Virus infected by computer

Reluctant_spender

Well that looks clean. Are you having any problems?

fox2319

Reluctant_spender wrote: »

Well that looks clean. Are you having any problems?

Not as such but whenever I run malaware I get the same message about

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Downloader) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Downloader) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

every time. This one has me worried due to it's persistence.

kkpolobear

try doing it in safe mode

fox2319

kkpolobear wrote: »

try doing it in safe mode

Thanks again for the help.

I've tried it in safe mode and it keeps doing it (reinstalling the file). Could it be recovering the infected file from system restore or something like that?

Update --
I've gone into the machine again and scanned the userinit file with both malwarebytes and avg and it's coming up clear. I checked the reg key and it just seems to be giving a location for the userinit.exe file.

I'm going to run the malwarebytes prog again tonight but am beginning to wonder if there's any infection? Any thoughts?

Another Update --

Have just run all the progs again and it's showing as all clear. Will give the machine back with clear instructions on what his grandkids shouldn't be doing on the machine...

Thanks again for all the help, all sorted