I accidentally deleted my Userinit.exe from my registry thinking it was a virus. Now my computer starts with a "Logon" screen that logs me off at least 3 times, before loading my settings to let me use my computer.
I heard that you can replace Userinit.exe into your registry, but I forgot which registry to input it, where it's supposed to belong.
Is there a way to get it back?

Note: I'm quite sure i deleted it from HKEY_LOCAL_MACHINE\ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.

In the right pane under Userinit, Change the key to read:

C:\Windows\System32\Userinit.exe,

Make sure you include the comma.

I looked in the registry folder, but I can't find "Userinit" anywhere!!
I really don't think I have my installation CD either...

If you do not see it where Budapest said, you may need to create the missing variable in Winlogon and then set the value appropriately - that is, if you deleted the whole variable.

Take a look at your system that works properly if you can. You want to make/add your registry userinit section look like a system that is working.

It's very strange. At some times, I can find Userinit.exe in my registry, like yesterday night. I rewrote the key the way Budapest told me to, and the Logon screen didn't come up (fortunately!)
But now, I can't go into Safe Mode because the Logon screen appears again (even in Safe Mode...) but this time, it just logs me off constantly.
And now, I can't find Userinit.exe in my registry...again....

If you are not deleting it, something is doing it for you - and userinit components are a popular taget for malicious software. There are worse userinit problems to have!

I would suggest you start with these free scanning programs.

Download, install, update and do a full scan with these malware detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

Of course there are many scanning softwares and opinions available, but this would be a good start.

Not to be scary, but if you do not have a bootable XP installation CD handy, you might try to come up with one in case things deteriorate later and you find yourself needing one. Everyone should really have one anyway.

I will give in the Malwarebytes FULL scan as soon as possible...but right now, my computer's becoming slow..
I just checked my registry, and I found Userinit.exe (mysteriously appeared again) The key data is: "C:\WINDOWS\system32\userinit.exe,"
When I try to modify the data to match Budapest's, since the data change stopped restarting albeit temporarily, it says: "Cannot edit Userinit: Error reading the value's contents"

I am also aware that a Malwarebytes Quick scan just detected a Rootkit agent in one of my files....

Malwarebytes' Anti-Malware 1.38
Database version: 2389
Windows 5.1.2600 Service Pack 3

7/7/2009 10:10:50 PM
mbam-log-2009-07-07 (22-10-49).txt

Scan type: Quick Scan
Objects scanned: 91355
Time elapsed: 13 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\owner\local settings\temp\c.exe (Rootkit.Rustock) -> Quarantined and deleted successfully.

I am moving this topic to the Am I Infected forum for you. ~ OB

Thank you, Orange Blossom!

A full Malwarebytes scan detected another Rootkit agent, and my SUPERAntispyware detected a Trojan agent/Gen_downloader

Please download RootRepeal Rootkit Detector and save it to your Desktop.

* Close all programs and temporarily disable your anti-virus, Firewall and any anti-malware real-time protection before performing a scan.
* Click this link to see a list of such programs and how to disable them.
* Create a new folder on your hard drive called RootRepeal (C:\RootRepeal) and extract (unzip) RootRepeal.zip. (click here if you're not sure how to do this. Vista users refer to this link.)
* Open the folder and double-click on RootRepeal.exe to launch it. If using Vista, right-click and Run as Administrator...
* Click on the Files tab, then click the Scan button.
* In the Select Drives, dialog Please select drives to scan: select all drives showing, then click OK.
* When the scan has completed, a list of files will be generated in the RootRepeal window.
* Click on the Save Report button and save it as rootrepeal.txt to your desktop or the same location where you ran the tool from.
* Open rootrepeal.txt in Notepad and copy/paste its contents in your next reply.
* Exit RootRepeal and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

Note: If RootRepeal cannot complete a scan and results in a crash report, try repeating the scan in "Safe Mode".

This is my RootkitRepeal scan report:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Time: 2009/07/08 21:36
Program Version: Version 1.3.0.0
Windows Version: Windows XP SP3
==================================================

Hidden/Locked Files
-------------------

Does this mean it did not find anything malicious? I just ran Malwarebytes after the scan, and a Quick Scan found nothing....I'm still cautious though!

Please download ATF Cleaner by Atribune & save it to your desktop. alternate download link DO NOT use yet.
Please download and install SUPERAntiSpyware Free

• Double-click SUPERAntiSypware.exe and use the default settings for installation.
• An icon will be created on your desktop. Double-click that icon to launch the program.
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.)
• Under the "Configuration and Preferences", click the Preferences... button.
• Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
• Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen and exit the program.
• Do not run a scan just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Double-click ATF-Cleaner.exe to run the program.

• Under Main "Select Files to Delete" choose: Select All.
• Click the Empty Selected button.
• If you use Firefox browser click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
• If you use Opera browser click Opera at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
• Click Exit on the Main menu to close the program.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

Scan with SUPERAntiSpyware as follows:

• Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes" and reboot normally.
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

I ran ATF Cleaner, but I couldn't delete my Firefox files (it said it didn't delete anything).
I also ran SUPERAntiSpyware, but I couldn't update it in Safe Mode, because it said something was blocking it. I checked my Firewall, but i couldn't connect with settings because it couldn't connect with ICS. My SUPERAntiSpyware found nothing.
My Internet is VERY fast now! I'm kind of surprised...
Also, I found Userinit again and modified the data as you said! Now my computer doesn't do the Logon process again!

But I'll still be careful!

You won't be able to update SUPERAntiSpyware in Safe Mode as you won't have internet access. You have to update it in Normal Mode, then boot into Safe Mode to run the scan.

If you’re clean, you should create a new Restore Point to prevent possible re-infection from an old one.

Go Start > Programs > Accessories > System Tools and click System Restore. Choose the radio button marked Create a Restore Point on the first screen then click Next. Give the Restore Point a name and then click Create. Then use Disk Cleanup to remove all but the most recently created Restore Point. Go Start > Run and type: "Cleanmgr" (without the quotes). Click Ok > More Options tab > Clean Up in the System Restore section to remove all previous restore points except the newly created one.

Also, go Start > Control Panel and double-click Add or Remove Programs. Post back and report any Java entries that you have.

Um...I have a big problem.
Another bug managed to hit my computer again. This time, my computer noted it. I did a quick Malwarebytes scan, but it found nothing. A warning from Windows popped up, and then my computer just restarted. I tried to go back into Safe Mode, but once again, my Userinit was plucked away, so I can't go into Safe Mode.
Right now in Normal Mode, I can't open Malwarebytes or SUPERAntiSpyware. I tried to do System Restore, but the Next button just won't work...

Rename the Malwarebytes file mbam.exe to winlogon.exe, then double click the renamed file and see if Malwarebytes will run.

It doesn't appear to work....
I tried numerous reboots to try to open Malwarebytes, but they don't work. Also, a notification always comes up for SUPERAntiSpyware, saying:

"The exception Breakpoint
A breakpoint has been reached
(0x80000003) occurred in the application at location 0x0048a7a3."

Sometimes, when i click it, my computer just reboots
And again, my Userinit just spontaneously pops up at random times

Oh! I just did a scan with another antivirus program i had, and now my Malwarebytes is up!
Should I do a Quick Scan or Full Scan with it?

Just do a quick scan for now. Post the log and also post the log from the anti-virus scan you ran if you have it.

Sorry, I don't have the scan for my other antivirus program, but I do know it showed Trojan infections.
Here is the Malwarebytes scan i did just now:

Malwarebytes' Anti-Malware 1.38
Database version: 2404
Windows 5.1.2600 Service Pack 3

7/10/2009 5:29:18 PM
mbam-log-2009-07-10 (17-29-18).txt

Scan type: Quick Scan
Objects scanned: 91953
Time elapsed: 3 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

But what's strange is that the first Malwarebytes scan i did before this one showed plenty of threats. Here it is:
Malwarebytes' Anti-Malware 1.38
Database version: 2403
Windows 5.1.2600 Service Pack 3

7/10/2009 1:24:05 PM
mbam-log-2009-07-10 (13-24-05).txt

Scan type: Quick Scan
Objects scanned: 91939
Time elapsed: 3 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 34

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pcmstub (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\pcmstub (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcmstub (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\net (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\net (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\net.net (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Fonts\windef.Log (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\Fonts\winpaged.ocx (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\Fonts\cooecp.tlb (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\msubr.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\msiuqeis.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\mslzwdjk.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\pcmstub.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\tpsaxyd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\msckggp.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\mscomiwk.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\mszlztr.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACipyameeebfmivvosr.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\msfqoiw.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACjxwlkmxewlgmvtfrh.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACpuqavoylwbyqtswtt.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACqjbmeilschowqbgee.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACxmnalmkvoboyxxivd.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\UACxnkpasvpeoriuwtij.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\UACqboetjiixgsklyjui.sys (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\install.48349.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\k56kshhui43wyugheh66hjfdsn43.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\k56kshhui43wyugheh66hjfdsn46.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\c.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\dailybucks_install.exe (Rogue.Installer) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\db.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\44400500915mmx.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\a.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\prun.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\temp\rasvsnet.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\UAC9143.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\UACe520.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

SUPERAntiSpyware first scans also showed many threats, but after I deleted them and scanned once more, it showed nothing in its scans.
Spybot is the same; it first detected ".TDSS" bugs

Can it be that the virus is just hiding and is not entirely gone?

Run this scan again:

Please download RootRepeal Rootkit Detector and save it to your Desktop.

* Close all programs and temporarily disable your anti-virus, Firewall and any anti-malware real-time protection before performing a scan.
* Click this link to see a list of such programs and how to disable them.
* Create a new folder on your hard drive called RootRepeal (C:\RootRepeal) and extract (unzip) RootRepeal.zip. (click here if you're not sure how to do this. Vista users refer to this link.)
* Open the folder and double-click on RootRepeal.exe to launch it. If using Vista, right-click and Run as Administrator...
* Click on the Files tab, then click the Scan button.
* In the Select Drives, dialog Please select drives to scan: select all drives showing, then click OK.
* When the scan has completed, a list of files will be generated in the RootRepeal window.
* Click on the Save Report button and save it as rootrepeal.txt to your desktop or the same location where you ran the tool from.
* Open rootrepeal.txt in Notepad and copy/paste its contents in your next reply.
* Exit RootRepeal and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

Note: If RootRepeal cannot complete a scan and results in a crash report, try repeating the scan in "Safe Mode".

Here is my RootRepeal scan:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Time: 2009/07/10 19:25
Program Version: Version 1.3.0.0
Windows Version: Windows XP SP3
==================================================

Hidden/Locked Files
-------------------
Path: C:\WINDOWS\Prefetch\ROOTREPEAL.EXE-3B8B9981.pf
Status: Visible to the Windows API, but not on disk.

I think it's time to head on over to the HijackThis forum for a closer look.

Preparation Guide for use before posting a HijackThis Log

Go straight to Step 6. Be sure to include a link to this thread so they can see what has already been tried.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/topic240657.html you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond. Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom