Windows cannot find "logon.exe"

[Bpayton]

Last night my computer got infected by some Trojan virus after listening on a
song. I closed all applications and ran my spyware and anti virus programs
right away. I removed all the infected files to the vault. Now every time I
restart I receive this message " Windows cannot find "logon.exe". Make sure
you typed the name correctly and try again...". I may have moved the
infected file to the vault. How can I fix this? I didn't get the Windows XP
CD when I bought this computer from surplus. Thank you.

 

[Bpayton]

What do you do when this has happened and the logon.exe file is not showing?

 

[Bernd]

-------- Original-Nachricht --------

Look here:

http://www.bleepingcomputer.com/forums/topic229102.html

especially at post #5 from garmanma.

Bernd

 

[Bernd]

-------- Original-Nachricht --------

These 3 Processes seem out of control:
EULALauncher.exe
CLI.exe
ATPStartupAssistant.exe

I used the Task Manager to end these processes and at least that lets
me use the computer, but I'm hoping I can find a true fix.

EULALauncher.exe belongs to Adobe Air. But search for it. If it's under
c:Windows or c:Windows\System32 then it's malware.
Delete it and the "starting" key in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Try to have a look at the other files by the scanner websites

http://www.virustotal.com
or
http://scanner.novirusthanks.org/index.php

Bernd

 

[Jose]

Well, first post.... I appreciate any help.

So I successfully removed the problem 2 days ago using many of your
suggestions (basically, I went in the registry and had to erase
logon.exe).

Seems to have worked but I think it left some damage behind. My
computer doesn't give me the "Windows Cannot Find 'logon.exe'......"
prompt anymore, But the CPU is still running very slow, and often times
at 100%.

These 3 Processes seem out of control:
EULALauncher.exe
CLI.exe
ATPStartupAssistant.exe

I used the Task Manager to end these processes and at least that lets
me use the computer, but I'm hoping I can find a true fix.

First you have to figure out what the problem(s) is.

I would not just delete some executable and then remove it from the
registry as a fix - what if you are using that program?

I know CLI is the part of the Catalyst Control Center for ATI video -
is that what you have?

If you are not using these things, disable them. If you need them,
fix them.

Click Start, Run and in the box enter:

msconfig

Look at the Startup tab and find your entries of interest and uncheck
(disable) them. This does not uninstall, but keeps them from starting
automatically. I would start with Catalyst Control Center (CLI)
since I know that is a CPU pig.

Click OK and reboot.

When XP loads again click the don't bother me again checkbox and test
your system. You can do one item at a time of the three interesting
ones, report back and then decide what to do next if you need help.

Msconfig is not the way to "uninstall" things either. It disables
them safely so you can put them back later if you want - when you
figure it out what the problem is, then we can fix it with certainty.

 

[Jeff Block]

I tried what you said as I have the same error message coming up, but I did
not see it on the list to take the action as you stated.

My message comes up after I log onto my user account onto my home computer.
My daughter also gets the same message when she logs onto her user account.
Once we hit the ok or X, it goes away and we can work.

 

[Jose]

I tried what you said as I have the same error message coming up, but I did
not see it on the list to take the action as you stated.

My message comes up after I log onto my user account onto my home computer.  
My daughter also gets the same message when she logs onto her user account.
Once we hit the ok or X, it goes away and we can work.

Part of delay and frustration in finding solutions is following
directions that includes phrases like "try", "probably" and "could
be".

A "Cannot find...", "Could not run...", "Error loading... or "specific
module could not be found"
message is usually related to malware that was set to run at startup
but the referenced file(s)
has been deleted after a malware scan leaving behind a registry entry
pointing to a file that does
not exist.

Windows is trying to load this file but cannot locate it since the
file was mostly likely removed
during an scan for malicious software. However, an associated orphaned
registry entry remains and is
telling Windows to load the file when you boot up or login.

You need to remove the referenced entry so Windows stops trying to run
the file. It may or may
not be in the registry.

If you are comfortable editing the registry you can search for and
remove the reference from
or remove it using a popular third party tool called Autoruns.

Before making any changes to your registry by hand or with third party
tools, be sure to make a backup
of the registry first. Here is a link to a popular registry backup
tool:

http://www.larshederer.homepage.t-online.de/erunt/

Autoruns does not install anything on your computer. It will display
all of the startup locations
where the reference might be so you can disable it or delete it
completely. Here is the download
link for Autoruns:

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Launch Autoruns.exe and wait for it to finish populating the list of
entries.

When Autoruns is finished scanning your system, it will say "Ready" at
the bottom left corner.

Scroll through the list and look for a startup entry related to the
file(s) in the error message.

Right-click on the offending entry and choose to delete it.

Reboot your computer and troubleshoot remaining issues.