# [SOLVED] Accidentally deleted winlogon.exe



## UberCuber (Aug 11, 2008)

Yeah, I'm a idiot, feel free to laugh at me.

Last night, I was on my laptop and was running an AVG Free scan on it. I was in the middle of something, and not really paying attention to what it was deleting, but I realized later that it got rid of Winlogon.exe, and I'm getting a blue screen whenever I start up windows. 

But here's the thing: I tried doing a repair install of XP on it, but it wouldn't give me the option to do it. So, I'm at one of those "WHAT THE HELL DO I DO NOW!!?!??!" moments. Anyone got any advice?


----------



## UberCuber (Aug 11, 2008)

*Re: Accidentally deleted winlogon.exe*

Ok, sorry for double posting, but I was on another website that had someone with similar problems, and they were told to go to the recovery console and type in:

C:\WINDOWS> cd system32
[enter]
C:\windows\system32>del winlogon.exe
[enter]
C:\windows\system32>x:
[x: is whatever your cd-rom is]
X:\>cd i386
[enter]
X:\i386>copy winlogon.ex_ c: (it might be c:\)
[enter]
X:\i386>c:
[enter]
C:\>ren winlogon.ex_ winlogon.exe
[enter]
C:\>copy winlogon.exe c:\windows\system32

So, I figured that I had nothing to lose really, so I tried it. And to some extent, it worked. Instead of getting just a blue screen of doom after the loading page for xp, it would say: "Windows is loading..." (or something similar)...

But then, it would go to a blue screen, and say:
"STOP: c000021a {Fatal System Error}
The Windows Logon Process System Process terminated unexpectedly with a status 
of 0xc0000005 (0x00000000 0x000000000).
The System has been shut down."

Any advice?


----------



## rbalaji (Dec 12, 2008)

*Re: Accidentally deleted winlogon.exe*

You can't just rename winlogon.ex_ to winlogon.exe. .ex_ files are compressed files. You are supposed to uncompress the file. First see if there is a copy of winlogon.exe in windows\system32\dllcache. If it is, just copy it to windows\system32. If not try this: expand <source directory>/winlogon.ex_ c:\windows\system32\winlogon.exe


----------



## UberCuber (Aug 11, 2008)

*Re: Accidentally deleted winlogon.exe*

Sorry if I'm coming off like a noob, but I'm not too awake right now, could you possibly put that into simple steps for me? I greatly appreciate the help


----------



## rbalaji (Dec 12, 2008)

*Re: Accidentally deleted winlogon.exe*

All I am asking you to do is instead of copy, use the command "expand". Or find another copy of the file that is already expanded (for example in the dllcache directory) and then you can just copy it with no need to expand.


----------



## elf (Jul 19, 2002)

*Re: Accidentally deleted winlogon.exe*

C:\WINDOWS> cd system32
[enter]
C:\windows\system32>del winlogon.exe
[enter]
C:\windows\system32>x:
[x: is whatever your cd-rom is]
X:\>cd i386
[enter]
X:\i386>expand winlogon.ex_ c:\windows\system32 (it might be c:\)

Should be all that you need to do. Note that you are using the expand command instead of the copy command.


----------



## UberCuber (Aug 11, 2008)

*Re: Accidentally deleted winlogon.exe*

Thank both of you for the helpful advice! I'm so grateful for sites like this. I'm going to make sure I'm not about to fall asleep the next time I do a virus scan. As I'm rather busy right now, I'll try that out first thing tomorrow morning, and if it doesn't work, I'll post it here.

Seriously, I'll be SO glad if this fixes it tomorrow, because my father would have had my head on a pike if he finds out I screwed up his laptop (he needs Corelldraw for his work, and can't run it on Vista). One last time, thank you.


----------



## rbalaji (Dec 12, 2008)

*Re: Accidentally deleted winlogon.exe*

You are welcome, and good luck! And if the problem does get resolved, please mark the thread as solved.


----------



## UberCuber (Aug 11, 2008)

*Re: Accidentally deleted winlogon.exe*

I've got some bad news: I tried putting all that stuff into the Recovery Console, and all I got was this message:

"STOP: d0000144 Unknown Hard Error
Unknown hard error"


----------



## rbalaji (Dec 12, 2008)

*Re: Accidentally deleted winlogon.exe*

Are you able to find an expanded copy of the file in the dllcache directory? If so you can just copy from there to the windows/system32 directory.


----------



## UberCuber (Aug 11, 2008)

*Re: Accidentally deleted winlogon.exe*

I looked, and unfortunately, no it is not in there.

I know this probably will sound stupid, but is there a place I could download winlogon.exe? Because couldn't I just copy it into system32, because I'm still able to use the laptop (with Ubuntu)


----------



## UberCuber (Aug 11, 2008)

*Re: Accidentally deleted winlogon.exe*

Hey, I was able to fix it. 

What I did was, look into the hard disk while using a Ubuntu Live CD, and looked through all the files for winlogon.exe, and I found it in the folder for the Antivirus, and simply copied and pasted it into the system32 folder, and it's working fine again (except for some viruses, but I'll take care of those later)


----------



## rbalaji (Dec 12, 2008)

Glad you got it fixed. You can mark the thread as solved. Good luck!


----------



## MIamiShared (Aug 11, 2010)

Nice post ! thank you.
even if you don't see the file..
use the search companion (search in hidden files and folders)
I found 3 diffrent places. (c:\windows\$ntservicePackuninstall$;
c:\windows\i386; c:\windows\servicepakfiles\i386)
renamed to winlogonBAD.exe then another one appeared, I renamed to winlogonBAD2.exe.
THen copied from c:\windows\$ntservicePackuninstall$ to windows\system32\... and piece of cake!

Then removed with malwarebytes!


----------

