Archived from groups: microsoft.public.windowsxp.general (
More info?)
Glad to hear that you got it fixed.
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In news:158933CA-2404-4D1E-A1C5-9045B17D94E9@microsoft.com,
RLH <RLH@discussions.microsoft.com> hunted and pecked:
> I found a "shell" command line reference to "userint32.exe" in the
> registry and deleted the key. The program is no longer called during the
> user logon process, and the error message no longer appears - QED problem
> solved.
>
> The shell command line instruction to execute was found in the registy in
> the following directory:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT \CurrentVersion\Winlogon
>
> Thanks again for your interest and advise.
>
> --
> RLH
>
>
> "Wesley Vogel" wrote:
>
>> You have a worm or a worm has been removed without removing its startup
>> reference.
>>
>> userint32.exe is a process that is added by the W32/Oscabot-C worm. It
>> uses IRC to get remote commands. This program is a registered security
>> risk and should be removed immediately. If found on your system make
>> sure that you have downloaded the latest update for your antivirus
>> application.
>>
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:CB2AC429-9713-483F-A1B0-D0B08D5A3A91@microsoft.com,
>> RLH <RLH@discussions.microsoft.com> hunted and pecked:
>>> Dave,
>>>
>>> 1st of all ... thank you for your fast reply
>>>
>>> 2nd of all ... from your reply, I can see why I didn't know how to fix
>>> this.
>>>
>>> 3rd...have you seen this message before? If I download all those files,
>>> execute the programs, etc., will I solve the problem???
>>>
>>> Thanks again
>>>
>>> Ron
>>> --
>>> RLH
>>>
>>>
>>> "David H. Lipman" wrote:
>>>
>>>> From: "RLH" <RLH@discussions.microsoft.com>
>>>>
>>>>> Win XP...4 users / profiles
>>>>>
>>>>> Each time one of us "logs on", we get the error message:
>>>>>
>>>>> "Windows cannot find C:\WINDOWS\userint32.exe"
>>>>>
>>>>> How do I correct the problem / eliminate the error message?
>>>>>
>>>>> I've never seen this one before.
>>>>>
>>>>> Thanks
>>>>>
>>>>> --
>>>>> RLH
>>>>
>>>> You may be infected with an Internet worm or you were infected with a
>>>> worm and it was not properly removed.
>>>>
>>>> Dump the contents of the IE Temporary Internet Folder cache (TIF)
>>>> Start --> Settings --> Control Panel --> Internet Options --> Delete
>>>> Files
>>>>
>>>> Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
>>>> Tools --> Options --> Privacy --> Cache --> Clear
>>>>
>>>> Download MULTI_AV.EXE from the URL --
>>>>
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>>>>
>>>> It is a self-extracting ZIP file that contains the Kixtart Script
>>>> Interpreter {
http://kixtart.org Kixtart is CareWare } two batch files,
>>>> four Kixtart scripts, one Link (.LNK) file, this PDF instruction file
>>>> and two utilities; UNZIP.EXE and WGET.EXE. It will simplify the
>>>> process of using up to 3 different Anti Virus Command Line Scanners to
>>>> remove viruses and various other malware.
>>>>
>>>> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in
>>>> C:\AV-CLS}
>>>> This will bring up the initial menu of choices and should be executed
>>>> in Normal Mode. This way all the components can be downloaded from
>>>> each AV vendor’s web site.
>>>> On Win9x/ME the choices are; Trend, McAfee, Exit the menu and Reboot
>>>> the PC
>>>> On NT4, Win2k, WinXP and Win2003 Server the choices are; Sophos, Trend,
>>>> McAfee, Exit the menu and Reboot the PC.
>>>>
>>>> You can choose to go to each menu item and just download the needed
>>>> files or you can download the files and perform a scan in Normal Mode.
>>>> Once you have downloaded the files needed for each scanner you want to
>>>> use, you should reboot the PC into Safe Mode [F8 key during boot] and
>>>> re-run the menu again and choose which scanner you want to run in Safe
>>>> Mode. It is suggested to run the scanners in both Safe Mode and Normal
>>>> Mode.
>>>>
>>>> When the menu is displayed hitting 'H' or 'h' will bring up a more
>>>> comprehensive PDF help file.
>>>>
>>>> To use this utility, perform the following...
>>>> Execute; Multi_AV.exe { Note: You must use the default folder
>>>> C:\AV-CLS } Choose; Unzip
>>>> Choose; Close
>>>>
>>>> Execute; C:\AV-CLS\StartMenu.BAT
>>>> { or Double-click on 'Start Menu' in C:\AV-CLS }
>>>>
>>>> NOTE: You may have to disable your software FireWall or allow WGET.EXE
>>>> and/or FTP.EXE to go through your FireWall to allow them to download
>>>> the needed AV vendor related files.
>>>>
>>>> * * * Please report back your results * * *
>>>>
>>>>
>>>> --
>>>> Dave
>>>>
http://www.claymania.com/removal-trojan-adware.html
>>>>
http://www.ik-cs.com/got-a-virus.htm
Facebook
Twitter
Instagram