password stealer
sandeep chandu
The userinit.exe process is executed by windows when you log on to your computer. It will run various network and user-setup related tasks to initialise your session on the computer/network. You should leave this process running to ensure that you are logged on correctly.
Steven Hyde (weitere Infos)
Steven Hyde is right, normally it's not an issue. “The userinit.exe process is executed by windows when you log on to your computer. It will run various network and user-setup related tasks to initialise your session on the computer/network. You should leave this process running to ensure that you are logged on correctly. ***FOLLOW THE LINK*** (It's possible userinit could be a Trojan too.)”
Jonathan Mann
Do not remove. Its part of the windows logon process, on Windows Server 2003, removal of this program will result in you not being able to log in to your computer at all. I have seen spyware vendors advertising this program as a trojan or spyware. I would seriously second guess what is being said in order to get people purchasing spyware.
Codah
It is an essential part of Windows OS and is safe to leave it alone unless it is hooked in the registry to run extra files which are trojans. It can hooked in the registry to run gpmiabp.exe which executes a trojan horse Win32.Qoologic. If you see in the Security Task Manager Userinit.exe,gpmiabp.exe or something added to the Userinit.exe then it is hooked through the registry to run malicious files.
John
I believe there are malware programs that use this file.It started to initialize about the same time I had unauthorized dialups that I had to terminate by unplugging my modem's phone line.Two unauthorized programs were on my computer at that time....Metacrawl toolbar and Yazzle (which I stopped from auto- installing) I have had Trend Micro program block and blacklist userinit on startup, with no adverse effect on network signin or any other programs I use.
John Lawrence
Userinit.exe in the system32 folder is necessary to log on to your computer, however it could be replaced by a userinit.exe in a different folder. Could it be used to start the virus when you log on or boot the computer?
On w2k machine, runs as Aserinit.exe, the A beeing alt+0197 sign. Takes 100% CPU. Can be killed in the Taskmanager. I can't find a remedy. I uppose it is a trojan which renamed the userinit. Impossible to find in the registry
Robert
It is a windows logon app. It should terminate on its own shortly after windows has loaded. I recomend that it not be removed. Microsoft says that the file can be deleted by spywares. If you suspect this, you will have to reinstall it from a XP install CD by expanding the file that is on the CD.
Courtney
it is an essential for windows. sometimes kaspersky antivirus recognises it as athreat and if you delete it then you will be stuck at the logon screen and you wont be able to start your session even in the safe mode. i had to format thrice and the same happened when i deleted the file
ron
Yes it is a normal Microsoft BUT it can run things you don't need. In my case it will run Script Logic which if I let that run my PC's policy will be scewed - no more control panel and other things. There is more detail of my situation but just realize userinit exe can run anything else it wants.
David Norris
For hte people who say that it makes htem loose connection: Its because of the nature of hte program... It does nothing harmful unless one of a various types of virus attaaches itself to it... If you see hte program running longer then 5 seconds after start-up then end it immediatly and get a better anti virus.
Ohjeez
without this file you cannot logon to windows xp, do NOT delete; I have anti-virus software that deleted this file, and I still couldn't fix the problem using the Recovery Console off the my Windows CD-ROM, any help would be appreciated
John C. (weitere Infos)
It depends on its size. If its around 24kb its system file if it is larger, say around 100kb it could be malware and you should copy file from i386 and replace file in system32 folder if you have problems starting computer. You will have to rename existing file in system32 first.
Gary
If your AV or antispyware report it wrong size or suspicious, scan it here: http://www.virustotal.com/ - do not delete it at first glance. You may have troubles with your OS. It should be located in C:\windows\system32\ by default. If location is different pay attention.
Italian IT Helper (weitere Infos)
On my system it was infected. I found out by right clicking on the file to see it's version. It was NOT a microsoft file, so I knew it had been hijacked. I simply renamed my file, and the microsoft operating system replaced it with the correct version in a matter of minutes.
mitchd123
whenever i log on the process userinit.exe starts and it gives me some warning saying your computer is not safe and takes me to download some fake spywares from the internet, my spyware is detecting it as a trojan and it is in the hkey in the registry so i am not sure what to do
worried
usereinit.exe is part of windows but game thief r WOW have reverse engineered this file & if it makes way to your pc can be malicious. It will capture all usernames & passwords & mail it to a centralised server location where hackers can go pick up your sensitive info. Also check the modified date of this file in explorer. If it was modified after 2004 there is a high change the virus has got you. download the original file from your windows cd & restore it to your C drive to get rid of the virus. make sure you have closed all internet programs for the operation.
Mubasher Khawaja
I use Wildblue security software...it blocks userinit.exe everytime I boot with no adverse effects. I did search the file and found it in the system 32 folder. The size is 24.0 KB (24,576 bytes), from what I've read about it, if it's larger that 24K, it's probably been infected. But I'm not on a network and I don't lock myself out of my PC, so that my be why I don't have any problem blocking it.
rick
I just had it replaced by a trojan.the original one is easy to spot because if you highlight userinit file and go to properties it will give a description of the file and who manufactured it but the trojan one did not have any of this information,it just had dashes after the description and manufacturer.Also the original is usually about 25-26kb when it is replaced mine was 48kb
Richie
there are many viruses that mainly work through userinit.exe. You can know when you have a problem if userinit.exe does not dissapear from task manager 20'' after you log in your computer or if the file itself is bigger than ~30KB. This file will prevent you from using safe mode and slowly kill your computer. You have to log on safe mode, select "Administrator" account and then you will notice that nothing happens. Press alt+cntrl+delete and you will notice that userinit.exe is bugged and still running. Close it and go to File- Run and type explorer.exe. Then you will be successfully logged in
Dexter
Then go to windows/system32/ and delete userinit.exe. Then the system will tell you that you just deleted an important file and that you have to insert SP2 or SP3 cds to repair. DO NOT RESTART YOUR COMPUTER AT THIS POINT. Insert the corresponding service pack cd and it will repair it itself. You are now free from this virus.
Dexter
In Vista I have in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon a key Userinit with value C:\Windows\system32\userinit.exe which seem to be ok, but in Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run I had a key userinit with value c:\users\i\appdata\roaming\twext.exe I deleted this.
Gottfried Forstner
There is a legitimate file named userinit.exe and if it starts on its own with no action taken by you, more than likely it is the legitimate file. However, at some point a trojan or or nasty could get on your system somehow and if it is added to the start menu startup folder or somehow requires you to say ok to start then you most likely have a problem.
Use your head.
All those who rated this a 1 are right!! Read their Posts again. Next, be sure you have the Filename right. Some Worms use very similar names. userinit.exe is necessary to run Windows XP. Goto C:\WINDOWS\system32 and find it, Right Click and choose Properties. Click the Version Tab and you should see that the Company is Microsoft and the File Version matches your Patch Level. If it does LEAVE IT ALONE!! If not run System File Checker and let it replace the file: sfc /scannow in the Run Dialog Box.
Microsoft Certified
Userinit.exe IS a vital part of the OS, however, if you are infected with a virus it attaches itself to Userinit.exe to run in stealth. Typically it disables your firewall and task manager. Observe your processes through you're internet security program to see if it is running after logon- if it is, then you have a virus. DON'T DELETE IT OR YOU WILL NOT BE ABLE TO LOGON. Unplug ethernet cable, use safe mode and run your cleaning tool (registry too). Also, configure your security so that it doesn't run on startup because it's only an app that is accessed very briefly and doesnt need to "run".
Victim of "Userinit.exe"
the userinit prevents my pc from loading the taskbar and icons. the only thing i can see is the wallpaper. I get around this by running explorer.exe through task manager. It doesn't restrict my internet access, but it prevents me from anything related to stopping this virus. I can't even install avira, what can I do?
ShootPointBlank
Encountered the same error and I can't logon to Windows. What I did was CTRL+ALT+DEL, Task Manager, click New Task and typed Control Panel on the Run command prompt. After which, Windows already displayed desktop. Problem is, Network IPs were reset.
Rhyam Dale
Dateidetails Dateipfad: C:\WINDOWS\system32 \ userinit.exe Dateidatum: 2002-08-29 14:00:00 Version: 5.1.2600.1106 Dateigröße: 22.528 Bytes Prüfsumme und Datei-Hashwerte CRC32: 1C9570DC MD5: BEBD 3F08 461F 9A88 E5AB CE0C B970 7000 SHA1: 55E8 15C5 ECE5 8884 B88D 80C4 9BD6 2D6C 6AF6 8C99 Versions-Informationen Firmenname: Microsoft Corporation Datei-Beschreibung: Userinit-Anmeldeanwendung Datei-Betriebssystem: Windows NT, Windows 2000, Windows XP, Windows 2003 Datei-Typ: Application Datei-Version: 5.1.2600.1106 Interner Name: userinit Copyright: � Microsoft Corporation. Alle Rechte vorbehalten. U
100% NECESSARY! However easily infected BECAUSE it's not always running. If you remove the userinit.exe file, your logins will fail. You will go to log into windows and you will get logged off immediately. The userinit.exe file only runs to log you in and then stops therefore being completely vulnerable to malware. The ONLY location for the userinit.exe file is windows\system32. If it's anywhere else, delete it. The registry key: HKLM \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon contains a string called Userinit and it points to C:\windows\system32\userinit.exe.
PCFixerGuy (weitere Infos)
Be warned because there is a virus or malware named userini.exe that will create up to 3 processes in the task manager. All of these will go from 0% to 100% of your CPU. Be careful as my computer was blocked from moving, always hanging. Now i am using a temporary.. SAFE SURFING
Another victim with another problem
Firewall so einstellen, dass Internet Zugang gesperrt wird. Der Staatsschutz verschafft sich mit diesem DL Zugang zum PC
