About userinit.exe
File name: userinit.exe
Publisher: Microsoft Corporation
Digital Signature Party: Microsoft Windows Verification PCA
Startup type: Registry
Path: %system%\\userinit.exe
Location: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\winlogon\\userinit
Description:
Userinit.exe It is a key process of the Windows operating system. Used to manage different boot sequences, such as when building network links and booting Windows shells. Userinit.exe may also be a Trojan horse spoofed by a hacker. The normal Userinit.exe program will automatically disappear after the system is started. If it does not disappear after booting for a long time, it may be a Trojan horse program. When userinit.exe is damaged by virus or the registry key of userinit.exe is modified by virus, Windows system may not log in normally or enter login user name and password. After the system logs out immediately, try to log in again and log out again.
Exceptional userinit
When userinit.exe is replaced by virus, or the normal value of userinit under the HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon key in the registry C:\\WINDOWS\\system32\\UserInit The .exe is modified and the system may be logged in abnormally. The performance is: win login, repeatedly logout, or can not boot to the windows desktop, press ctrl + alt + del, call up the task manager, start explorer.exe through the task manager, but can start to the desktop.
At this time, Jinshan cleaning experts will be detected userinit exception. This is usually not an isolated phenomenon. It is likely to be related to Trojan downloaders, robot dogs, etc., using Jinshan cleaning experts or Kingsoft Internet Security will detect more viruses or Trojans.
Solution:
Jinshan cleaning experts can repair the damage of abnormal userinit registry keys, but you can not repair damaged virus userinit.exe file. Because, Jinshan cleaning experts can not copy the program authorized by the owner of the intellectual property (for Microsoft's "userinit"). Under
this case, we have several ways to fix userinit.exe damaged. If you find this article, you don't need to reinstall the system. By the way, if you fix the abnormal userinit, you should use Kingsoft Internet Security and Jinshan cleaning experts to clean up other malware. Finally fix userinit.exe.
Method 1 from the other normal computer% system% \\ userinit.exe U copied to disk, and then restore the computer to malfunction.
The premise of using this method is that windows can be started, but it is not easy to log in. For example, you can also start explorer.exe through the task manager to display the desktop and then operate.
Method 2, using winpe CD (such as the common tool leaves the mountains CD, ERD emergency CD-ROM, etc.) First Aid
first press the delete key to enter the BIOS, confirm whether the current startup mode The CD is booted. Press "+" "-" to modify the first boot as the CD-ROM drive, and press F10 to save and exit and restart. As shown in the figure:
001.png (13.61 KB)
2008-1-16 12:21
WinPE startup time is longer after reboot, please be patient. As shown in the figure:
002.png (3.3 KB)
2008-1-16 12:21
After entering the WinPE virtual system, find the registry editing tool inside to locate the registry Item: Find the userinit.exe item under [HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options] and delete it. (From the screenshot you can see that the virus hijacking userinit.exe to a file that does not exist will cause the XP system to log out repeatedly.)
003.png (31.05 KB)
2008-1-16 12:21
< BR> This step may not find the userinit.exe project for virus hijacking. Next, locate the registry key [HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon], find the Userinit key value inside, and modify its data. The default value of the system is "C:\\WINDOWS\\ system32\\UserInit.exe," as shown in the figure:
004.png (41.4 KB)
2008-1-16 12:21
Next we need to replace the userinit.exe file in the WinPE disk with the file in the system directory to ensure that the file is not modified by the virus. The method is to browse the CD-ROM to find the system32 directory under the I386 directory, right-click the userinit.exe file and select "Copy to", the default path X:\\windows\\system32 input dialog box (X is the system drive letter, usually C drive) As shown in the figure:
005.png (51.34 KB)
2008-1-16 12:21
If there is a userinit.exe file in the system directory, the following prompt will appear. It is recommended to click "Yes" to avoid the previous file being modified by the virus. As shown in the figure:
006.png (42.47 KB)
2008-1-16 12:21
When the registry modification and file replacement are completed, restart the computer, and the phenomenon of repeated logout is Can be solved. (Pay attention to take out the WinPE CD to avoid repeatedly entering the WinPE system)
Method 3, use the windows installation CD, boot the system to the recovery console, and then restore userinit.exe from the installation disk
About windows For the use of the recovery console, refer to here: www.45it.com/Article/pcedu/Window/windowszh/200512/2972.htm, this article selects some of the key content of this article.
windows mounted disc
guided to the R, select the boot recovery console
If the two systems, two windows are displayed paths, selected from A correct one is fine. You need to enter the administrator password. This password should be clear to the person who installed the system. If you don't know, try to press Enter directly. It is estimated that many people are empty passwords.
Execute expand D:\\i386\\USERINIT.EX_ C:\\windows\\sytem32\\USERINIT.EXE (Here it is assumed that D is the CD-ROM drive letter, your system is installed in the c drive windows directory.)
< BR> The file provided at the end of this article is winxp's userinit.exe (can be downloaded directly to down.45it.com). If you can't find the normal file replacement, download one directly to the windows\\system32 directory of the faulty computer. Cover damaged files.