What is logon.exe?

Logon.exe is a well known piece of adware. It is installed with many products from MSI (Micro-Star International) and tracks the browsing habits of the user. Logon.exe uses the user's browsing habits to present targeted ads during browsing. It runs in the background and can be difficult to remove without an adware removal utility.

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the logon.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for logon.exe related errors

Logon.exe file information

Windows Task Manager with logon
Logon.exe process in Windows Task Manager

The process known as belongs to software msi Logon or sangfor logon or NbXrtTdbt5ujO2VJu3 by msi ( or sangfor or HgKbaq21X.

Description: Logon.exe is not essential for Windows and will often cause problems. Logon.exe is located in the C:\Windows\System32 folder. Known file sizes on Windows 10/8/7/XP are 28,164 bytes (13% of all occurrences), 34,308 bytes and 16 more variants. 
There is no description of the program. The file is not a Windows system file. The software is loaded during the Windows boot process (see Registry key: Winlogon\Shell, MACHINE\Run, Run, MACHINE\User Shell Folders, User Shell Folders). Logon.exe is able to monitor applications. Therefore the technical security rating is 54% dangerous, however you should also read the user reviews.

Recommended: Identify logon.exe related errors

External information from Paul Collins:
There are different files with the same name:

Important: Some malware also uses the file name logon.exe, for example Trojan.Generic.1288095 (detected by BitDefender), and Backdoor:Win32/Poebot.gen or VirTool:WinNT/Emold.C (detected by Microsoft). Therefore, you should check the logon.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

MSI SecureDoc--File encrypter--Handy for encrypting any kind of file into your HD. It has a password to keep others from decrypting the files.
  JC   (further information)
since this file showed up in my startup items, my comp is wacked
  arita   (further information)
Mine is NOT from MSI - it was installed as a part of a backdoor app
system process
All that I know is that once AVG removed this from my computer the computer reboot itself and was never able to come back up again I will let you know if I find out more when I repair this
logon.exe by Leisure Ltd is an adware that uses explorer.exe to pop up ads in chinese. The ad's looks similar to the msn messenger generated alerts. Ads will be triggered when browse to some sites. For me, will trigger the ad pop-up
When logging as an administrator on XP the PC restarts over and over again!
  Joe Sant  
Checking at system32 folder
I picked up logon.exe two nights ago and cannot get rid of it.
It turns my computer off and I have to start and restart by using the safe mode with networking tab to keep my comp. on!
this is causing my comp to show an error at startup and will allow about 5-10 minutes of usage before an auto shutdown and restart. This is a continual cycle as long as I let it go. I can't do a system restore to any point either. Any recommendations?
Had AVG suspect it of infection through a trogan, so moved to vault, restarted computer came up with an error when logged on but still logged on fine for me, have noticed no problems so far
My info on logon.exe: upon windows startup AVG "detected a threat" which was logon.exe. I clicked on heal, nothing happened. When I opened my computer again, i got an error message telling me windows cannot locate and start the program logon.exe. So now it will be giving me this annoying message upon start? The pc seems to be working fine tho
AVG removed it and now Windows will not load
This process indicates that your system has been infected with a very bad keylogging trojan. The worst thing about it is that it actually encrypts the files in the user's "My Documents" folder in XP, and when it is removed those files are no longer accessible and are totally lost -- even though they're still technically there, once you clean out the virus (which decrypts the files making it appear as if the only thing wrong is that your computer has slowed down) there is no way on earth to retrieve them. The best alternative at this point is a destructive reinstallation of Windows.
  Dr. Planarian  
msgbox started to come up after a virus was detected and cleaned then it started saying no logon.exe file found
  Ron V  
I had 3 worm allerts 2 nights ago which proceeded to crash my computer. The internet connection was completely buggered. A scan got the worms out and internet connection re-established. Now a notice - Cannot find logon.exe. Also notice of Kernel verifier problem. There seems to be no further problems though.
  Rob Hill  
I think Logon.exe is a Microsoft file, but it would be best to ask Microsoft support. I too have lost it somehow, but I will ask Microsoft about it.
  Derek Jacobson  
the generic logon.exe is included with windows xp and other versions, if it is not modified or a modified version, this is the program that displays the computer's logon prompt ie: your name and logon picture before windows is completely started
Antivirus notices it right away on login. It is being created in this Vista system to folder c:\program files\Windows\logon.exe . Everytime it is quarantined or deleted, it is being created again. Thousands of times an hour then. Haven't noticed that the machine would be slower or anything other significant, just the fact that it keeps being created and antivirus doesn't like it.. I don't use internet on that machine though...
Logon.exe was in "c:\program files\windows\" and caused the antivirus software to go berserk. However when cleaned in safe mode the virus was been able to removed and after that no problems with the system. Not needed if in this location.
help HijackThis uncheck user.ini
System restore worked for me! It started two days ago when I accidently accepted the internet access of 'Window NT-aanmelding' (Dutch word). The next day I had the problem that the system was shut down after 5-10 minutes. I did the system restore and restored to the settings of two weeks ago and now it works again!

Rating chart

Summary: Average user rating of logon.exe: based on 24 votes with 23 user comments. 5 users think logon.exe is essential for Windows or an installed application. One user thinks it's probably harmless. 4 users think it's neither essential nor dangerous. 5 users suspect danger. 9 users think logon.exe is dangerous and recommend removing it. 4 users don't grade logon.exe ("not sure about it").

Do you have additional information?
What do you know about logon.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving logon issues

A clean and tidy computer is the key requirement for avoiding problems with logon. This means running a scan for malware, cleaning your hard drive using cleanmgr and sfc /scannow, uninstalling programs that you no longer need, checking for Autostart programs (using msconfig) and enabling Windows' Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the logon.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

logon.exe [all]