.

Hope this helps, let us know.

 

[LVTravel]

Why not?

==

Cheers, Tim Meddick, Peckham, London.

Because you are leaving potentially unwanted items in the start menu. Then
if you forget that you defeated the warning window that pops up every time
you uncheck an item in the msconfig that can cause a later issue. It is
always better to permanently get rid of a problem than using a workaround.
I just finished posting to the OP so please look at that.

This KB article http://support.microsoft.com/kb/310560 states that "It does
not manage the programs that run when Windows starts." It goes on to give
information on how to remove startup programs.

 

[Tim Meddick]

Nothing you have said makes be think that there is anything wrong with using
msconfig.exe [only] to remove a startup item.

Regarding your statement : "Because you are leaving potentially unwanted items in the
start menu"

They are *not* left in the start menu at all, but are deleted from it and a reference
is placed under the "msconfig" key should the user want to re-activate the entry at a
later date (undo changes).

This is very useful if you happened to remove the WRONG entry, as a method of undoing
any changes is instantly at hand ("re-checking" the item in msconfig).

Finally, I would never advise anyone to go in and edit the registry directly without
a most basic of warnings

e.g.: -

*Note - Please exercise care when editing the registry, always create a backup and /
or create a 'System Restore' point first.

As editing the registry, if you have had no experience (even with very clear
instructions, which IMO yours are not) is potentially dangerous if you don't know
what your doing.

I would still *always* advise a poster to use "msconfig.exe" to remove an unwanted
startup entry.

For more advanced users - I would refer them to editing the reg-run key
directly...

==

Cheers, Tim Meddick, Peckham, London.

 

[Kelly]

Very well said!

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

 

[Kelly]

Clean your system. Some of the best are listed here:
http://www.kellys-korner-xp.com/xp_s.htm#spy

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

 

[pdjpirate]

The logon.exe file is part of my MSI SecureDoc encryption program that came
with my original MSI motherboard, which is long gone, but I still have the
software. I usually kill it unless I need something from archieves. So I keep
it on my boot list and kill it from the tray after booting up. Seems harmless
to me and obeys my command!

All the best,

Just another Pirate!

 

[Zach0116]

yea the same think happend to me while listening to a song on myspace....
i got a bunch of virusis deleted them, and now i get the same message on
start up, how do i fix it, i tryed the ways listed above but none of them
have worked, and my virus scaner keeps picking up virus every time i run it,
anyone have any idea how to fix this with out formating ?

 

[Tim Meddick]

If the file is part of software that is outdated and no longer installed - why would
you choose to keep this file on your system?

It is only making the boot process a little longer and may interact badly with some
other applications in the future.

Just delete it from the system and remove the reference to it that calls for it at
boot from the registry.

(Probably located in either the
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
....or the :
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
....keys)

XP is by no means "infallible" and can sometime "lock-up".

These "freezes" are caused by code that has left residual data in RAM and the more
errant data is around, the more likely is that this will happen. All non-essential
programs should not be allowed to run on startup as services or background
applications...

==

Cheers, Tim Meddick, Peckham, London.

 

[R Wink]

I found an entry in the registry that stops this dialog box on boot. Use
"regedit" and navaigate through the registry, going to
"HKLM>Software>Microsoft>Windows NT>Winlogon" and double clicking on the
"shell" entry. In the dialog box, remove the entry after "explorer.exe"
(which is "Logon.exe"). Close the box and close the editor. Reboot and you
shouldn't have the "Windows cannot find..." dialog box.

 

[pdjpirate]

Tim: "...why would you choose to keep this file on your system?"
....Well, let's flash back to my original post...
Me: "I usually kill it [from the boot up, so it does not run unless I tell
it to] unless I need something from archieves!"

It gives me no problem, cause it sits, fitches and stays when told to and it
gives me no problem and serves its master well.

PIRATE

 

[Jose]

if you can research and follow directions, then you can edit your
registry.  honestly, you should get in the habit of re-installing
windows and all of your programs once or twice a year.  face it, windows
sucks.  

the message you are getting about missing logon.exe...  somehow at some
point in time, your pc got infected.  a file named logon.exe was created
and hidden in your filesystem.  at the same time, one of your registry
entries was modified, to make your shell call on this new file named
"logon.exe", along with the required "explorer.exe".  once your
antivirus got the definitions for this particular infection, it found
the "logon.exe" file and deleted it or put it in the vault.  

your antivirus will not edit your registry... so now that the file is
gone, every time you start your computer, when the shell starts, it
still looks for that file.  

start -> run -> regedit.

search for logon.exe

there will be an entry named "Shell".  double click to open it.  the
data for this will contain "Explorer.exe Logon.exe".  simply remove the
word "logon.exe", close, and you're done.

** DO NOT DELETE "Explorer.exe"  IT IS THE HEART OF WINDOWS AND IS
REQUIRED FOR IT TO OPERATE **  (if you don't believe me, then just open
task manager and kill the process "explorer.exe" and see what happens.
don't worry you won't hurt anything, you'll just have to do a manual
reboot..)

this issue can pertain to other variants of viruses/crapware, just
using a different name.  i have seen many different viruses use the
shell to start the infected file during boot.  If this is too difficult
of a  task to do to fix the problem, or just trying to find it in
MSCONFIG (cause it ain't there... it's ONLY in the registry), then maybe
it's time you switch to linux.  since you don't know windows, then it
would be super easy for you to learn on linux and be safer and faster.

Should I really get in the habit of re-installing Windows and all my
programs once or twice a year?

According to systeminfo, my XP Original Install Date is 1/21/2003. I
reckon I am in big trouble!

 

[Max]

This solution worked well for me - only note I'd make is I found the
logon.exe command under the windowsN =>
HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/WindowsNT/Current version/Run

 

[Max]

....and and FYI, I found the "explorer.exe logon.exe" under my "Windows NT"
directory. I looked and looked under Windows and didn't find it. Then I
looked in Windows NT and there is was hidded. Thanks for your posts - they
helped me fix my laptop (first time I've been able to do this without
"...taking it in")

 

[Jose]

yes jose you should get in the habit.  i reckon you're probably safe
using your xp that was installed in 2003, seeing as how you probably
would never notice any performance change.  solitaredoesn't take much
to run.

the registry and filesystem gets loaded with crap over time with the
installing/reinstalling/upgrading/uninstalling of software.  the more
useless files and registry entries cause the pc to seek the hard drive
more to find what it needs, thus causing a decrease in performance.

Registered_User, now I am really worried.

Please tell me the method to determine the amount of crap in my
registry and the useless files/registry entries on my system.

Is there a Registry Crap Displayer (RCD) or Useless File Displayer
(UFD) I can download?

How do you know my registry is loaded with crap and how can I see it?
(Oh - you said it is probably loaded with crap).

If you looked at my registry could you spot the crap, how would you
spot the crap and determine it was really crap?

Do you just somehow know that my registry is loaded with crap?

If there are no tools to show me, what method would you use/recommend
to determine my current situation that do not include the words guess,
probably, maybe, might, could, would or should?

What methods do you use to determine it is time to reinstall XP? How
do you really know when reinstall time has come?

Is it time to reinstall when you just can't figure out how to fix
something?

Please describe the best method (in your opinion) to measure current
system performance and the performance after any recommended changes
including the seek time of my hard drive. How will I know my registry
is better after any changes? What benchmarking tools do you find the
most useful?

I would very much like to be able to see some positive difference.

 

[Bob I]

Where ever do you come up with this kind of kind of bogus stuff?!? I
certainly hope you don't actually believe it, cause if you do, you
really need to do some real research!