none
winlogon.exe error

    Question

  • when I start the computer or logon or restart even in safemode I get a warnning sound when the welcome blue screen apeares and after that when the desktop apears I get a warnning box like this http://www.fileden.com/files/2008/12/30/2245308/untitled.bmp if I click Ok I don't have any problem in useing my pc I can accses everything . I have put norton internet sec 2009 licensed and fully updated  to do a full system scan in safe mode it didn't show up nothing no worms no adware no spyware I used norton system works to scan and fix registry but that box steel apears please help I can allways reinstall my windows but why should i do that if only that box bothers me
    Tuesday, June 9, 2009 6:57 PM

Answers

  • thanks daft for your idea but after doing what you wrote and restarted the registry key ramain the same so I've edited in regedit the shell value with "Explorer.exe C:\WINDOWS\system32\winlogon.exe"and at the next restart the box disapeared Thanksall for help
    • Marked as answer by nicuads Thursday, June 11, 2009 4:53 PM
    Thursday, June 11, 2009 4:52 PM

All replies

  • Nicuads,

    First of all, i think your pc might be infected with spyware or a virus (or was infected).
    Because winlogon.exe is a verry critical operating system file.
    BUT it never will reside in the C:\windows\ directory.But the default location for winlogon.exe is c:\widows\system32\winlogon.exe.
    So this is verry suspicious.

    So, go to the http://housecall.trendmicro.com and run a free scan on your computer.
    The next step is check if your antivirus definitions are up 2 date. And perform a full scan.

    If you did all these steps and the message still occours.
    Try the following steps to manualy remove this dialog box.

    1. Open a command prompt
    2. Type in the command MSCONFIG
    3. Click on the Startup tab
    4. Uncheck the line where the command is C:\windows\winlogon.exe
    5. Click the OK button and reboot your machine.

    (It could be that the virus is more advanced. And it starts from a other location then this one.
    But if that is the case post some more info here.)

    Did this resolve your problem?

    Kind Regards
    DFT


    IM me
    • Proposed as answer by daft Tuesday, June 9, 2009 9:52 PM
    Tuesday, June 9, 2009 9:52 PM
  • as I've mentioned before I don' t have any other problem with my pc it behaves normal ecsept that box i can accses any sites and any file on my pc i can install delete or uninstall any program ,folder, file . norton uses live update pulse update and sonar to detect heuristic virus. as for more info watch the winlogon.exe registry and tell me if its something wrong with it http://www.fileden.com/files/2008/12/30/2245308/exlporer%20winlogon%20reg.bmp and this image of programs running at startup http://www.fileden.com/files/2008/12/30/2245308/programs%20running%20at%20startup.bmp
    Wednesday, June 10, 2009 5:25 PM
  • The message would appear to come from \windows\winlogon.exe looking for a copy of itself in the \windows directory. 

    What do you see if you press start, run.  Type cmd.  In cmd window type, w/o quotes, 'cd \windows' and press enter.  Type, w/o quotes, 'cacls winlogon*.*' and press enter.  When you have that answer type 'exit' and press enter to close the cmd window. 

    If the answer is something like 'not found' that indicates one path for researching the problem.  If the answer is something like 'permissions' that indicates another path.  Not knowing which case exists indicates no real path to finding the answer to your post.

    Could be a simple matter of the winlogon.exe having been mistakenly moved/copied into \windows causing the boot sequence some confusion.

    Good luck!


    Wednesday, June 10, 2009 6:43 PM
  • the answer was the systenm cannot find the specified file. how could this help me I'm not good at this
    Wednesday, June 10, 2009 7:13 PM
  • Consider:

    The message title indicates that the process having the problem is 'c:\windows\winlogon.exe'.

    The message body indicates that the problem is that 'c:\windows\winlogon.exe'.

    The cacls would have provided the permissions to access the file if it existed.

    If it does not exist then it appears that there is a stronger possibility that daft's response regarding spyware possibility/leftover is the case as, per title, the file likely existed when you booted and generated the error by, for example, looking for \windows\winlogon' (itself) rather than \windows\system32\winlogon.  Or, it could be that the error is generated on purpose in order to hook into error handling to complete its processing.

    Beyond that I am unable to assist but I'm certain someone on this forum can.  Have you tried daft's suggestions?

     

     

    Wednesday, June 10, 2009 11:19 PM
  • nicuads,

    Thanks for the screenshots they are verry helpfull.
    It seems that the shell key has the wrong value.

    How can you change this to remove the anoying winlogon.exe prompt.
    Well try the following steps.

    1. See that you are logged on with a user that has administrator rights.
    2. Hit Windows Key + R
    3. Type in the run dialog box the following command: CMD.exe
    4. Type the following command in the black box (command prompt)
    REG ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t "REG_SZ" /d "Explorer.exe" /f
    5. Close everything & reboot your machine.

    Did this solution work for you?

    Kind Regards
    DFT
    IM me
    • Proposed as answer by daft Thursday, June 11, 2009 10:13 AM
    Thursday, June 11, 2009 10:13 AM
  • thanks daft for your idea but after doing what you wrote and restarted the registry key ramain the same so I've edited in regedit the shell value with "Explorer.exe C:\WINDOWS\system32\winlogon.exe"and at the next restart the box disapeared Thanksall for help
    • Marked as answer by nicuads Thursday, June 11, 2009 4:53 PM
    Thursday, June 11, 2009 4:52 PM