How to fix userinit.exe(0*80000003)

This is a virus activity which prevents to use command prompt on the infected machine, this virus is called PC-OFF.bat trojan which turns off or shutdown your computer when ever you try to use command prompt by any means.
The infected computer restarts on opening command prompt.
This PC-OFF.bat virus creates the following files

• • password_viewer.exe
  • bar311.exe
  • photo.zip.exe
  • pc-off.bat

at the following locations

• • c:\windows\bar311.exe
  • c:\windows\password_viewer.exe
  • c:\windows\photo.zip.exe
  • c:\windows\pc-off.bat

Another variant of the this virus is recognized as bar311.exe virus A.K.A. winzip123 which will have almost the same symptoms and when ever you boot your Windows Xp computer in safe mode it will say a message Thank You!!! Password:Winzip123
Let's find out the fix to remove this shutdown virus completely from computer.
Fix:
1. Open Task Manager by pressing Ctrl+Shift+Esc, click the process tab and locate the process named 'password_viewer.exe' or 'bar311.exe' or 'photo.zip.exe' one by one and right click and select 'End Process'
2. Open Start Menu >> Run, type regedit and press Enter key or OK button
3. Navigate to the following path
HKEY_LOCAL_MACHINE \ SOFTWARE \ MICROSOFT \ WINDOWS NT \ CURRENTVERSION \ WINLOGON
4. Locate the key named Userinit in right pane
"Userinit" = C:\WINDOWS\system32\userinit.exe,bar311.exe"
double click and remove the text 'bar311.exe' from the above
OR
"Userinit" = C:\WINDOWS\system32\userinit.exe,photo.zip.exe"
double click and remove the text 'photo.zip.exe' from the above
OR
"Userinit" = C:\WINDOWS\system32\userinit.exe,password_viewer.exe"
double click and remove the text 'password_viewer.exe' from the above
Note: Please make sure after editing the above Userinit key value it should be only
C:\WINDOWS\system32\userinit.exe (as shown in the image below)

5. Navigate to the following path now
HKEY_CURRENT_USER \software\microsoft\windows\currentversion\explorer\advanced
Change Value of the following registry Key's :-
"Hidden"=dword:00000001 (1) - Change to '1'
"HideFileExt"=Dword:00000000 (0) - Change to '0'
"ShowSupperHidden"=Dword:00000001 (1) - Change to '1'
6. Navigate to the following registry path
HKEY_CURRENT_USER \software\microsoft\Command Processor
Find the registry key named autorun, right click and delete this key. The value of the key would be autorun=c:\windows\pc-off.bat

7. Open notepad and type the following commands
@echo off
del /a /f c:\windows\bar311.exe
del /a /f c:\windows\password_viewer.exe
del /a /f c:\windows\photo.zip.exe
del /a /f c:\windows\pc-off.bat
pause
Save it as remove-pc-off-virus.bat and double click to run it. Or just download this batch file here and run it by double click.
8. Search for bar311.exe OR password_viewer.exe OR photo.zip.exe OR pc-off.bat and delete these files where ever found on your computer.
9. That's it, Enjoy the pc off virus is now completely removed from your computer.

if it was running for more than 30 hours, it wasn't doing much. You can try copying hal.dll off of a known, good-working XP pc, and replace it with the one on your broken PC. It's better if you extract it from i386 folder but grabbing it from another pc should work fine.

If you need further help, reach me via phone at https://www.6ya.com/expert/brandon_bf4b4a06876c89a0

Please click on Start, Click on Run and type the following in the open box and click OK
msconfig

Vista: In the Start Search field, type msconfig , and press Enter . The System Configuration window opens.

Or

Press and hold Windows logo key on keyboard and press R. It will open Run Window. Type the following in the open box and click OK

MSconfig

The System Configuration window opens.

Please click on Startup tab

Remove the check mark from entries related to Mywebsearch OR M3PLUGIN.DLL

Then click on Apply, Close and Please click on Exit without restart.

When the system restarts, you will see a message about System Configuration Utility. Click in the box for "Do not Show this message" and then click on OK.

More on this solution here.

This is a common virus attack that will throw you out everytime you login, or licensing issues

For virus problem is bit tricky and needs to deal with registry settings and also need network computer

Try following

Log on to a networked computer.
Run Regedit.exe
Point your cursor to HKEY_LOCAL_MACHINE
Select File > Connect Remote Registry
Type computer name (infected computer)
Navigate to the following location in registry of destination or infected computer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Edit below two values in right pane:

Shell
Userinit

Change the two values to
Shell=explorer.exe
Userinit = c:\windows\system32\userinit.exe
close the Registry
Restart Infected computer.
You should be able to log on to computer. if it not work then go to back steps and just copy and overwrite the file userinit.exe from installation source.

Disable System Restore. Scan your computer with the free version of Malwarebytes' Anti-Malware.
http://malwarebytes.org/
If you don't have an Anti-Virus program, download Avast and scan.
http://www.avast.com/
If both scans don't detect anything, do this..
Ctrl-Alt-Del > Processes - End the following processes in order:
dxdlg.exe
wscript.exe
Start > Run > regedit - Open the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows NT\CurrentVersion\Winlogon
In the right hand pane, select Userinit and delete everything except C:\windows\system32\ userinit.exe

Make sure the processes wscript.exe and dxdlg.exe are not running.

Delete the following files
C:\Windows\System32\dxdlg.exe
C:\Windows\System32\boot.vbs
In your Windows drive, search for boot.vbs and delete all of them.
In your Windows drive, search for kinza.exe and delete all of them.
Enable System Restore.
Restart your computer.

My Documents Folder - Opens Upon Boot

To Stop Windows Explorer from opening My Documents: Check your settings here: Start/Run/Regedit

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

In the right pane under Userinit - Change the key that reads:

C:\Windows\System32\Userinit.exe,C:\Windows\System32\Userinit.exe
To:
C:\Windows\System32\Userinit.exe,

And also here: Start/Run/Regedit

Start/Run/Regedit

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows. In the right pane, check your settings under Load.

try this rate the solution

You've got the wrong entry in your registry.
Userinit string should be:
C:\WINDOWS\system32\userinit.exe,


Note the trailing comma which must be there.
Often this entry is damaged by malware.


Ways to deal with this:

1. Install Windows on a second partition, load the damaged registry hive and fix it.
2. Boot with a Bart's PE or ERD Commander and fix the registry entry.

Or if you manage to get the register editor running just fix the registry key.

In the register you have to go to:
HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon

Find the line named: Userinit
Make sure it points to: C:\WINDOWS\system32\userinit.exe,

If it doesn't exist, make one, if it doesn't point to the same place, change it.

CHeers

Hi
Hey dear its a virus, luckily your antivirus has already removed it from your pc. one trace is remains in registry which will try to load it on startup.

Ok, do the following step and get rid of it.
Open Run , type regedit and press enter
Go to

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon

and check for the key Shell, the value of this must be Explorer.exe . if you can see some other after that like Explorer.exe C:\PROGRA~1\MYWEBS~1\bar\2.bin... , then remove the second file from the value, means it must only Explorer.exe

Ok, then check for the key Userinit. the value must be C:\WINDOWS\system32\userinit.exe, (including the comma) . If after that some thing is there , then delete it.
Ok thats all. restart your system .

please tell us how to resore requird dll for error

C:\program~1\Mywebs~1\bar\1.bin\m3plugin.dll The specified module could not be found.

First
Open task manager and kill process wscript.exe.

Then
Delete VirusRemoval.vbs and Autorun.inf files from all usb drives.
Delete "c:\WINDOWS\system32\userinit.exe"

Then
Go to c:\Windows\System32 and delete the file VirusRemoval.vbs. It is super hidden so first go to Folder Options and check show hidden and check boxes. Also required for the above files.

Then
go to start>run and type regedit and enter
Go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
On the right side look for Shell which should have value of just explorer.exe.
delete anything at right side of explorer.exe if there is anything.

Under same key Winlogon also look for Userinit which should have value of
c:\WINDOWS\system32\userinit.exe,
Delete all the **** after the comma.

Then
Go to HKCU\Software\Microsoft\Internet Explorer\Main
On the right side locate Window Title and delete its value i.e. Sujin.com.np

Under the same key locate Start Page and delete its value i.e. http://sujin.com.np/

then go to Start Menu -> Run -> msconfig -> Startup tab -> uncheck .vbs files

Restart System