Undocumented Entry in HijackThis

itsdanky · Cadet Joined: May 05, 2004 Posts: 4 Location: USA

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

Anyone have an idea what this is? Not so much the program but the "F2" category.

Thanks.

helpless · Posted: Sat May 08, 2004 3:16 pm Post subject:

this is what i could find on it at bleepingcomp

F2(and F3) entries correspond to the equivalent locations as F0 and F1, but they are instead stored in the registry for Windows versions XP, 2000, and NT. These versions of Windows do not generally use the system.ini and win.ini files. Instead of backwards compatibility they use a function called IniFileMapping.IniFileMapping, puts a all the contents of a an .ini file in the registry, with keys for each line found in the .ini key stored there. Then when you run a program that normally reads their settings from an .ini file, it will first check the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping, for an .ini mapping, and if found will read the settings from there instead. You can see that this key is referring to the registry as it will contain REG and then the .ini file which IniFileMapping is referring to.

also notice that when it contains a " , " (comma) then it can be a bad thing and it is for sure when another fille is linked to it.

Another entry commonly found in F2 is the UserInit entry which corresponds to the key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit which is found in Windows 95 and above. This key specifies what program should be launched right after a user logs into Windows. The default program for this key is C:\windows\system32\userinit.exe. Userinit.exe is a program that restores your profile, fonts, colors, etc for your uname. It is possible to add further programs that will launch from this key by separating the programs with a comma. For example: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit =C:\windows\system32\userinit.exe,c:\windows\badprogram.exe. This will make both programs launch when you log in and is a common place for trojans, hijackers, and spyware to launch from.

hope it helps

itsdanky · Cadet Joined: May 05, 2004 Posts: 4 Location: USA

Great information. Thanks a lot! Smile

lilliebet65 · Posted: Wed Jun 02, 2004 2:09 pm Post subject:

Glad we were able to help. Smile

NOTE: This thread is now closed. Should you need it reopened, please PM a mod.
Everyone else having a similar issue, please launch a new topic for yourselves.


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 716 pages served in previous 5 minutes. Page Rendered: 0.343 seconds.