after MS updates today system kaplunk

WinXP pro Media SP 3
Loaded the KB files and MS asked to reboot.
what the computer got was a logon.exe error pop up, clicked on cancel to debug, and got the blue screen with error logon message.
just cannot get past that logon pop up.

Tried system restore, accepted and did a restore to 2 days ago, but with the blue screen results.
tried other day last week, with the same results.


Got into safe mode.
cannot do sfc /scannow as it says RPC in not available
went iin to controlPanel/admintools/server and RPC is started and active?

what can I do in safe mode to correct?
Have run regcure.exe, retried booting did not help.

help would be most appreciated.
posting from girl friends computer

You can try a repair install.
http://www.michaelstevenstech.com/XPrepairinstall.htm

Are you sure the name is logon.exe?
Logon.exe is not a Windows file but a nasty.

to my joy, this AM.- I was able to load OS and able to go to command prompt and do sfc /scannow.
here I hit a snag, sort of.
asked for
insert tour windows XP pofessional service pack 3 CD now
which i have and did. Only to get a pop up stating "The CD provided is the wrong cd. Please insert the windows XP professional Service Pack 3 CD into your CD-Rom drive"

of course I can see the pop up in background stating "Microsoft Windows XP Service Pack 3 with advanced security Technologies"
clicked on cancel and continued.
asked for XP Pro disk which I inserted (which by the way has SP pack 2 included.
which it did ask for and the same results as sp3.
But it did go through after I hit the cancel it continues all the way.

question=
do I reload sp3, only
or do I reload SP2 and Than 3
or just do nothing?

I am running sfc a second time to be sure. will do a restore point.

ran Super Antiispyware but clean results.
will also try housecall trend micro after the sfc has finished.

You still didn't answer my question, is the error related to logon.exe?

If it is, open regedit (start > Run > type in regedit)
and scroll to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
On the right pane there will be a value Shell, it should be Explorer.exe.
If anything else, change it to Explorer.exe.

logon.exe is a virus. SuperantiSpyware doesn't mind if you have a different shell. It's not spyware.
Housecall should find it.

sorry DEP.-
no it is winlogon.exe.

frankb--Can you run System Restore from Safe Mode with internet connection, AV program and Firewall turned off?
The CD you are using for sfc /scannow is an SP3 CD and SP3 is what is installed on the PC, correct?

Welshjim.-
here is what I have on my system .-

Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Its up and running. I did trendmicro,superantispyware,spybot and now running defender. So far no virus, Trojan, spyware.

I placed SP2 disk that was supplied me by microsoft when asked. not recognised
I placed original WIN XP Pro with SP2 on the CD when asked. recognised and used
I placed SP3 which I had downloaded as a msi and did a CD-rom when asked. not recognised

In safe mode with internet connection its as slow as molasses.
No Zonealarm and or AVG loaded. so l eerie on being on line.

The only thing that puzzle me now is that I had some lines in Hijackthis that I don't see in the log.
referencing something like elsa winlogon from germany. bu I would guess that regcure took that out.
I can only surmise that this may have been the culprit!

Thank you all for the assistance. Guided me in the right direction to resolve.

I'll do two things only, and if doesn't work, reinstall windows...it'll be less time wasted.
a) uninstall the Updates, from control panel/programs install/uninstall
b) or uninstall the updates, from safe mode,,,
and please...Don't run more than one anti-virus and one anti-spyware program on your system, they fight between them to protect your computer that, they see each other as a threat...

Mad Max
only run one firewall ZoneAlarm.- free version
only run one Anti-virus AVG 8.x free version

Virus/trojan programs are on the system, but NOT running.
I run them only if I see a requirement to verify.

As to uninstalling and re-installing.
If it aint broke don't touch, still works for me.

no answer to the following

"question=
do I reload sp3, only
or do I reload SP2 and Than 3
or just do nothing?"

As, if I do or when I do "sfc /scannow" the same question will arise.

thank you for input.

If XP SP1 is installed then SP3 only is needed.

If it is just XP then SP! or SP2 then SP3 needs to be installed.

Now if you slip stream XP , then you do not run into problems with sfc /scannow.
Otherwise you need to uninstall the SP's so the OS then matches the cd.

Train

here is what I have on my system .-

Platform: Windows XP SP3 (WinNT 5.01.2600)

I would guess that the best route here would be to make a slipstream CD.
Like a project ToDo in the very near time frame.

Would sfc /scannow recognize the Slipstream Disk???

At this stage I will search out the control Panel add/remove and find the SP3 install.
Uninstall, and re-install. and than try sfc /scannow again to see results.

Quote:

---

Originally Posted by Train

If it is just XP then SP! or SP2 then SP3 needs to be installed.

---

Windows XP Service Pack 3 Overview
http://www.microsoft.com/downloads/d...displaylang=en

Quote:

---

Windows® XP Service Pack 3 (SP3) includes all previously released updates for the operating system.

---

(The "all previously released updates" would include both SP1 and SP2).

I missed that statement. Thanks!

No problem. :)