userinit.exe

[jhill]

Today Malwarebytes keeps identifying the following file as infected (from the log):

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.PWS) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.PWS) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

Each time I have removed it, and it comes back. I uploaded the userinit.exe file to kaspersky online virus test which passed it, and my antivira software says it is a clean file.

Is this a false positive or do I need to do something else?

thanks.

[whatmeworry?]

The best place to ask questions and seek answers about false positives in the False Positives section, not this one. I think you'll find your answer there.

[jhill]

so it would seem!

it was the first topic.

thank you.