Computing.Net > Forums > Security and Virus > Log on and log off - USERINIT.EXE exists!

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Log on and log off - USERINIT.EXE exists!

Reply to Message Icon

Name: el_grande
Date: July 25, 2009 at 14:45:41 Pacific
OS: Windows XP
Product: Microsoft Als windows xp professional
Subcategory: General
Comment:

I've got the log on - log out issue on my pc.

I checked the System32 drive using an IDE for the common WSAUPDATER virus issue, however the USERINIT is still there and REGEDIT correctly pointing to USERINIT.

Ran a number of virus scans on HD (avast, spybot S&D, Symantec corporate) and no viruses.

Finally decided to delete the existing copy of the USERINIT and added version from the laptop I was viewing from still no joy!
What other issues could it be?



Sponsored Link
Ads by Google

Response Number 1
Name: el_grande
Date: July 25, 2009 at 14:48:07 Pacific
Reply:

Additional info - I've tried the recovery option too after having no luck with the IDE and still no change.


0

Response Number 2
Name: mavis007
Date: July 25, 2009 at 15:20:00 Pacific
Reply:

"...decided to delete the existing copy of the USERINIT and added version from the laptop..."

... hi "el_grande "... do you know what "UserInit" does?

... reg key kicks in programs that should be launched right after a user logs into Windows. The default program for this key is C:\windows\system32\userinit.exe. Userinit.exe is a program that restores your profile, fonts, colors, etc for your username. It is possible to add further programs that will launch from this key by separating the programs with a comma blah blah

... some adaware programs may also remove or quarantine wsaupdater.exe thinking that it's harmful

... Windows SA replaces userinit.exe used in logon with its own wsaupdater.exe. Uninstalling doesn't revert it back

... if the file has been altered(?) from your laptop my knowledge stops there ... more info below:

1. Boot using your winxp cd.

2. Enter recovery console.

3. at the command prompt go to
C:/windows/system32

4. next type:
copy userinit.exe wsaupdater.exe

5. exit and reboot normally. You should now be able to logon. But you're not done yet!

6. run regedit

7. find the Userinit key in:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\

8. modify the entry:
C:\WINDOWS\System32\wsaupdater.exe
so that it reads:

C:\WINDOWS\System32\userinit.exe

*****************************************************
expand d:\i386\userinit.ex_ c:\windows\system32\userinit.exe

... d: = cdrom... maybe another letter


.

...ps..... maybe its not a UserInit problem!


.

... Posting is provided "AS IS" with no warranties
http://img36.imageshack.us/img36/13...
Grrrr... no hush money!


0

Response Number 3
Name: el_grande
Date: July 26, 2009 at 02:01:34 Pacific
Reply:

hi mavis. I'd tried using the recovery console, but the commands made no difference. Also, the userinit file was already present, the reg key was pointing to the userinit file, and there isn't a version of wsaupdatser everything appears fine. No signs of virus's either. I'm also thinking it's not an issue with userinit....but i don't know what else could cause this. Googled log on, log off and everyone points to userinit. What other things could it be?


0

Response Number 4
Name: mavis007
Date: July 26, 2009 at 05:05:06 Pacific
Reply:

... how did you manage to look @ the reg keys if it logged off as soon as you log-on?

... from what I gather the "userinit" issue does not allow log-on!

... guess your hooking it up some how with your "ide" statement

.... please post here the "boot.ini" content

.

.

... Posting is provided "AS IS" with no warranties
http://img36.imageshack.us/img36/13...
Grrrr... no hush money!


0

Response Number 5
Name: el_grande
Date: July 26, 2009 at 12:43:08 Pacific
Reply:

yes, unable to actually log on. the ide connects directly to the hard drive via it's own power supply. Accessed the system32 folder to see the files. Ran the regedit.exe from there, but i've since thought that may have given me the details of the laptop i'm running? Not been able to get back on yet to get the boot.ini but will post when i've got it.


0

Related Posts

See More



Response Number 6
Name: mavis007
Date: July 26, 2009 at 12:47:04 Pacific
Reply:

... you should be able to boot-off xp cd (r) console

... cd\ [ENTER]

... type boot.ini [ENTER]

... should display boot.ini


.


.

... Posting is provided "AS IS" with no warranties
http://img36.imageshack.us/img36/13...
Grrrr... no hush money!


0

Response Number 7
Name: el_grande
Date: July 29, 2009 at 12:23:01 Pacific
Reply:

Sorry about that, been unable to get time to get onto the pc.
Boot.ini looks ok (to my untrained eye):

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect


0

Response Number 8
Name: mavis007
Date: July 29, 2009 at 14:16:26 Pacific
Reply:

... try boot-up with xp cd to (r) @ command prompt type:

... press [ENTER] after each line

FIXMBR C:
FIXBOOT C:
COPY *CDDrive:\I386\NTLDR C:\
COPY *CDDrive:\I386\NTDETECT.COM C:\
BOOTCFG /rebuild

.....*CDDrive is your cdrom drive letter (I do not know what your drive letter is) only one drive letter and : .....

...ie COPY D:\I386\NTLDR C:\


.


.

... Posting is provided "AS IS" with no warranties
http://img36.imageshack.us/img36/13...
Grrrr... no hush money!


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Log on and log off - USERINIT.EXE exists!

computer automatically logs off www.computing.net/answers/security/computer-automatically-logs-off/26211.html

logs on and logs off auto www.computing.net/answers/security/logs-on-and-logs-off-auto/24731.html

Info on Log-on and BLAZEFIND www.computing.net/answers/security/info-on-logon-and-blazefind/13994.html