After running CCE quick scan it showed one threat. I choose to ignore the threat for now and ran a scan using CIS. The results of CIS scan were no threats found. Here is the text info from the CCE scan.
====== System Information ======
Computer Name: HPDESKTOP
Log on User: John
Memory Size: 7.75 GB.
Windows Directory: C:\Windows
Windows Version: 7 (64bit)
CCE Version: 2.5.242177.201
Virus database version: 13147
[12:45:29] Scan started.
====== Cleanup results ======
Global WINLOGON SYSCHANGE Ignore OK
Please check the digital signature of the winlogon file to see it has a valid digital signature by Microsoft.
To know for sure that winlogon.exe is the original file you can use Sigcheck to see if it is digitally signed by Microsoft.
Download this zip archive and unpack it to C:\Program Files\SysinternalsSuite\ . When done run sigcheck.reg to add it to the registry.
When this is done navigate to the system32 folder, look up and select winlogon.exe click right and choose Signature from the context menu. A black command box will pop up. See if it is signed or not.
I am unable to get a black command box to open… I right click on the file and select signature but then I get a box asking what program to open the mui file…
Please run the extra tool ‘Autoruns’ and click on the ‘Winlogon’ part in the left menu.
Then post a screenshot of the results please so we might see what has been changed.
Click on “start”
Click on “All Programs”
Click on “Accessories”
Click on “Command Prompt” <---------Right Click on - RUN AS ADMIN
type in “sfc /scannow” <----without the " "
There are several stages of ‘winlogon’ e.g. in win.ini and system.ini, registry etc.
The CCE entrie doesn’t show a clue where to look for modified things, I’d suggest to run a MBAM scan to see if that shows more details.
Just thinking out loud. May be it is responding to the file not found situation? Try disabling the autorun entry with the file not found error and try again.
Also try running checkdisk to see if the file system is intact. Run chkdsk /f from the command prompt and allow Windows to run chkdsk on the next boot.
Mine is also selective startup. When you remove any checks from the startup entries it automatically is set to selective startup, atleast here it is so.
why don’t you try putting it back to normal and see if the problem is still reported. To turn things off I actually use CClenaer in their tools section.