Which Forum ? Mlwarebytes reports userinit.exe infected

[Mel_3]

I'm guessing this may not be the right forum so if not would someone be kind enough to direct me to the proper one as all the forum titles get confusing... I have Malwarebytes Free... and am not sure what Hijack This is...

My probjem:

- I ran the latest Malwarebytes on my Windows XP-Pro on Friday night. I had all the Malware bytes updates downloaded and installed.

- Malwarebytes reported c:\windowssystem32\userinit.exe is infected with the trojan Downloder.Agent.ATHF

- Malwarebytes also reported two registery keys with Trojan Downloader...

at... HKEY_Local_Machine\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Useinit

Data:system32\userinit.exe

Data: c:\windows\system32\userinit.exe

How can I remove this virus with out completely reinstalling Windows XP-Pro and having to reinstall all applications?

I read somewhere to replace userinit.exe from the XP disk... but then what about the registry keys?

Thanks for any help on this.

[AdvancedSetup]

Hello and Welcome to Malwarebytes.org

Please read and follow the instructions provided here: I'm infected - What do I do now?

Someone will be happy to assist you further with cleaning your system if required

During this scan and cleanup process you should not install any other software unless requested to do so.

[Gardien]

I have this exact same problem. MWB removal claims to be successful, but this problem never goes away. Can I delete the userinit.exe files that MWB detected to be infected with a Trojan?

Thanks.

[AdvancedSetup]

NO - DO NOT delete the file. MBAM is flagging it and basically you need special handling to correct this. If you delete the file you will no longer be able to logon to Windows.

Please post your logs as suggested and try to be patient and wait for assistance. The site is VERY busy so it may take some time before someone can assist you.

[cja]

Was there a solution to this? I need to replace userinit.exe and could do with a procedure to follow.

NO - DO NOT delete the file. MBAM is flagging it and basically you need special handling to correct this. If you delete the file you will no longer be able to logon to Windows.

Please post your logs as suggested and try to be patient and wait for assistance. The site is VERY busy so it may take some time before someone can assist you.

[cja]

(This post is to turn on notifications, which I forgot to do in the previous one.)

Was there a solution to this? I need to replace userinit.exe and could do with a procedure to follow.

[AdvancedSetup]

Scan and post logs - read note at bottom in green

If you're having Malware related issues with your computer that you're unable to resolve.

1. Please read and follow the instructions provided here: I'm infected - What do I do now?
2. If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
   
3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.
   

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review
  

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.