trojan in userinit.exe

fletch5

fletch5

Pain in the arse
Messages
3,313
Name
Dean
Edit My Images
Yes
so last week, my desktop computer running AVG decided to popup with a security warning saying there is a trojan thingy in userinit.exe

since AVG wont touch the file because it is vital to windows, i had a google and run through a couple of manual removal tools to no avail.

ive tried lavasofts ad aware and spybot. they find i and remove it, but there is a downloader something somewhere that reloads it.

any help would be gratiously received
(and no, not interested in a mac:lol:)
 
i uesd to use avg but i had a few things get thrugh it, so ditched it and are now using nod32 nothing has beat it yet :)
 
fletch5,run ccleaner,then if you have xp you will have to disable system restore so the bad file is deleated there,i recomend malwarybytes as a good scanner,and avast 4.8,hopefully these will find and permanently remove,then restart system restore.
 
You need to turn off system restore and start PC in safe mode and then scan with AVG!
 
Boot off your xp disc, go into the recovery console. change the path to <cd drive>:\i386

type "expand userinit.ex_ c:\windows\system32"

it should say one text file copied or something similar.

Reboot and pick a decent antivirus :)

When removing viruses I tend to use 2 tools the most, this one then this one.

If trojan remover and kaspersky fail to update, check that internet explorer isnt set to use a proxy, and isnt set to work offline.
 
Ill give it a try when i get home, thanks. i left it running spybot and ad aware in safe mode last night. will check what happens when i reboot later.

i cant remember off the top of my head the name of the trojan(actually i dont think it told me:thinking:)

i am running xp sp3 as well.

thanks for all the help:thumbs:
 
Don't rule out the possibility that you may have to reinstall XP to get rid of it.

What gave you the name of the trojan in the first place? If it was an AVG scan then repeat it. With the trojan identified it may be possible to find a fix specific to it. Without the name, you are increasing the likelihood of having to resort to the ultimate solution.
 
Don't rule out the possibility that you may have to reinstall XP to get rid of it.

What gave you the name of the trojan in the first place? If it was an AVG scan then repeat it. With the trojan identified it may be possible to find a fix specific to it. Without the name, you are increasing the likelihood of having to resort to the ultimate solution.
 
well, thanks for all the help. it seems the spybot and ad aware running in safe mode, followed by avg sorted it out. it did show up a few system restore points that had the trojan, so i turned it off(would never use it anyway i dont think) and all seems good now, will wait and see for a couple of days though.

thanks again for the useful advice:thumbs:
 
:bang:well, its back, so didnt fix it. so just working my way through the current list.

it doesnt tell me what it is though, just a trojan downloader. started with tthe malwarebytes mentioned above. fingers crossed:thumbs:
 
Don't wipe the hard drive!

Can you remove the hard drive and place it into a 2nd PC as a slave drive and scan it in the 2nd PC?
 
not wiping the hard drive just yet. if it gets that bad i will though. if the drive is messed up enough to need a reinstall, it wouldnt hurt as i would know it is definetly clear then;)

i havent done a reinstall for a few years though, be the 2nd time in 6 years ish
 
Is it showing any other signs of a virus? slow, popups etc?
 
it has gone a little slow on startup, but i think that is avg sorting out what it thinks it is:shrug: and a bit slow opening things up.

so malwarebytes has finished, and found these...
files1.jpg


clicked on the remove button, then told me needed to reboot to remove the others. rebooted and its still there...

this the fourth prog to find it, and not get rid, is it worth anymore or another solution.

thanks for the help so far

btw, it is the druxta thingy which it said i needed to reboot to remove:thumbs:
 
pmjg said:
fletch5,run ccleaner,then if you have xp you will have to disable system restore so the bad file is deleated there,i recomend malwarybytes as a good scanner,and avast 4.8,hopefully these will find and permanently remove,then restart system restore.
Click to expand...

any links to ccleaner or what/where it is??
 
Are you still in safe mode?
 
nope, should i be???

(anything i know about computers is self taught really, not to bad with the stuff i know, but if i havent come across it before i know nothing;))
 
just google ccleaner and you should find it ok, don't think that ccleaner deals with trojans though.
When I had one on my computer all attempts to get rid of it failed until I tried superantispyware.
 
ill avoid if it doesnt deal with trojans then. onto superantispyware it is:thumbs:

should i be running them in safe mode???
 
Yes you should run it in safe mode.
 
ok, any particular reasoning, or one of them things everyone does?
 
In safe mode not all the programs are running. A file being used by windows cannot be deleted.

System Restore should be turned off.
 
If that fails you can delete it manually.
 
all sorted by the looks of it, thanks for all the replies and help:thumbs::notworthy:
 
Good news, but tell us how, for future reference
 
lol. i went into safe mode and ran every antivirus mentioned above one after the other. (along with latest updates), restarted the computer and seen nothing since.

i have spent the last week turning off the 5 different programs and stopping themrunning on startup though:thumbs:
 
You must log in or register to reply here.
Back
Top