Windows Legacy OS

General discussion

userinit.exe disaster - how to fix?!

by GusGusGus / March 23, 2008 9:49 PM PDT

I did an AVG Rootkit scan which turned up "c:windows/system32/userinit.exe" as a dodgy file.
I removed it and now the machine won't login when I boot the system. With a bit more digging it seems that this file was actually the login information within the registry and as it can't find a valid user/password it just keeps asking me click the user name and login.
When I click it just loops back and throws back up the window, asking me to click the user name again.
I suspect that the AVG Rootkit gave me a "false positive" and this wasn't a rootkit after all.
Is there a simple way I can access the registry and reset the userinit.exe file?
I've tried selecting "last good configuration" which didn't work.
I also tried to download Bart PE on another machine (running Vista) to set up a boot CD, but it wasn't particularly clear how to go about it, so I tried using the XP System Recovery app on the install disks. This got me into a C: prompt, but couldn't figure out how to get regedit going (i was going to simply try reseting the registry value for the login)
Is there a way to open a list of configurations, so I can go to the previous config to that one? For obvious reasons I'd prefer to avoid reinstalling XP and losing all my data.
The crashed PC is in another location, which I won't be visiting for another week or so, so in the meanwhile, any tips would be hugely appreciated! Will post how I fare once I manage to have another go at fixing it.

Cheers,
Gus

Post a reply
Discussion is locked
You are posting a reply to: userinit.exe disaster - how to fix?!
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: userinit.exe disaster - how to fix?!
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Last time I fixed that I...
by R. Proffitt Forum moderator / March 23, 2008 10:10 PM PDT

Performed what is called a XP REPAIR INSTALL.

It normally does not wipe out the machine and I don't write the instructions here. Just ask google about XP REPAIR INSTALL.
Bob

Collapse -
userinit.exe disaster - how to fix?!
by aznsstealer3 / May 20, 2008 3:23 PM PDT

hey, i also have the same problem on a laptop right now with windows xp home edition. while trying to remove viruses, the "userinit" file was deleted. how did you eventually fix it? i really need help with this! thanks in advance

Collapse -
No Expert, But I Would Try Bob's...
by tobeach / May 20, 2008 4:14 PM PDT

idea of a "repair install" hopefully from your original OS CD. You may have a separate partition that contains this info if Factory never supplied a CD.
As stated, the BIG advantage is you don't lose all your existing data/files etc. Basically, it just overwrites you current XP with original system files & default settings. Not as clean as an Format & re-un-install but keeping your files might be paramount for you.

Additionally, after the repair install, you could, if you like/want, off load all your important stuff to a CD/DVD/USB Flash drive, THEN do format& new clean install and feed back in your valuables.

Remember, if you do a format &install, you want to secure ALL your various drivers for MB/audio/video/printer etc. OFF the machine also as these usually are not MS drivers. They maybe on original install disks or may be downloaded from manufacturers sites. It is also an opportunity to update your drivers to latest for each.Good Luck!! Happy

Collapse -
recovery console
by aznsstealer3 / May 21, 2008 5:03 AM PDT

i just tried the repair install and it seems that the proper userinit file was not replaced. it is sitting in the recyle bin, but i cannot restore it the normal way without logging in. is there a way to restore the recycle bin using recovery console?

Collapse -
Recovery Console
by SuperMA5TER / May 21, 2008 5:29 AM PDT
In reply to: recovery console

When in recovery console with your XP installtion disc in the drive, type the following on the command prompt:
expand userinit.ex_ userinit.exe
then type exit to restart your computer.

Collapse -
tryied the command
by aznsstealer3 / May 21, 2008 6:11 AM PDT
In reply to: Recovery Console

i tried the command "C:\windows>expand userinit.ex_ userinit.exe and it gave me the message "The system cannot find the file or directory specified."

Collapse -
Oh
by SuperMA5TER / May 21, 2008 6:13 AM PDT
In reply to: tryied the command

Not from c:\windows.
Go to <cd drive letter>:\i386\ and type it there.
Hope it will solve your problem

Collapse -
how to
by aznsstealer3 / May 21, 2008 6:19 AM PDT
In reply to: Oh

i really have no experience with the recovery console, how exactly do i change from the original command they give me "C:\windows>" to the drive letter?

Collapse -
Step by Step
by SuperMA5TER / May 21, 2008 6:23 AM PDT
In reply to: how to

Ok you are in C:\Windows. Now lets suppose that your CD drive letter is d:
So here is what you type.
d:
cd i386
expand userinit.ex_ userinit.exe

If it shows a message like 1 file expanded or copied then type Exit and restart.

Collapse -
access denied
by aznsstealer3 / May 21, 2008 6:30 AM PDT
In reply to: Step by Step

i followed those steps and got the message "access denied" though i may have to find out if the cd-rom drive is named something else

Collapse -
CD drive letter
by SuperMA5TER / May 21, 2008 6:39 AM PDT
In reply to: access denied

Your CD drive letter will be the same as it was when your Windows were running fine.

Collapse -
a problem
by aznsstealer3 / May 21, 2008 6:45 AM PDT
In reply to: CD drive letter

the problem is that the laptop is my friends and i was given it to try and fix. is there any other way to find out the right drive name?

Collapse -
LOL
by SuperMA5TER / May 21, 2008 6:49 AM PDT
In reply to: a problem

Ok then just keep trying the steps I told replacing d with e,f,g,h and so on until one of them works.

Collapse -
something wrong
by aznsstealer3 / May 21, 2008 6:59 AM PDT
In reply to: LOL

something that bothers me though is that i did a system repair install and it should have repaired the userinit.exe file, but i still cannot log in. is there a way to make a pertition that would have a non corrupt userinit.exe file then log in using the new partition and recover files or recover the original userinit.exe file sitting in the recycle bin?

Collapse -
YOUR INSTRUCTIONS ARE WRONG
by Jaegar-Croft / January 31, 2009 11:10 AM PST

The advice you have been giving to fix this problem is wrong, that is why people have been having so much trouble with this VERY SIMPLE FIX.

Your Advice messages listed below are all wrong :

Recovery Console
by SuperMA5TER - 5/21/08 12:29 PM In reply to: recovery console by aznsstealer3

When in recovery console with your XP installtion disc in the drive, type the following on the command prompt:
expand userinit.ex_ userinit.exe
then type exit to restart your computer.

-------------------------------------------------------

Oh
by SuperMA5TER - 5/21/08 1:13 PM In reply to: tryied the command by aznsstealer3

Not from c:\windows.
Go to <cd drive letter>:\i386\ and type it there.
Hope it will solve your problem


----------------------------------------------------------


Step by Step
by SuperMA5TER - 5/21/08 1:23 PM In reply to: how to by aznsstealer3

Ok you are in C:\Windows. Now lets suppose that your CD drive letter is d:
So here is what you type.
d:
cd i386
expand userinit.ex_ userinit.exe

If it shows a message like 1 file expanded or copied then type Exit and restart.


----------------------------------------------------------


THE REAL WAY TO FIX THIS PROBLEM IS TO DO THE FOLLOWING:

1. Insert the original Windows XP CD (Windows XP with Service Pack 2 is preferred, but not required) and reboot the computer. You may need to configure your computer to boot from the CD-ROM drive.
2. When the Windows XP Setup has started, press "R" to "repair the Windows XP installation using Recovery Console".
3. Select the Windows installation to repair (generally this is C:\Windows) by typing its number and then pressing ENTER.
4. Type the Administrator password and press ENTER.
5. Type the following commands:

D: [ENTER]
CD I386 [ENTER]
EXPAND USERINIT.EX_ C:\WINDOWS\SYSTEM32 [ENTER]

NOTE: If your CD-ROM drive has a different letter assigned to it, enter "X:" instead, where X is the appropriate drive letter.

After entering "EXPAND USERINIT.EX_ C:\WINDOWS\SYSTEM32" you should see the text "1 file(s) copied", in which case all went well.

Remove the Windows XP CD, type "EXIT" and press ENTER to restart your computer. You should now be able to log on as normally.

Collapse -
Access Denied
by trexmgd / February 13, 2009 12:59 AM PST

I tried your updated/corrected instructions and I get "Access Denied" when I type the expand line command.

Ideas?

Collapse -
Recovery Console (Access Denied)
by PacB / February 18, 2009 2:52 AM PST
In reply to: Access Denied

Has anyone replied to this thread?

I too received an ?Access Denied? response and hence can not expand the userinit.ex_ file. I am running XP Home, booted off the reinstallation CD, logged in as administrator (no password, just hit enter) and tried to expand and or copy the file to the SYSTEM32 folder. What?s the fix here??

Thanx

Collapse -
New day, new pests. Just sharing.
by R. Proffitt Forum moderator / February 18, 2009 2:56 AM PST

I ran into that access issue and it took a short while to figure it out.

It appears that pest or malware had changed ownership of C:\Windows and many other files. I used this article to make things proper and then it worked. HOWEVER I'm sure someday even that won't work as the pests are getting more virulent.

-> http://support.microsoft.com/kb/308421

Collapse -
Access Denied
by PacB / February 18, 2009 3:10 AM PST

Thank you for the response?

However, as indicated on previous threads, I can not login /boot even in safe mode. I can boot form the CD and log in as administrator. I followed your link but it really discusses ways of changing access privileges within a windows environment. How do I do this from a command prompt?

Thanx?

Collapse -
With the command line.
by R. Proffitt Forum moderator / February 18, 2009 3:24 AM PST
In reply to: Access Denied
Collapse -
Access Denied 1
by PacB / February 18, 2009 3:32 AM PST
In reply to: With the command line.

Thank you for your response, I will take a look at the links.

... Something I tried this morning:

Since I could not copy or access the userinit.ex_ file on my home computer (infected computer) I brought the installation CD to work, copied the userinit.ex_ file to a folder expanded it and then burned this to a CD. Tonight I will try and copy it from the CD to the SYSTEM32 folder. Will this work?

Btw? when I expanded the file on my work computer, it appeared successful however, I noticed the larger file is still named userinit.ex_ it did not become a .exe is this proper?

Collapse -
Well we could boot Linux.
by R. Proffitt Forum moderator / February 18, 2009 4:57 AM PST
In reply to: Access Denied 1

Linux LIVECDs do not require an install and I can copy files from some USB stick to the hard disk.

I have NOT reviewed your issue about said trojan damage. I am only giving you what I recently ran into and how I resolved it.

-> You must be sure you are curing this pest proper. If you are unsure, post in our SPYWARE FORUM.
Bob

Collapse -
Try this
by SlipperyKilla / March 19, 2009 7:21 PM PDT
In reply to: Access Denied

When I first tried it I got the "Access Denied" message but it turns out that when i typed in this part below

EXPAND USERINIT.EX_ C:\WINDOWS\SYSTEM32 [ENTER]

I didn't leave a space in between the _ and the C:\ so make sure there is a space there and it should work for you! I know it worked for me, and it took me 4 hours of trying until I saw that post. Good Luck!

Collapse -
it worked!!
by SlipperyKilla / March 19, 2009 7:16 PM PDT

Thank you very very much for posting this Jaegar-Croft, it took me 4 hours until I saw your post about this and tried it to finally get my computer working right again!

Collapse -
message says there is no floppy or cd in drive
by mayzer05 / December 28, 2009 2:23 AM PST

I did exactly as you said , except used e: for my drive and get message there is no floppy disk or cd in the drive, my win xp install cd is in drive e. what can i do to get it to recognize cd.

Collapse -
I suceedet to fix the same problem!!!
by gpetrov_98 / March 9, 2009 4:20 AM PDT

Hello, I had the same problem. My NOD32 displayed a message that it has found a virus in Userinit.exe and I confirmed the action "delete". Next time I tried to log on, I was unable to. Then I remembered, that my NOD has deleted this file, and what I did later, helped me to restore my Windows back, without re-installing it!
I have created the same users, with the same passwords (even the same pictures) on my laptop. Then I have copied the file "userinit.exe" on a CD and after that I have copied it in the folder, where the old file was (C:/WINDOWS/system32)
It worked!
Hope to help!

Popular Forums
icon
Computer Help 47,885 discussions
icon
Computer Newbies 10,322 discussions
icon
iPhones, iPods, & iPads 3,188 discussions
icon
Security 30,333 discussions
icon
TVs & Home Theaters 20,177 discussions
icon
HDTV Picture Setting 1,932 discussions
icon
Phones 15,713 discussions
icon
Windows 7 6,210 discussions
icon
Networking & Wireless 14,510 discussions

Tech Tip

Know how to save a wet phone?

It's not with a dryer and it's not with rice. CNET shows you the secret to saving your phone.