[billyplatt]

After running a windows repair, and after having to re-activate a windows install, I ran panda cloudav which caught and cleaned several infections of blazefind, the computer is now running normally with one oddity.

When running autoruns.exe, it finds the following. Under HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\userinit, there is an entry for c:\windows\system32\winlogon32.exe, which is reported as missing.

If I try to disable or delete the entry, autoruns warns that Deleting Userinit will prevent users from logging on. Are you sure..?

While this seems like a moot point, since the file is missing, and the computer surely DOES allow users to log on, I was looking for an opinion with whether to do anything, ignore it as a registry quirk, or perhaps blazefind deleted the file and I should consider extracting it from CD?

This is on an XP Home, fully patched SP3 version of the OS.

[Advertisements]

winlogon32.exe is a malicious file.

I suggest that you start a new topic in the Malware Removal and Spyware Removal area.

Before you start a new topic click on this link --> Malware and Spyware Cleaning Guide, Please read before starting a new topic. This will give you a few preparations to make, as well as instruction for posting your OTListIt2 log.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

[Broni]

winlogon32.exe is a malicious file.

I suggest that you start a new topic in the Malware Removal and Spyware Removal area.

Before you start a new topic click on this link --> Malware and Spyware Cleaning Guide, Please read before starting a new topic. This will give you a few preparations to make, as well as instruction for posting your OTListIt2 log.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

[billyplatt]

maybe I was unclear, the virus has been removed, I was looking for advice about the registry entry, but I already got it fixed, thanks, though.

[Broni]

All I'm saying is, that if the registry refers to some bad file, it may mean, your computer is not totally clean.

[billyplatt]

I do appreciate the advice, and I appreciate all you guys to to help people! Wish I had some time to help out around here, I know you have your hands full.

[Broni]

You're welcome