annoying dialog box on startup

I picked up a virus yesterday, my antivirus program detected it, but ever
since i have been getting this dialog box come up on start up. It states
cannot find file logon.exe try typeing it in again or do a search for it. I
have checked forums for this, and it appears that it is not a windows file. I
have done several things to try and get rid of this dialog box. ie virus
scans, spyware scans, windows chkdisk at boot up even used the microsoft one
care scans but I am still getting this dialog box. Another thing I,m getting
is Lsa Shell (export Version) this is being picked up by Zone alarm which
because I am not sure have denyed internet access. Apart from doing a windows
repair what esle can I do.

pennib5 wrote:
I picked up a virus yesterday; my antivirus program detected it. But ever
since, I have been getting this dialog box come up on start up. It states
"Cannot find file logon.exe Try typing it in again or do a search for it". I
have checked forums for this, and it appears that it is not a Windows file. I
have done several things to try and get rid of this dialog box. eg virus
scans, spyware scans, Windows chkdisk at boot up, even used the Microsoft One
Care scans but I am still getting this dialog box. Another thing I'm getting
is Lsa Shell (export Version). This is being picked up by Zone alarm which,
because I am not sure have denied internet access. Apart from doing a Windows
repair what else can I do?

Please read all this before trying.. there are some important notes:

The malware was deleted by your a/v software, but the reference to the
file was not removed from the registry.

Click Start, Run, type REGEDIT, click OK. Press the Home key, press F3,
type the name of the file (logon.exe) into the search pane. Click "Find
Next", and when located, delete the reference to the file. Press F3 to
continue the search. There are legitimate files that will be located
with that search, such as WINLOGON.EXE, SAPLogon.exe, CHLogon.exe and
CHGLogon.exe so you have to keep pressing F3 till the proper entry is
displayed. Then press Delete to remove that entry.

You can click File, Export, and save the entry to the Desktop. If you
remove it and there's a problem, double-click the .reg file you exported
to the Desktop and it'll be added to the registry again. You can create
a restore point before editing the registry too.

You COULD click Start, Run, type MSCONFIG, click OK, click the StartUp
tab, and deselect the item(s). When you restart the computer, you will
be warned that you're running in the Diagnostic mode; click to not alert
you again, and OK out. You won't see the message again. But I think
it's best to just remove the references from the registry.

Look in the registry for "LSA Shell" and post back what you find. The
answer MIGHT be the same for that entry.

--
Joe =o)

Thanx Elmo I went into reg winlogon/Shell and found the logon.exe next to
explorer.exe I deleted the logon.exe. that solved the annoying dialog box at
startup, once again thank you.
"Elmo" wrote:

pennib5 wrote:
I picked up a virus yesterday; my antivirus program detected it. But ever
since, I have been getting this dialog box come up on start up. It states
"Cannot find file logon.exe Try typing it in again or do a search for it". I
have checked forums for this, and it appears that it is not a Windows file. I
have done several things to try and get rid of this dialog box. eg virus
scans, spyware scans, Windows chkdisk at boot up, even used the Microsoft One
Care scans but I am still getting this dialog box. Another thing I'm getting
is Lsa Shell (export Version). This is being picked up by Zone alarm which,
because I am not sure have denied internet access. Apart from doing a Windows
repair what else can I do?

Please read all this before trying.. there are some important notes:

The malware was deleted by your a/v software, but the reference to the
file was not removed from the registry.

Click Start, Run, type REGEDIT, click OK. Press the Home key, press F3,
type the name of the file (logon.exe) into the search pane. Click "Find
Next", and when located, delete the reference to the file. Press F3 to
continue the search. There are legitimate files that will be located
with that search, such as WINLOGON.EXE, SAPLogon.exe, CHLogon.exe and
CHGLogon.exe so you have to keep pressing F3 till the proper entry is
displayed. Then press Delete to remove that entry.

You can click File, Export, and save the entry to the Desktop. If you
remove it and there's a problem, double-click the .reg file you exported
to the Desktop and it'll be added to the registry again. You can create
a restore point before editing the registry too.

You COULD click Start, Run, type MSCONFIG, click OK, click the StartUp
tab, and deselect the item(s). When you restart the computer, you will
be warned that you're running in the Diagnostic mode; click to not alert
you again, and OK out. You won't see the message again. But I think
it's best to just remove the references from the registry.

Look in the registry for "LSA Shell" and post back what you find. The
answer MIGHT be the same for that entry.

--
Joe =o)
.

pennib5 wrote:
Thanx Elmo I went into reg winlogon/Shell and found the logon.exe next to
explorer.exe I deleted the logon.exe. that solved the annoying dialog box at
startup, once again thank you.

That's great news! Thanks for reporting back.

"Elmo" wrote:

pennib5 wrote:
I picked up a virus yesterday; my antivirus program detected it. But ever
since, I have been getting this dialog box come up on start up. It states
"Cannot find file logon.exe Try typing it in again or do a search for it". I
have checked forums for this, and it appears that it is not a Windows file. I
have done several things to try and get rid of this dialog box. eg virus
scans, spyware scans, Windows chkdisk at boot up, even used the Microsoft One
Care scans but I am still getting this dialog box. Another thing I'm getting
is Lsa Shell (export Version). This is being picked up by Zone alarm which,
because I am not sure have denied internet access. Apart from doing a Windows
repair what else can I do?
Please read all this before trying.. there are some important notes:

The malware was deleted by your a/v software, but the reference to the
file was not removed from the registry.

Click Start, Run, type REGEDIT, click OK. Press the Home key, press F3,
type the name of the file (logon.exe) into the search pane. Click "Find
Next", and when located, delete the reference to the file. Press F3 to
continue the search. There are legitimate files that will be located
with that search, such as WINLOGON.EXE, SAPLogon.exe, CHLogon.exe and
CHGLogon.exe so you have to keep pressing F3 till the proper entry is
displayed. Then press Delete to remove that entry.

You can click File, Export, and save the entry to the Desktop. If you
remove it and there's a problem, double-click the .reg file you exported
to the Desktop and it'll be added to the registry again. You can create
a restore point before editing the registry too.

You COULD click Start, Run, type MSCONFIG, click OK, click the StartUp
tab, and deselect the item(s). When you restart the computer, you will
be warned that you're running in the Diagnostic mode; click to not alert
you again, and OK out. You won't see the message again. But I think
it's best to just remove the references from the registry.

Look in the registry for "LSA Shell" and post back what you find. The
answer MIGHT be the same for that entry.

--
Joe =o)