Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


How to restore the userinit.exe file?

  • Please log in to reply
5 replies to this topic

#1 pinkyinus


  • Members
  • 2 posts
  • Local time:04:28 PM

Posted 25 May 2009 - 02:50 AM

hi, everyone, this is my first post at Bleeping Computer, hope I can get help ASAP, thanks a lot. I found my desktop got infected by malware tonight and I tried to remove those virus by using malwarebytes' antimalware at the "Safe Mode with Networking". And I found that one of the virus is located as "userinit.exe" at the system32 folder and I so deleted that and even clear the recycle bin(~.~) at the "Safe Mode"!! And now I can't login to the windows and the safe mode anymore!!! What can I do and how can I place that file back to its place? And if I don't have the Windows XP installation CD (I am trying to find that, but think the chance is minimal...sorry), what can I do?

Thank you again!

BC AdBot (Login to Remove)


#2 rowal5555


    Just enough info to be armed & dangerous...

  • Members
  • 2,644 posts
  • Gender:Male
  • Location:St Kilda, Dunedin. South Island. NZ
  • Local time:09:28 AM

Posted 25 May 2009 - 06:33 AM

Hi pinkyinus

What is the make and model of your computer, and do you have a Recovery Partition on your hard drive? (It will probably show as Drive D:)

rowal5555 (Rob )                                                             

Avid supporter of Bleeping Computer's
Team 38444

You can help find a cure


#3 garmanma


    Computer Masochist

  • Members
  • 27,809 posts
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:04:28 PM

Posted 25 May 2009 - 10:25 AM

You will have to create a small 'fix CD' to solve this problem.
Please download RC.ISO and save it somewhere you can find it.
Also download MagicISO and install it.

Start MagicISO. You should see a window informing you about the full version of MagicISO.
In the bottom right select Try It! and the program will open.
Click on File and then on Open and navigate to the RC.ISO file you downloaded. Select it, and click Open.

First, you'll need to add a clean version of userinit.exe to the current RC.ISO
  • In the upper right pane, double click on the i386 folder.
  • Right click in the upper right pane and select Add Files...
  • Navigate to C:\Windows\System32 and select userinit.exe
  • Then click Open to add userinit.exe to the CD image.
  • Click File and select Save As...
  • Name the file RCplus and save it somewhere you can find it.
Next, we'll need to burn the newly created image to a disk that we can use to fix the problem.
  • Put a blank CD-R disk in your CD burner and close the tray. If an AutoPlay window opens, close it.
  • Click on Tools and select Burn CD/DVD with ISO.... A window will appear.
  • Click on the little folder to the right of CD/DVD Image File then navigate to the newly created RCplus.iso Image file and click Open.
  • In the CD/DVD Writing Speed drop-down menu choose the 8X setting.
  • Under Format make sure that Mode 1 is selected.
  • And finally, click on the Burn it! button to burn RCplus.iso to disk.
Once the disk is burned, put it in the machine you want to fix and restart it.
Boot to the CD just as you would with a Windows XP disk.
At the Welcome to Setup screen, press R to enter the Recovery Console.
Choose the installation to be repaired by number (usually 1) and press Enter.
When you are asked for the Administrator password, enter the password or leave it blank (default) and press Enter.

At the C:\Windows> prompt, type the following commands pressing Enter after each one. Note: Watch the spaces.

cd i386
copy userinit.exe c:\windows\system32

After putting in the third command, you should receive the message 1 file copied which will indicate that the operation succeeded.
Now take out the CD and reboot your computer to normal mode. Try to log in and it should let you back in.

Edited by garmanma, 25 May 2009 - 10:26 AM.

Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#4 pinkyinus

  • Topic Starter

  • Members
  • 2 posts
  • Local time:04:28 PM

Posted 25 May 2009 - 11:44 AM

To Rowal5555,

Thank you for your fast reply, my CPU is a Compaq Presario SR2032X.

To garmanma,

Thank you very much for your method, I tried, but I found that the disk I have is not working...I mean I cannot burn the data in the disc I have...Do you have any suggestions?

Edited by pinkyinus, 25 May 2009 - 12:11 PM.

#5 joseibarra


  • Members
  • 1,301 posts
  • Gender:Male
  • Location:Downstairs
  • Local time:03:28 PM

Posted 28 May 2009 - 02:25 PM

Greetings, friends and neighbors.

I have XP Pro, SP3, all updates I care about, no malware that I know of, and this is my desktop (actually, I call it a floor top - the case is so old) home computer I built.

Before XP Pro, I had Windows 2000.

On my old 2000 boot menu, I could choose to boot to 2000 or the Recovery Console With XP, I just boot to XP, so thought I would add the recovery console using my bootable XP CD following the directions from MS, but the winnt32 on the CD is not compatible with my SP so winnt32 won't run. I read I can download SP2 to build it, but I don't wan to install SP2 over SP3 and it just doesn't sound safe to me.

Since I built it myself, there is no recovery partition, and I don't care for one.

I read your directions here about using the MagicISO and RC.ISO to create a bootable CD to replace userinit.exe. I don't have that same problem, but a bootable CD (besides my XP CD) might come in handy, so I followed the directions, even added userinit.exe because I know about that problem..., burned it, it ejected, no errors. My system will not boot on the new CD.

I went into my BIOS and left my CD and floppy as the only boot devices and it still won't boot on the CD. I just get asked to choose a device. It hits the floppy, but of course nothing is there. I know my CD drive and BIOS settings are okay because I can still boot on my XP installation CD with that BIOS configuration and run RC from there.

The CD I made does not boot on different computer either.

The CD is labeled Recovery CD and has the i386 folder (with userinit.exe ) and files WIN51 and WIN51IC.

I have Nero and could probably come up with something there, but this looks sooo straightforward and easy!

Did I miss something?

I don't know what a bootable CD should look like I guess. I can try again, but thought I'd ask since I am pretty sure I followed the directions and there were no errors anywhere - smooth! I never get to teh referenced Welcome to setup screen.

I would like to have this bootable CD for my at home toolkit and I would still like to know if I can get the Recovery Console safely added to my HDD as a boot option (I know about boot options - I just need RC installed). It still have the CMDCONS folder from 2000, but I am not trying that.

I know that is two issues, so if I need to make a new thread or something I can, or is there a good thread(s) to read.


The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.

#6 gotchalv247


  • Members
  • 2 posts
  • Local time:01:28 PM

Posted 18 July 2009 - 12:32 PM

I am using Trojan Remover and my 'USERINIT.EXE' cannot be restored by the application. Trojan Remover is telling me that..

"An essential Windows file, USERINIT.EXE, has been replaced or virally patched by malware. TR cannot locate a good copy of this file to restore."

The file cannot be renamed/removed without a good copy available, because then the system would not be able to start correctly.



Is the process basically the same for XP?, If different please explain. Your help is greatly appreciated.

OS: Windows 7rc x86
3.6 GHz dual prescott
1024 MB RAM

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users