We help IT Professionals succeed at work.

how do I install or find userint32.exe ?

lbrnx1
lbrnx1 asked
on
I Have a Dell Dimension 2400 and every time I turn on my P.C. I get this error message cannot find c:\windows\userint32.exe .what can I do to get rid of this error message. It also seems to be affecting other areas of my system. I have windows xp.
Comment
Watch Question

Top Expert 2007
Commented:
This is a remnant of a virus that has probably been cleaned from your computer but has left undesirable registry entries that are causing you these issues.
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FOPANKI%2EL&VSect=T

read the above and then click on the solution link on that page.
CERTIFIED EXPERT
Top Expert 2007
Commented:
That's not a valid file, it's some trojan file.
It's very likely that the file has already been deleted and it's only the reg entry that is present and is being called at startup, so deleting the reg entry will fix the error.

Run Hijackthis and the relevant entry should show up there and fixing that entry will fix the error.
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis
Attach the logfile here.

You can also uncheck the relevant entry pointing to that file in your msconfig but it's not the best solution for it, the bad registry entry has to be removed.
CERTIFIED EXPERT
Top Expert 2007

Commented:
Running a good scanners, registry scanners, or any scanners that removes the bad reg entry should fix it, as orangutang and sparkmaker also suggested.

Hijackthis possible entry to fix:(if not in the 04 line)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\userint32.exe


Alternatively you can remove the reg entry yourself in the registry.
 Startup Registry Keys:
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit  
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce  
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce  
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
  HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
 

Commented:
For more information about that particular piece of malware, see this Trend Micro article:

WORM_OPANKI.L

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FOPANKI%2EL&VSect=T
Top Expert 2007

Commented:
@souseran-->I believe I already posted that link

Commented:
@sparkmaker,

You did. Left that window open *way* too long.
Top Expert 2007

Commented:
I often forget where the refresh button is myself.
Forced accept.

Computer101
EE Admin

Explore More ContentExplore courses, solutions, and other research materials related to this topic.