HolidayBuyer's Guide

Spyware, Viruses, & Security forum

General discussion

USERINIT.exe application errors...any ideas why?

by bbokor / November 20, 2004 4:01 AM PST

Good Day all

Upon attempting to install Windows SP2 on my DELL Dimension PC, I read the DELL pre-install memo stating to remove any spyware via Ad Aware (or some other program)....running Windows XP Pro.

Upon running Ad Aware, I was asked to reboot my PC to fix errors that could not be fixed without a reboot.

Since that time, Upon reboot, EVERYTIME I get to the blue users logon screen (select which user to log in to), when I click on any user, I get an application error "USERINIT.EXE Application Error (Oxc000000142)."

The pc then loads a blank desktop...when I use the cntrl+alt+del command to log off, I get a similar "TASKMNGR.EXE Application Error (Oxc000000142)."

Then I've got to power down by holding in the power button, restart, F8 to go into safe mode, then use the restore system to an earlier point option.

The FIRST time the PC reboots using the system restore, when I try to logon to one of the users, I get the same error messages as above (USERINIT.exe error followed by TASKMNGR.exe error)

BUT, when I reboot a SECOND time, I can finally get into each specfic users programs....PC works as though nothing is wrong (THANK GOD).

I've run Ad aware, Spybot, and CounterSpy...attached below is the HIJACKthis log file...

HELP....this is driving me MAD....I called DELL service techs....FIRST THING THEY TOLD ME WAS NOT TO INSTALL Windows SP2!

Then they told me this error (userinit.exe) was caused by spyware and it will ALWAYS reside in my pc until I completely clean the hard drive and reinstall Winpows XP PRO...I've got 115 GB on info on PC...so any advice without wiping the drive and starting new would be greatly appreciated!

Thanks in advance!

Brian

Logfile of HijackThis v1.98.2
Scan saved at 2:03:11 PM, on 11/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Sunbelt Software\CounterSpy Client\sunasDTServ.exe
C:\Program Files\Sunbelt Software\CounterSpy Client\sunasServ.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
C:\WINDOWS\FSScrCtl.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Brian Bokor\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [sunasDTServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasDTServ.exe
O4 - HKLM\..\Run: [sunasServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasServ.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Startup: Screen Saver Control.lnk = C:\WINDOWS\FSScrCtl.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Norton System Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: Yahoo! NFL GameChannel StatTracker - http://aud14.sports.yahoo.com/java/y/nflgcst1008_x.cab
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - http://down.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} (alaWeb.clsGetStats) - file://C:\Win2000\Content\cabs\alaWeb.CAB
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://tampabay.mlxchange.com/Control/MultiSelectComboBox.cab
O16 - DPF: {59F156FC-9BC4-11D5-B0A5-0060085A719D} (Opalplayerx5 Control) - http://opal.pascocountyfl.net/permit/opalplayerx5.cab
O16 - DPF: {5D68B82D-C79F-4FFC-83C0-8D0FC794CEF2} (alaWeb.clsGetStats) - file://C:\Win2000\Content\cabs\alaWeb.CAB
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://pubgis.co.pinellas.fl.us/ActiveX/ver6/mgaxctrl.cab
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://tampabay.mlxchange.com/Control/MLXClientUtils.cab
O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemplates/ActiveSecurity.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://tampabay.mlxchange.com/Control/IRCSharc.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://aerial.leepa.org/ecwplugins/ncs.cab
O16 - DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} (alaGrid.TechDocSearch) - file://C:\Win2000\Content\cabs\alaGrid.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab27513.cab
O16 - DPF: {CE74A05D-ED12-473A-97F8-85FB0E2F479F} (dlControl.UserControl1) - http://www.nugs.net/dev/dlControl.CAB
O16 - DPF: {D42ED9FF-DF46-4AD9-A3FE-46BAF896466E} (CountSpies.SpyCounter) - http://www.sunbelt-software.com/dell/CounterSpy.CAB
O20 - AppInit_DLLs: mad.dll

Discussion is locked
You are posting a reply to: USERINIT.exe application errors...any ideas why?
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: USERINIT.exe application errors...any ideas why?
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
USERINIT.exe application errors...any ideas why?
by dawillie / November 20, 2004 4:16 AM PST
Collapse -
Re: USERINIT.exe application errors...any ideas why?
by bbokor / November 20, 2004 4:32 AM PST

dawillie,

Thx for the suggestion!...pls correct if I'm wrong, but according to Kelley-s Corner, it looks like the userinit.exe file is considered a "cabinet file" (?).

If so, I'll need to restore this file from my Windows XP cd...do you know if there is ANY threat of damaging my pc more if I restore a cabinet file from the windows XP cd?

Thank You for your time and your suggestion!

Brian

Collapse -
Re: USERINIT.exe application errors...any ideas why?
by dawillie / November 20, 2004 8:16 AM PST

in a word, no.

that was the repair i was hoping you would not have to do.

Collapse -
Re: USERINIT.exe application errors...any ideas why?
by roddy32 / November 20, 2004 4:19 AM PST

This is a bit over my head so I will yield to one of the experts but I wanted to comment that IF the Dell person meant NOT to install SP2 EVER, they should be fired, If they meant not to install SP2 until you were free of spyware, they were correct. I couldn't figure out by your post which it was.

Collapse -
Re: USERINIT.exe application errors...any ideas why?
by bbokor / November 20, 2004 4:36 AM PST

Roddy32...

The tech SPECIFICALLY told me not to EVER install Windows SP2.

I've spent ump-teen hours on the phone with Dell...they keep blaming the userinit.exe application error on Spyware and have told me that my ONLY solution was to reformat the hard drive and start from scratch!

Not what I expected from Dell support...that's what got me here in the first place!...

Thx for the reply...

Brian

Collapse -
Re: USERINIT.exe application errors...any ideas why?
by roddy32 / November 20, 2004 4:46 AM PST

Hi Brian
I really doubt the Dell company would approve of the way the tech handled the situation. Even if your issue IS caused by spyware which is not yet been determined I don't think the tech should have handled it that way and NOT installing SP2 is certainly not good advice to give a customer.XP SP2 is by far better than XP SP1 or any other Microsoft OS for that matter. There are already viruses out that do NOT affect SP2 machines but DO all others, not to mention the fact the it won't be all that long that you will HAVE to have SP2 even to use Windows Update. I trust that David will figure out your problem and I wish you the best of luck. That sure is not a good advertisment for Dell. The tech probably had a hangover. Hang in there David or someone here will correct your problem.

Collapse -
Re: USERINIT.exe application errors...any ideas why?
by bbokor / November 20, 2004 4:53 AM PST

Thanks for the encouraging words roddy32...I'm hanging in there (by a thread), but when we get to the bottom of this, I'll post my findings.

Enjoy the weekend

Brian

Collapse -
Another suggeston
by roddy32 / November 20, 2004 4:57 AM PST

Bob Proffitt replied to you in another of the CNET Forums that you posted this in Brain. I don't remember which one.

Collapse -
USERINIT.exe application errors...any ideas why?
by dawillie / November 20, 2004 8:22 AM PST

too bad you did not get this clowns name.

this is the sort of poor information that gets ppl into trouble.

Dell assemble their PC's and use MS as the operating system, plus a whole lot of unneccessary junk.

they do not write or maufacture the OS.

that said it looks like you are going to have to extract this *.cab file from your installation disc, or if DEll provided you with one,you will need to use it.

Collapse -
Re: USERINIT.exe application errors...any ideas why?
by bbokor / November 21, 2004 12:51 AM PST

dawillie

agree 100% with the lack of SOFTWARE support from Dell...I have been pleased with the hardware support as they have came sent techs out to the house and replaced drives, etc

But as far as the software knowledge...I've learned more from forums like this.

Thx dawillie...I have been contacted by several other ppl who have the same suggestion that you do (i.e. replace the current userinit.exe file with the one on the windows XP cd), so that will be my next step.

Collapse -
(NT) (NT) TASKMNGR.EXE is usually that trojan.
by R. Proffitt Forum moderator / November 20, 2004 5:02 AM PST
Collapse -
Re: (NT) TASKMNGR.EXE is usually that trojan.
by bbokor / November 20, 2004 5:20 AM PST

Hey Bob,

Thanks again

I'm not 100% positive that the application error I'm getting is "TASKMNGR.exe" or "TSKMNGR.exe"...I don't want to restart to find out because it takes so much to get this blasted thing up and running again.

I will reply when I restart

Thx again

Brian

Collapse -
O20 - AppInit_DLLs: mad.dll
by Marianna Schmudlach / November 20, 2004 5:08 AM PST
Collapse -
Re: O20 - AppInit_DLLs: mad.dll
by bbokor / November 20, 2004 5:21 AM PST

Thx Marianna

I'll read through the link you referred and will reply with any progress / continuing issues.

Thanks for the info!

Brian

Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

The Samsung RF23M8090SG

One of the best French door fridges we've tested

A good-looking fridge with useful features like an auto-filling water pitcher and a temperature-adjustable "FlexZone" drawer. It was a near-flawless performer in our cooling tests.