HELP, wininit.ini

Printable View

March 4th, 2002, 08:40 PM
jjcampbe

HELP, wininit.ini

everytime the wininit.ini file is present in the windows directory, windows will not load(win98). when i delete it, everything works fine, but the wininit.ini file appears everytime i install something. what kind of virus or program could be causing this?? i have norton antivirus corp. edition and a virus scan shows no viruses, do i have to scan from DOS?? how can i scan from DOS? i need this fixed ASAP, as it is my bosses computer and he wants it fixed now.

Thanks,
Jeff Campbell
Network Administrator
March 4th, 2002, 08:46 PM
dspeidel

Visit http://sysinternals.com/ you can download a utility that shows what processes are using which files -this might point u in the proper direction.
March 4th, 2002, 08:48 PM
TechieChick

Hi Jeff,

This is the Bymer worm, check here for the variant that you are infected with.

I've seen the wininit.exe recreate itself at bootup even after supposedly purging proper files.
March 4th, 2002, 09:12 PM
jjcampbe

no, i dont think that it is the bymer worm. it is not showing any of those symptoms. what would be looking for the wininit.ini file??
March 4th, 2002, 09:28 PM
TechieChick

Jeff, there are several viruses that could cause this problem. Nimbda is one and W95.mtx is another. MTX prevents NAV from updating further so that could be why you're running a clean scan. :confused:

I just smell virus..
March 4th, 2002, 09:34 PM
{P²P}Apocalypse

Quote:

Originally posted here by jjcampbe
what would be looking for the wininit.ini file??

Well for one the wininit.ini is modified by Nortons to run some of it's rpc's and tsr's. So look in your settings of Norton and the auto-update features of the Live-Update from symantech. Turn the settings off in Norton and then reboot. This may fix it if not contact Symantec support. MS has an issue with this problem in ME. It may affect 98SE as well. See MS:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q274092

The problem you describe can occur if a file named wininit.ini is present in the Windows folder. That file indicates that there has been an incomplete installation or removal of an application or system update, and system file changes are pending. The first thing to do when you get this error is restart the computer as it suggests. If there is an uninstall or system update pending, it might complete itself. If the error still occurs, search the hard drive for the presence of the wininit.ini file, then rename it. To do so, restart your computer in Safe Mode. Click Start, then Search, then click For Files or Folders. In the Named box, type wininit.ini. In the Look In box, click Local hard drives, then click Find Now. Right-click on the wininit.ini file, click Rename, type wininit.old, then click OK. Close the Find Files window. Restart the computer in Normal mode. Hope this helps.
March 4th, 2002, 10:02 PM
jjcampbe

can you run those removal tools from DOS?? can i run a virus scan from DOS, or savemode and how?? if i just reinstall norton will that be able to find it?? it doesnt let me scan a computer from savemode, how can i do it?
March 4th, 2002, 10:23 PM
TechieChick

Jeff,
Go to those links I provided and follow their directions. That will tell what to look for within the registery and give you removal directions.
March 4th, 2002, 10:40 PM
jjcampbe

there is nothing in the registry. i have checked it 100 times. i did everything it said to remove the goner virus, i think that something else is screwd up becuase of it. anyone have any ideas???
March 4th, 2002, 10:45 PM
TechieChick

Now you tell us you had the goner virus on there...

Arggghhh

If such a process is found, the worm will delete the executable file and all files contained within the same folder and subfolders where the given file resides. If the files are in use and cannot be deleted, the file %SYSTEM%\Wininit.ini is created, and is used to delete the files when the computer restarts.

Click here for info on Goner..sounds like you have some cleanup to do still.
March 13th, 2002, 08:46 PM
jjcampbe

i did all the cleanup i could find. i just ran a complete virus scan in DOS with virus definitions taken off another computer that has no probs and it didnt find anything. is there a file that is needed for the wininit.ini to work, like wininit.exe?
March 13th, 2002, 08:48 PM
jjcampbe

im thinking that maybe some file that is needed got deleted by goner. any help is appreciated.
March 13th, 2002, 08:51 PM
KorpDeath

Is there a reason you don't want to just re-install?
March 13th, 2002, 10:38 PM
TechieChick

I have to agree with KorpDeath, while the hunt is half the fun in virus removal a lot of time has been wasted on a system that seems to be mission critical. I'd format that baby and re-image or reload.whatever is available to you there.
March 14th, 2002, 03:20 PM
jjcampbe

Yeah thats true guys, that was the only other option i could think of, but my boss does not want to have to reinstall all his stuff. but if there is no other option, he will have no problem with it. Just so you guys know, as of now it is not an immediate problem and i have time to solve it, another reason for not just reinstalling, as the problem only arrises when you try to install a program that requires rebooting and adds the wininit.ini file and the program i had trouble installing becuase of this was IE6.0 but i manually installed the files required myself and it worked perfect. I greatly appreciate the help you guys gave me, but i think there HAS to be another solution or something. i remember reading somewhere about a wininit.exe, and there is NO wininit.exe on that computer. Again, thanks for your help.