Sign in with
Sign up | Sign in
Your question

Startup File Missing

Last response: in Windows XP
Share
Anonymous
May 14, 2005 10:30:00 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

I was hoping someone could help me who has seen this problem before.

When any user logs on, after loading the user's setting, I see an error
message stating the following
"Cannot find C:\Windows\userint32.exe ... etc". This file does not exist on
my C: drive. I've tried to search the internet and newgroups for help, but
I've found nothing related to this problem.

Everything appears to run OK after the message appears.

Note: As you probably guessed, this problem began after the removal of some
malware and a nasty liitle worm virus called "W32.Allim". I was able to rid
the computer of the virus, and have run multiple scans in the safe mode -
everything looks good except for the message above.

jt

More about : startup file missing

Anonymous
May 15, 2005 1:23:23 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi,

The registry is damaged. Userint32.exe is not a windows file, but rather
something that was designed to look like one. The closest real file is
userinit.exe. Start/run regedit, then click edit/find and scan for
uerint32.exe. Post back with the keys you find it in.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Associate Expert - WindowsXP Expert Zone
www.microsoft.com/windowsxp/expertzone
Windows help - www.rickrogers.org

"Foge" <jtfogarty@knology.net> wrote in message
news:eoOgoRNWFHA.2984@tk2msftngp13.phx.gbl...
>I was hoping someone could help me who has seen this problem before.
>
> When any user logs on, after loading the user's setting, I see an error
> message stating the following
> "Cannot find C:\Windows\userint32.exe ... etc". This file does not exist
> on my C: drive. I've tried to search the internet and newgroups for help,
> but I've found nothing related to this problem.
>
> Everything appears to run OK after the message appears.
>
> Note: As you probably guessed, this problem began after the removal of
> some malware and a nasty liitle worm virus called "W32.Allim". I was able
> to rid the computer of the virus, and have run multiple scans in the safe
> mode - everything looks good except for the message above.
>
> jt
>
Anonymous
May 15, 2005 12:42:57 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

http://forums.spywareinfo.com/lofiversion/index.php/t48...

instructions re HijackThis
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm


"Foge" <jtfogarty@knology.net> wrote in message
news:eoOgoRNWFHA.2984@tk2msftngp13.phx.gbl...
>I was hoping someone could help me who has seen this problem before.
>
> When any user logs on, after loading the user's setting, I see an error message
> stating the following
> "Cannot find C:\Windows\userint32.exe ... etc". This file does not exist on my C:
> drive. I've tried to search the internet and newgroups for help, but I've found
> nothing related to this problem.
>
> Everything appears to run OK after the message appears.
>
> Note: As you probably guessed, this problem began after the removal of some malware
> and a nasty liitle worm virus called "W32.Allim". I was able to rid the computer of
> the virus, and have run multiple scans in the safe mode - everything looks good
> except for the message above.
>
> jt
>
Related resources
Anonymous
May 15, 2005 8:27:20 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

"Rick "Nutcase" Rogers" <rick@mvps.org> wrote in message
news:uVEc1yOWFHA.2520@TK2MSFTNGP09.phx.gbl...
> Hi,
>
> The registry is damaged. Userint32.exe is not a windows file, but rather
> something that was designed to look like one. The closest real file is
> userinit.exe. Start/run regedit, then click edit/find and scan for
> uerint32.exe. Post back with the keys you find it in.
>
> --
> Best of Luck,
>
> Rick Rogers, aka "Nutcase" - Microsoft MVP
> http://mvp.support.microsoft.com/
> Associate Expert - WindowsXP Expert Zone
> www.microsoft.com/windowsxp/expertzone
> Windows help - www.rickrogers.org
>
> "Foge" <jtfogarty@knology.net> wrote in message
> news:eoOgoRNWFHA.2984@tk2msftngp13.phx.gbl...
>>I was hoping someone could help me who has seen this problem before.
>>
>> When any user logs on, after loading the user's setting, I see an error
>> message stating the following
>> "Cannot find C:\Windows\userint32.exe ... etc". This file does not exist
>> on my C: drive. I've tried to search the internet and newgroups for help,
>> but I've found nothing related to this problem.
>>
>> Everything appears to run OK after the message appears.
>>
>> Note: As you probably guessed, this problem began after the removal of
>> some malware and a nasty liitle worm virus called "W32.Allim". I was able
>> to rid the computer of the virus, and have run multiple scans in the safe
>> mode - everything looks good except for the message above.
>>
>> jt
>>

Thank you for your reply(s).

Ran HijackThis and found said entry. Delete the entry and "it's all good,
again". Thank you!
I included the HijackThis report below for your review.

Logfile of HijackThis v1.99.1
Scan saved at 4:24:47 PM, on 5/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\John\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType
Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
D:\PROGRA~1\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel
32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program
Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec
Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton
AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Anonymous
May 15, 2005 11:47:32 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi,

Good. The rest of that log looks fine.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Associate Expert - WindowsXP Expert Zone
www.microsoft.com/windowsxp/expertzone
Windows help - www.rickrogers.org

"Foge" <jtfogarty4@yahoo.com> wrote in message
news:uF36txYWFHA.2960@TK2MSFTNGP15.phx.gbl...
> "Rick "Nutcase" Rogers" <rick@mvps.org> wrote in message
> news:uVEc1yOWFHA.2520@TK2MSFTNGP09.phx.gbl...
>> Hi,
>>
>> The registry is damaged. Userint32.exe is not a windows file, but rather
>> something that was designed to look like one. The closest real file is
>> userinit.exe. Start/run regedit, then click edit/find and scan for
>> uerint32.exe. Post back with the keys you find it in.
>>
>> --
>> Best of Luck,
>>
>> Rick Rogers, aka "Nutcase" - Microsoft MVP
>> http://mvp.support.microsoft.com/
>> Associate Expert - WindowsXP Expert Zone
>> www.microsoft.com/windowsxp/expertzone
>> Windows help - www.rickrogers.org
>>
>> "Foge" <jtfogarty@knology.net> wrote in message
>> news:eoOgoRNWFHA.2984@tk2msftngp13.phx.gbl...
>>>I was hoping someone could help me who has seen this problem before.
>>>
>>> When any user logs on, after loading the user's setting, I see an error
>>> message stating the following
>>> "Cannot find C:\Windows\userint32.exe ... etc". This file does not exist
>>> on my C: drive. I've tried to search the internet and newgroups for
>>> help, but I've found nothing related to this problem.
>>>
>>> Everything appears to run OK after the message appears.
>>>
>>> Note: As you probably guessed, this problem began after the removal of
>>> some malware and a nasty liitle worm virus called "W32.Allim". I was
>>> able to rid the computer of the virus, and have run multiple scans in
>>> the safe mode - everything looks good except for the message above.
>>>
>>> jt
>>>
>
> Thank you for your reply(s).
>
> Ran HijackThis and found said entry. Delete the entry and "it's all good,
> again". Thank you!
> I included the HijackThis report below for your review.
>
> Logfile of HijackThis v1.99.1
> Scan saved at 4:24:47 PM, on 5/15/2005
> Platform: Windows XP SP2 (WinNT 5.01.2600)
> MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
>
> Running processes:
> C:\WINDOWS\System32\smss.exe
> C:\WINDOWS\system32\winlogon.exe
> C:\WINDOWS\system32\services.exe
> C:\WINDOWS\system32\lsass.exe
> C:\WINDOWS\system32\Ati2evxx.exe
> C:\WINDOWS\system32\svchost.exe
> C:\WINDOWS\System32\svchost.exe
> C:\WINDOWS\system32\spoolsv.exe
> C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
> C:\Program Files\Norton AntiVirus\navapsvc.exe
> C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
> C:\Program Files\Norton AntiVirus\SAVScan.exe
> C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
> C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
> C:\WINDOWS\System32\svchost.exe
> C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
> C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> C:\WINDOWS\system32\Ati2evxx.exe
> C:\WINDOWS\Explorer.EXE
> C:\Program Files\Common Files\Symantec Shared\ccApp.exe
> C:\Program Files\Microsoft IntelliType Pro\type32.exe
> C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
> C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
> C:\WINDOWS\system32\wuauclt.exe
> C:\Program Files\Outlook Express\msimn.exe
> C:\Program Files\Messenger\msmsgs.exe
> C:\Documents and Settings\John\Desktop\HijackThis.exe
>
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://yahoo.com/
> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
> D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
> O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
> Files\Spybot - Search & Destroy\SDHelper.dll
> O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
> Files\Norton AntiVirus\NavShExt.dll
> O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
> Shared\ccApp.exe"
> O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
> C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
> O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType
> Pro\type32.exe"
> O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
> Files\Java\j2re1.4.2_06\bin\jusched.exe
> O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
> C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
> O8 - Extra context menu item: E&xport to Microsoft Excel -
> res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
> O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
> D:\PROGRA~1\aim.exe
> O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
> C:\Program Files\Messenger\msmsgs.exe
> O9 - Extra 'Tools' menuitem: Windows Messenger -
> {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
> Files\Messenger\msmsgs.exe
> O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
> O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
> C:\WINDOWS\system32\Ati2evxx.exe
> O23 - Service: ATI Smart - Unknown owner -
> C:\WINDOWS\system32\ati2sgag.exe
> O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
> C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
> Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
> O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
> Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
> O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
> Corporation - C:\Program Files\Common
> Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
> O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program
> Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
> O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec
> Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
> O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
> Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
> O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton
> AntiVirus\SAVScan.exe
> O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
> C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
> O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
> Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
> O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
> C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
> O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
> Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
>
>
!