Run Time Error

We get a "run time error, abnormal program termination, winlogon.exe" when we get ready to shut down. What causes this? I notice winlogon is checked in the start up menu. We run Win98 with internet explorer. Thanks for any help.

pennydog--

Quote:

---

I notice winlogon is checked in the start up menu.

---

What start up menu?? MSCONFIG|Startup?
I have a suspicion that you should not have this file at all in Win98. And especially if your winlogon.exe is in C:\Windows, you may have spyware or a virus . (In WinNT or XP, it should be in C:\Windows\System32.)
Have you run an Antivirus scan recently? Did you update your virus definitions before you ran the scan?
Do you have a spyware detector installed, such as AdAware or SpybotS&D? If yes, make sure you have the latest references files and run a scan. If no, get one
AdAware
http://www.lavasoft.de/support/download/
SpybotS&D
http://www.safer-networking.org/
After deleting any "baddies" these scans find , uncheck the box to the left of the winlogon line in MSCONFIG and reboot.

Winlogon.Exe with 98? I believe you have ad/spyware, or a virus.
SpyBot Search & Destroy
Housecall, online AV scan
Online Trojan Scan
After installing Spybot, do the update first, then do the Check for Problems. Allow it to remove everything already checked off. If nothing appears, then do the online scans.
Edit: it seems Welshjim and I posted at the exact same time.

Thanks for the replies. We do have adaware, have done the trojan scan, housecalls and just installed a new version of Nortons Antivirus. Yes the Winlogon is in the MSCONFIG file along with a lot of other stuff that I am scared to uncheck. I did uncheck a few things that I knew about. I just used the Norton Utilities to let it "fix" several lost clusters and files out of sinc. That is when we started getting these errors. I uninstalled the System Works, or at least I hope I did and left the anti virus. I think I unchecked the winlogon once and my Nortons Firewall stopped working, I am not sure of this, but it seems I rememebr that. We have had the firewall for a couple years now with no problems. I noticed on another thread that you can reset the registry to 5 days before? Will this correct the problem? I installed this Norton stuff on Monday afternoon or Tuesday afternoon. Thanks for the help. When I get home tonight I can list everything that is in the msconfig file if that helps. Yes we have Win 98, with office 2000 and IE 6.

Ok, I ran the scan with adaware before I left for work. I found 30 files/folders, several were; Wild Tangant - date miner, IP insight - reg key, Trading company-free. Then there were 2 that said winlogon.exe-process-malware & winlogon.exe-reg value-malware. I had these quarentined until I knew what they were. Any ideas? Oh yeah, when I shut down I did not get the error messages this time. If we have any kind of spy anything, I want it off there. Malware is a trojan or some such, right? How can I get it off there?

pennydog, You did right by quarantining them, next you have to delete them; I would wait a few days and keep an eye on your puter to see how it runs. I run Adaware once or twice a day to keep things clean, you will see date miner come up often: it's a tracking program just delete it. You are going to be supprised with all the junk that tries to get in your puter. Let me give you a list: Bugs, Advertisements, Worms, Spyware, Scripts, Cookies, Web Sites, Style Sheets, Scanners, Pop Ups, Viruses and there maybe even more. Some are harmless BUT, some are very dangerous.
Thats why you need a anti-virus, firewall and a program to stop the other junk.
I would say try SPYBLOCKER for the 15 days so you can get an idea what junk tries to get in and how MANY. IT WILL BLOW YOUR MIND.
I hope this may help?
Take Care:)

Thanks Deltree,
Is the winlogon-Malware a trojan? If so will the adaware delete it or do I need to go somewhere else and delete it? We have adaware, antivirus and a firewall, and I usually try to scan again with trend micro and I have done the trojan scan and they showed nothing. This winlogon thing has been on there 2-3 weeks I think.

pennydog, I would say;if you run Adaware and it shows up get rid of it : BUT, if it doesn't show up, don't worry about it? If your puter is running well don't try to fix it. If you get an error post back with the error.
Take Care:)
--"If it's not broke, don't fix it."--:p

pennydog--
1) Is winlogon malware? In Win98 it is.
http://www.google.com/search?sourcei...nlogon+malware
2) Here are several articles that will help you decide what can safely be unchecked in MSCONFIG
http://www.3feetunder.com/krick/startup/list.html
http://www2.whidbey.net/djdenham/Uncheck.htm
http://www.sysinfo.org/startuplist.php
There actually is very little that really needs to be checked, although some programs are personal preference.
I only have
ScanReg
SysTray
AntiVirus
Firewall
Time Synchronization program
Load Power Profile
DrWatson

pennydog, I just looked in my puter an I have winlogon and it is going to stay there, Adaware didn't pick it up as anything bad so it will stay.
Take Care:)

Thanks guys. adaware picked up 2 versions on winlogon.exe, one was process-malware and the other was registry value-malware. I read where it is a trojan or a mydoom thing. If I do not need it and it is a spy ware of some sort I want it off there, but if it is a part of the win 98 system, then I need to leave it?

Also, when I uncheck some of the boxes in MSCONFIG, theyg et re-checked somehow.

DELTREE--C:\Windows\System32\winlogon.exe is a legitimate MS file in WinXP--but not in Win98.

so welshjim........

I have read all the links above and it seems I need to remove the winlogon.....is that right? It is quaretined right now in adaware, but when I get hom I can deleted it. Also, do I need to go in anywhere else and get rid of it other than the adware scan? Thanks.

Welshjim, THANK YOU.

pennydog--Yes, since you use Win98,delete any reference to winlogon. And put all the other stuff AdAware indicates is malware into Quarantine. If, after a week or so, you have no problems, delete them, too.
Also, do I need to go in anywhere else and get rid of it other than the adware scan? With reference to winlogon, AdAware should have detected it all. You could, however, always run Find in Windows and Edit|Find in the Registry and see if you find anything left behind.
And, as mentioned earlier, uncheck the box in MSCONFIG.
You mentioned earlier that some boxes in MSCONFIG would recheck themselves after you undchecked. If this still happens after quarantining/deleting all the baddies, tell us what items.
I have already provided sites where you can learn what each item in MSCONFIG is and whether is recommended to keep the box checked (and therefore allow the program to start at boot).