Startup File Missing

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

I was hoping someone could help me who has seen this problem before.

When any user logs on, after loading the user's setting, I see an error
message stating the following
"Cannot find C:\Windows\userint32.exe ... etc". This file does not exist on
my C: drive. I've tried to search the internet and newgroups for help, but
I've found nothing related to this problem.

Everything appears to run OK after the message appears.

Note: As you probably guessed, this problem began after the removal of some
malware and a nasty liitle worm virus called "W32.Allim". I was able to rid
the computer of the virus, and have run multiple scans in the safe mode -
everything looks good except for the message above.

jt
4 answers Last reply
More about startup file missing
  1. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Hi,

    The registry is damaged. Userint32.exe is not a windows file, but rather
    something that was designed to look like one. The closest real file is
    userinit.exe. Start/run regedit, then click edit/find and scan for
    uerint32.exe. Post back with the keys you find it in.

    --
    Best of Luck,

    Rick Rogers, aka "Nutcase" - Microsoft MVP
    http://mvp.support.microsoft.com/
    Associate Expert - WindowsXP Expert Zone
    www.microsoft.com/windowsxp/expertzone
    Windows help - www.rickrogers.org

    "Foge" <jtfogarty@knology.net> wrote in message
    news:eoOgoRNWFHA.2984@tk2msftngp13.phx.gbl...
    >I was hoping someone could help me who has seen this problem before.
    >
    > When any user logs on, after loading the user's setting, I see an error
    > message stating the following
    > "Cannot find C:\Windows\userint32.exe ... etc". This file does not exist
    > on my C: drive. I've tried to search the internet and newgroups for help,
    > but I've found nothing related to this problem.
    >
    > Everything appears to run OK after the message appears.
    >
    > Note: As you probably guessed, this problem began after the removal of
    > some malware and a nasty liitle worm virus called "W32.Allim". I was able
    > to rid the computer of the virus, and have run multiple scans in the safe
    > mode - everything looks good except for the message above.
    >
    > jt
    >
  2. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    http://forums.spywareinfo.com/lofiversion/index.php/t48096.html

    instructions re HijackThis
    Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
    http://mvps.org/winhelp2002/unwanted.htm


    "Foge" <jtfogarty@knology.net> wrote in message
    news:eoOgoRNWFHA.2984@tk2msftngp13.phx.gbl...
    >I was hoping someone could help me who has seen this problem before.
    >
    > When any user logs on, after loading the user's setting, I see an error message
    > stating the following
    > "Cannot find C:\Windows\userint32.exe ... etc". This file does not exist on my C:
    > drive. I've tried to search the internet and newgroups for help, but I've found
    > nothing related to this problem.
    >
    > Everything appears to run OK after the message appears.
    >
    > Note: As you probably guessed, this problem began after the removal of some malware
    > and a nasty liitle worm virus called "W32.Allim". I was able to rid the computer of
    > the virus, and have run multiple scans in the safe mode - everything looks good
    > except for the message above.
    >
    > jt
    >
  3. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    "Rick "Nutcase" Rogers" <rick@mvps.org> wrote in message
    news:uVEc1yOWFHA.2520@TK2MSFTNGP09.phx.gbl...
    > Hi,
    >
    > The registry is damaged. Userint32.exe is not a windows file, but rather
    > something that was designed to look like one. The closest real file is
    > userinit.exe. Start/run regedit, then click edit/find and scan for
    > uerint32.exe. Post back with the keys you find it in.
    >
    > --
    > Best of Luck,
    >
    > Rick Rogers, aka "Nutcase" - Microsoft MVP
    > http://mvp.support.microsoft.com/
    > Associate Expert - WindowsXP Expert Zone
    > www.microsoft.com/windowsxp/expertzone
    > Windows help - www.rickrogers.org
    >
    > "Foge" <jtfogarty@knology.net> wrote in message
    > news:eoOgoRNWFHA.2984@tk2msftngp13.phx.gbl...
    >>I was hoping someone could help me who has seen this problem before.
    >>
    >> When any user logs on, after loading the user's setting, I see an error
    >> message stating the following
    >> "Cannot find C:\Windows\userint32.exe ... etc". This file does not exist
    >> on my C: drive. I've tried to search the internet and newgroups for help,
    >> but I've found nothing related to this problem.
    >>
    >> Everything appears to run OK after the message appears.
    >>
    >> Note: As you probably guessed, this problem began after the removal of
    >> some malware and a nasty liitle worm virus called "W32.Allim". I was able
    >> to rid the computer of the virus, and have run multiple scans in the safe
    >> mode - everything looks good except for the message above.
    >>
    >> jt
    >>

    Thank you for your reply(s).

    Ran HijackThis and found said entry. Delete the entry and "it's all good,
    again". Thank you!
    I included the HijackThis report below for your review.

    Logfile of HijackThis v1.99.1
    Scan saved at 4:24:47 PM, on 5/15/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Microsoft IntelliType Pro\type32.exe
    C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\John\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    http://yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
    Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
    Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
    Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
    C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType
    Pro\type32.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
    Files\Java\j2re1.4.2_06\bin\jusched.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel -
    res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
    D:\PROGRA~1\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -
    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
    Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
    C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
    Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
    Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel
    32\IDriverT.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program
    Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec
    Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
    Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton
    AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
    C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
    Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
    Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  4. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Hi,

    Good. The rest of that log looks fine.

    --
    Best of Luck,

    Rick Rogers, aka "Nutcase" - Microsoft MVP
    http://mvp.support.microsoft.com/
    Associate Expert - WindowsXP Expert Zone
    www.microsoft.com/windowsxp/expertzone
    Windows help - www.rickrogers.org

    "Foge" <jtfogarty4@yahoo.com> wrote in message
    news:uF36txYWFHA.2960@TK2MSFTNGP15.phx.gbl...
    > "Rick "Nutcase" Rogers" <rick@mvps.org> wrote in message
    > news:uVEc1yOWFHA.2520@TK2MSFTNGP09.phx.gbl...
    >> Hi,
    >>
    >> The registry is damaged. Userint32.exe is not a windows file, but rather
    >> something that was designed to look like one. The closest real file is
    >> userinit.exe. Start/run regedit, then click edit/find and scan for
    >> uerint32.exe. Post back with the keys you find it in.
    >>
    >> --
    >> Best of Luck,
    >>
    >> Rick Rogers, aka "Nutcase" - Microsoft MVP
    >> http://mvp.support.microsoft.com/
    >> Associate Expert - WindowsXP Expert Zone
    >> www.microsoft.com/windowsxp/expertzone
    >> Windows help - www.rickrogers.org
    >>
    >> "Foge" <jtfogarty@knology.net> wrote in message
    >> news:eoOgoRNWFHA.2984@tk2msftngp13.phx.gbl...
    >>>I was hoping someone could help me who has seen this problem before.
    >>>
    >>> When any user logs on, after loading the user's setting, I see an error
    >>> message stating the following
    >>> "Cannot find C:\Windows\userint32.exe ... etc". This file does not exist
    >>> on my C: drive. I've tried to search the internet and newgroups for
    >>> help, but I've found nothing related to this problem.
    >>>
    >>> Everything appears to run OK after the message appears.
    >>>
    >>> Note: As you probably guessed, this problem began after the removal of
    >>> some malware and a nasty liitle worm virus called "W32.Allim". I was
    >>> able to rid the computer of the virus, and have run multiple scans in
    >>> the safe mode - everything looks good except for the message above.
    >>>
    >>> jt
    >>>
    >
    > Thank you for your reply(s).
    >
    > Ran HijackThis and found said entry. Delete the entry and "it's all good,
    > again". Thank you!
    > I included the HijackThis report below for your review.
    >
    > Logfile of HijackThis v1.99.1
    > Scan saved at 4:24:47 PM, on 5/15/2005
    > Platform: Windows XP SP2 (WinNT 5.01.2600)
    > MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    >
    > Running processes:
    > C:\WINDOWS\System32\smss.exe
    > C:\WINDOWS\system32\winlogon.exe
    > C:\WINDOWS\system32\services.exe
    > C:\WINDOWS\system32\lsass.exe
    > C:\WINDOWS\system32\Ati2evxx.exe
    > C:\WINDOWS\system32\svchost.exe
    > C:\WINDOWS\System32\svchost.exe
    > C:\WINDOWS\system32\spoolsv.exe
    > C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    > C:\Program Files\Norton AntiVirus\navapsvc.exe
    > C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    > C:\Program Files\Norton AntiVirus\SAVScan.exe
    > C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    > C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    > C:\WINDOWS\System32\svchost.exe
    > C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    > C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    > C:\WINDOWS\system32\Ati2evxx.exe
    > C:\WINDOWS\Explorer.EXE
    > C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    > C:\Program Files\Microsoft IntelliType Pro\type32.exe
    > C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
    > C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    > C:\WINDOWS\system32\wuauclt.exe
    > C:\Program Files\Outlook Express\msimn.exe
    > C:\Program Files\Messenger\msmsgs.exe
    > C:\Documents and Settings\John\Desktop\HijackThis.exe
    >
    > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    > http://yahoo.com/
    > R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    > O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    > D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    > O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
    > Files\Spybot - Search & Destroy\SDHelper.dll
    > O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
    > Files\Norton AntiVirus\NavShExt.dll
    > O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
    > Shared\ccApp.exe"
    > O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
    > C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    > O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType
    > Pro\type32.exe"
    > O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
    > Files\Java\j2re1.4.2_06\bin\jusched.exe
    > O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
    > C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    > O8 - Extra context menu item: E&xport to Microsoft Excel -
    > res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    > O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
    > D:\PROGRA~1\aim.exe
    > O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
    > C:\Program Files\Messenger\msmsgs.exe
    > O9 - Extra 'Tools' menuitem: Windows Messenger -
    > {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
    > Files\Messenger\msmsgs.exe
    > O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
    > O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
    > C:\WINDOWS\system32\Ati2evxx.exe
    > O23 - Service: ATI Smart - Unknown owner -
    > C:\WINDOWS\system32\ati2sgag.exe
    > O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
    > C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    > O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
    > Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    > O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
    > Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    > O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
    > Corporation - C:\Program Files\Common
    > Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    > O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program
    > Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    > O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec
    > Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    > O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
    > Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    > O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton
    > AntiVirus\SAVScan.exe
    > O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
    > C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    > O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
    > Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    > O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
    > C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    > O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
    > Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    >
    >
Ask a new question

Read More

Windows XP