Every time I log on to my desk top (I don’t have to restart my computer for this to happen) I get a bug report stating “Userint32.exe has encountered a problem and needs to close…” and a warning massage saying “16 bit MS-DOS Subsystem C:\nine.exe The NTVDM CPU has encountered an illegal instruction CS:0dc9 IP:0219 OP:63 73 73 22 20 Choose ‘close’ to terminate the application.” I think I have a virus but my virus scan won’t pick it up (not32).When searching for Userint32.exe on Google I get a lot of hijack this reports so here’s mine Logfile of HijackThis v1.99.1 Scan saved at 7:45:53 PM, on 5/20/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32krn.exe C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\userint32.exe C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\BOINC\boincmgr.exe C:\Program Files\Azureus\Azureus.exe C:\Program Files\NetPerSec\NetPerSec.exe C:\Program Files\Java\jre1.5.0_02\bin\javaw.exe C:\Program Files\BOINC\boinc.exe C:\Program Files\BOINC\projects\climateprediction.net\hadsm3_4.12_windows_intelx86.exe C:\Program Files\BOINC\projects\climateprediction.net\hadsm3um_4.12_windows_intelx86.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Katz\My Documents\My s---\Sys. Aps\hijackthis\HijackThis.exe F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\userint32.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Windows Service Manager] C:\WINDOWS\userint32.exe O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - Startup: Adobe Gamma.lnk.disabled O4 - Startup: Azureus.lnk = C:\Program Files\Azureus\Azureus.exe O4 - Startup: NetPerSec.lnk = C:\Program Files\NetPerSec\NetPerSec.exe O4 - Startup: Tor.lnk.disabled O4 - Startup: Trillian.lnk.disabled O4 - Global Startup: Adobe Gamma Loader.lnk.disabled O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled O4 - Global Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe O4 - Global Startup: Screen Saver Control.lnk.disabled O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Browser Adjustment - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\PROGRA~1\Agnitum\OUTPOS~1\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.exe (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.exe (file missing) (HKCU) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112848822389 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe Thank you for your time

Sorry my virus scanner is NOD32 not not32

hahaha Rowan yeah man u got a virus...try to remove it but if you cant...just reformat. There are 10 types of people in the world, those who know binary, and those who don't.

There is probably a much easer way to solving this problem than reformatting

Hi Rowan, Computing Monk, hello everyone, Rowan, Press Ctrl + Alt + Del. Select the Process tab. End task on userint32.exe Run hijackthis again and remove the following entries; F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\userint32.exe O4 - HKLM\..\Run: [Windows Service Manager] C:\WINDOWS\userint32.exe Go to C:\Windows and delete the userint32.exe. Turn off System Restore. Go here and run an online virus scan. Best Regards, Mesich

Thank you for that it solved the problem with the userint32.exe, i realy apreciate it. Although dose anyone have any idea about the nine.exe thing? I tried to delete it but it says something is using it even when i close all non esential processes. Thank you again for your help.