Userinit.exe

Userinit.exe being cautious...

#1 CaLiFol2niCaTioN

Member

Group: Members
Posts: 16
Joined: 22-August 08

Posted 22 August 2008 - 02:21 AM

First off, thanks Grinler for the great tut on how to use Autoruns to optimize computers.

I managed to get everything to work and was about to uncheck userinit.exe when Autoruns gave me a popup box saying that unchecking userinit.exe will prevent me from logging on. Is this just the trojan or is the userinit actually legit? In the database it says that userinit.exe is malware, so I'm at a crossroads.

Thanks for reading!

#2 Grinler

Bleep Bleep!

Group: Admin
Posts: 36,175
Joined: 24-January 04
Gender:Male
Location:USA

Posted 22 August 2008 - 09:35 AM

Userinit.exe is legitimate. When using the database you must check to make sure the paths in the database that are flagged as malware are the same as in autoruns.

For example, if it says in the database that C:\Windows\userinit.exe is malware and autoruns shows your userinit.exe in C:\Windows\System32, then they are different files.

Lawrence Abrams
Circle BleepingComputer on Google+!
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
How to detect vulnerable programs using Secunia Personal Software Inspector <- Everyone should do this!

#3 ndancosse

New Member

Group: Members
Posts: 11
Joined: 27-November 08

Posted 28 November 2008 - 10:23 AM

so if u accidentally do uncheck this than how do u get back to recheck it?

#4 garmanma

Computer Masochist

Group: Staff Emeritus
Posts: 27,809
Joined: 27-January 07
Location:Cleveland, Ohio

Posted 28 November 2008 - 11:51 AM

Quote

userinit.exe is a key process in the Windows operating system. On boot-up it manages the different start up sequences needed, such as establishing network connection and starting up the Windows shell. This program is important for the stable and secure running of your computer and should not be terminated.
userinit.exe should not be disabled, It is required for essential applications to work properly..

Quote

so if u accidentally do uncheck this than how do u get back to recheck it?

I'm not sure if you could get into Safemode. You'd probably have to do sfc /scannow or a repair install

This post has been edited by garmanma: 28 November 2008 - 11:53 AM

Mark

why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#5 savethewhales

Member

Group: Members
Posts: 25
Joined: 27-February 09

Posted 28 February 2009 - 01:42 PM

Hello, I have the file which I copied and pasted below shown in my autorun scan.

C:\WINDOWS\system32\userinit.exeUserinit Logon Application Microsoft Corporation c:\windows\system32\userinit.exe

The database shows several programs with filename userinit.exe listed as malware. The legitimate program, the one which plays an important role in startup, however, is listed as having filename AUserInit.exe, which, so far as my untrained eye can tell, does not match the file which I have pasted above. The filename is the same as the malware, but different than the filename of the legitimate windows file.
All of the malware with matching filenames however, are named, while this file does not have a name. Since the legitimate file also does not have a name, it seems that the file here has similarities to both the good and the bad matches nothing exactly. Does anyone out there have any advice?
Thanks in advance for any help you can offer.