The "wait" screen you see when you boot Win95 is LOGO.SYS; the "wait" screen you see after you shut down Win95 is LOGOW.SYS; and the "It's now safe to turn off your computer" screen is LOGOS.SYS. Although each has an SYS extension, these files are standard bitmaps you can modify with the Paint
applet for custom startup and shutdown screens.  (LOGO.SYS is located in the root directory, and the other two are in C:\WINDOWS.)