Userinit.exe

[Duncan Clench]

This is very likely one for Uncle Meat as he's bailed me out on several occasions before! 2 computers (both XP) at work have got nasty little bugs that I can't seem to fix.

 

First up, a trojan (downloader.agent) is screwing one of them over. I've run updated versions of Malwarebytes, Cureit, spybot, and xoftspy, as well as the AVG antivirus scans. It keeps coming back though, and here's the thing. The trojan has infected userinit.exe so AVG won't remove it even though it finds it. I'm not sure Malwarebytes is even picking up on it because it's a windows executable. I've done loads of internet research but to no avail.

 

Anyone got any ideas?

 

Second up, and XP laptop that won't even log in. Logs in, and the back out again immediately.

 

Would appreciate any advice. Doing my head in. Thanks in advance.

[Duncan Clench]

By the way, just running Superantispyware which has picked up on it and called it thus:

 

trojan.dropper userinit-fake. Will do a bit of googling on that.

[Uncle_Meat]

I saw this one last week. Avast Antivirus will kill and cure it happily

[Duncan Clench]

Thanks Meat.

 

Any ideas of how I can get into a laptop that won't let me log in?! Tired this:

 

Annoyances.org - re: I can't log in! (Windows XP Discussion Forum)

 

...to no avail.

[Uncle_Meat]

I take it you're having no joy in Safe Mode either?

 

Have you got a copy of Winternals? 'Tis a boot disk (Preinstalled Enviroment) that at least allows you easy access to restore points/registry editing.

 

If not, build yourself a copy of UBCD4Win

 

UBCD for Windows

 

Download the builder, and all you need to add is a source of XP install files (XP CD will do, for obvious reasons they're not allowed to distribute the tool as a ready-made image). The builder will make the .iso for you. Then, burn the image to a CD, boot and off you go. Shitloads of tools for you to tweak with, plus some virus scanners. Update the virus databases for the included AV software on there too.

[Duncan Clench]

Thanks again mate. I managed to get into the laptop using the recovery console. Changed the userinit file name and then expanded a healthy one from the XP disc.

 

Avast has found the trojan as expected but can't clean it so I've moved it into the chest for now. Hopefully it's the userinit.old file that's infected because I can delete it safe in the knowledge that log in will still work!

 

By the way... the user in question came clean about how he got the virus. Was looking for naked pics of a woman from star trek. Her name is a number or something like that. Don't watch it myself and I wasn't listening properly. I've got a hangover.

 

You're help is much appreciated as always.