Infected computer, need help understanding Hijack This log please

tranmererovers

Well it's very bizarre, I have just done a search for userinit.exe files and it finds 2

One in

c:\windows\ServicePackFiles\i386\userinit.exe
and the other is
C:\windows\prefetch\userinit.exe-30818140.pf

There is no userinit.exe in the windows\system32 folder

Reluctant_spender

Hmm strange - unless it has been quarantined.

Send the other two to be checked -hopefully they are clean.

tranmererovers

OK, the one in the i386 directory is clean

tranmererovers

I've never come across a PreFetch directory before (there isn't one on my laptop!!!) Google searches suggest deleting the contents! Any thoughts?

I am thinking perhaps the userinit file in the prefetch is corrupt so I should delete that and copy the one from the 1386 folder to system32

Reluctant_spender

Have you sent C:\windows\prefetch\userinit.exe-30818140.pf to virustotal - that way we will know if it is corrupt.

if the other one is clean I wonder why SDFIX did not move it????

tranmererovers

The prefetch one has come back clean also!

tranmererovers

Reluctant_spender wrote: »

Have you sent C:\windows\prefetch\userinit.exe-30818140.pf to virustotal - that way we will know if it is corrupt.

if the other one is clean I wonder why SDFIX did not move it????

Well I am thinking to delete the prefetch one anyway (as I understand it will get recreated) and copy the clean file to the system32 directory.

Perhaps SDFix didn't move it because the destination file didn't exist??

And once that's done I could try SDFix again?

All purely speculative but I am beginning to lose the will to live with this one lol

Reluctant_spender

just out of interest - can you send the System32 one to virustotal too.

I appreciate that this appears to be some faff but I want to be sure that the file is bad before we look at moving it.

Reluctant_spender

I am planning to move a file using combofix which will/should sort out the movement issue. Fingers crossed.

tranmererovers

Reluctant_spender wrote: »

just out of interest - can you send the System32 one to virustotal too.

I appreciate that this appears to be some faff but I want to be sure that the file is bad before we look at moving it.

There isn't one in the system32 directory! I think if it wasn't for the prefetch directory the machine would be in a log on / log off loop!