Virus and Userinit.exe

It most likely asked you to reactivate windows because you used a different disc, im guessing!! The good people at Microsoft are good yaaknow. They think of all possible ways to make your life harder than it is.

# Insert the original Windows XP CD (Windows XP with Service Pack 2 is preferred, but not required) and reboot the computer. You may need to configure your computer to boot from the CD-ROM drive.
# When the Windows XP Setup has started, press "R" to "repair the Windows XP installation using Recovery Console".
# Select the Windows installation to repair (generally this is C:\\Windows) by typing its number and then pressing ENTER.
# Type the Administrator password and press ENTER.
# Type the following commands:

D: [ENTER]
CD I386[ENTER]
EXPAND USERINIT.EX_ C:\\WINDOWS\\SYSTEM32[ENTER]

*^^^ where is says EXPAND, that is an actual command to type into the command prompt using Recovery Console. Not a search ... trying to browse for the particular file. This could be where you went wrong.*

If your CD-ROM drive has a different letter assigned to it, enter "X:" instead, where X is the appropriate drive letter.

After entering "EXPAND USERINIT.EX_ C:\\WINDOWS\\SYSTEM32" you should see the text "1 file(s) copied", in which case all went well.

Remove the Windows XP CD, type "EXIT" and press ENTER to restart your computer. You should now be able to log on as normally.

^^^ this lot is from microsofts website. Hope it works for you

Quote:
I believe this is how we learn.

Quote:
wow...you an ass much? how you think you figure out to fix things if not by trying new obstacles?? and anyone that uses norton can't tell me anything..

The average size of a userinit.exe file is ~24kb this has been an issue I've dealt with many of times @ work. It's a combination of Antivirus 07/08/09/360 variants along with Conflicker that causes this sorts of issues. This doesn't mean you need to format the pc tho. I would use malwarebytes as suggested above along with spybot.

Now after all thats been done check the windows/system32 folder and view by details, sort both by date created and date modified, delete any file that has a very current date (within a week or so) Before you do that though double check by googling any file name that your not sure about. If you dont get any results back about the file then its probably malware.

Also, I've noticed that these viruses have also been using a method of installing as a device driver so check windows/system32/drivers as well and do the same as before (check file name/deletion).

Now if the dll/tmp/exe file can't be deleted download a program called Unlocker and it can "unlock" the file for deletion. If that doesnt work another app you can try is Killbox.

With that being done open up msconfig in the run prompt and turn off anything that isnt nessicary also look @ the file paths as well they can give away the location of anything suspicious. Do the same for the services tab but just make sure that ur not showing any microsoft service to make life easier on urself.

After all that you should be ok. Also, if you already found any file name that you know is spyware then open up regedit with the run command again and search for the file name w/o the extension and delete any values that are associated with it.