What is userinit.exe? Is userinit.exe spyware or a virus?

How to fix userinit.exe related problems?
1. Run Security Task Manager to check your userinit process
2. Run Windows Repair Tool to repair userinit.exe related Windows Errors
3. Run MalwareBytes to remove persistent malware

Process name: Userinit Logon Application or honey or hello or love or task

Product: Microsoft Windows Operating System or honey or F YOU or thanhminh or Hav_online or THANHMINH

Company: Microsoft (microsoft.com) or

File: userinit.exe

If you want a detailed security rating about your userinit.exe (and all other running background processes) read the following user opinions, and download the free trial version of Security Task Manager. http://www.neuber.com/taskmanager/process/userinit.exe.html 

Note: Any malware can be named anything - so you should check where the files of the running processes are located on your disk. If a "non-Microsoft" .exe file is located in the C:\Windows or C:\Windows\System32 folder, then there is a high risk for a virus, spyware, trojan or worm infection! Check it out!

Click to Run a Free Scan for userinit.exe related errors

Users Opinions

Average user rating of userinit.exe: based on 83 votes. Read also the 89 reviews.

466 users ask for this file. 35 users rated it as not dangerous. 6 users rated it as not so dangerous. 16 users rated it as neutral. 10 users rated it as little bit dangerous. 16 users rated it as dangerous. 15 users didn't rate it ("don't know").

All comments about userinit.exe:
password stealer   sandeep chandu
made my computer restart right after loading. I saw it when browsing in the TaskManager I noticed that name and removed it first thing the next boot (which was 5 seconds later). it didnt boot since.   Niva Aldema
Essential part of Windows boot process.   Fred Jones
As I am using cable modem, this file blocks my internet connection. As soon as I stop the exe file from the task manager I can connect to net again...   Emrah Erdal
The userinit.exe process is executed by windows when you log on to your computer. It will run various network and user-setup related tasks to initialise your session on the computer/network. You should leave this process running to ensure that you are logged on correctly.  See also: Link   Steven Hyde
Do not confuse userinit.exe with usrinit.exe, one is pert of the OS, the other is bad news   KevMar
userinit.exe is just a Windows program run at login, leave it   Midnight Cowboy
USERINIT.EXE is part of Windows XP. Under normal circumstances, this program will run for a few seconds after you log in, and then it should disappear from the task manager.   Zsolt
Well, its not dangerous, but some worms replace it   kusiak
it is active on startup but then terminates itself shortly after  
Steven Hyde is right, normally it's not an issue. “The userinit.exe process is executed by windows when you log on to your computer. It will run various network and user-setup related tasks to initialise your session on the computer/network. You should leave this process running to ensure that you are logged on correctly. ***FOLLOW THE LINK*** (It's possible userinit could be a Trojan too.)”   Jonathan Mann
Do not remove. Its part of the windows logon process, on Windows Server 2003, removal of this program will result in you not being able to log in to your computer at all. I have seen spyware vendors advertising this program as a trojan or spyware. I would seriously second guess what is being said in order to get people purchasing spyware.   Codah
This is not a dangerous file. It runs when windows is started up, then turns itself off.   Matt
It is an essential part of Windows OS and is safe to leave it alone unless it is hooked in the registry to run extra files which are trojans. It can hooked in the registry to run gpmiabp.exe which executes a trojan horse Win32.Qoologic. If you see in the Security Task Manager Userinit.exe,gpmiabp.exe or something added to the Userinit.exe then it is hooked through the registry to run malicious files.   John
Once you log in, it might run for a few seconds. After that, it seems to terminate itself. For Windows boot   Mark
This file is an essential part of your OS, however it can be exploted by various viruses and malware. Make sure your antivirus is always up to date and you should be fine.   Ruben
This file blocks absolutley nothing. I have tracked it's run from boot until it shuts itself off. It does just run what is needed to logg you on PROPERLY and then terminates itself.   Daniel at Computer Parts Unleashed. Hawkesbury ON Canada
it makes my cable modem loose connection every few minutes or so   D.
It is User Initialisation file responsible for user login and can be hijacked by worms such as c:\recycled\svchost.exe so as to make Widows XP to logoff itself as u try to login   Masilo Mokgalabone
I believe there are malware programs that use this file.It started to initialize about the same time I had unauthorized dialups that I had to terminate by unplugging my modem's phone line.Two unauthorized programs were on my computer at that time....Metacrawl toolbar and Yazzle (which I stopped from auto- installing) I have had Trend Micro program block and blacklist userinit on startup, with no adverse effect on network signin or any other programs I use.   John Lawrence
Malicious programs will use userinit.exe as a backdoor   thY_nemesYs
this file stops some crucial network services   Farbod
it is a "Essential part of Windows boot process." It is in no way a virus, and if you are having problems with it, it has to do with other system problems you may have (aka: corrupt files or a virus)   Ava
If you notice this because there are a hundred + in your task manager processes, than you more than likely have a worm.  
depend from where it was execute.. originally is windows process and very important for stability and control your logon information   devex
this file, if allowed, will allow you (when logged on) to run smoothly, if disabled the Windows GUI will freeze   network_masta
essential to log on to Windows. I deleted registry keys with Userinit.exe and had to reinstall Windows. Dont remove or terminate it.   Been there done that
Yes, This file only runs as user logs in to windows, then it self terminates. Not a threat but a necessary part of the OS.   Greg S
Userinit.exe in the system32 folder is necessary to log on to your computer, however it could be replaced by a userinit.exe in a different folder. Could it be used to start the virus when you log on or boot the computer?  
Windows system file that starts when windows boot   butilities
On w2k machine, runs as Aserinit.exe, the A beeing alt+0197 sign. Takes 100% CPU. Can be killed in the Taskmanager. I can't find a remedy. I uppose it is a trojan which renamed the userinit. Impossible to find in the registry   Robert
It is a windows logon app. It should terminate on its own shortly after windows has loaded. I recomend that it not be removed. Microsoft says that the file can be deleted by spywares. If you suspect this, you will have to reinstall it from a XP install CD by expanding the file that is on the CD.   Courtney
That it is a system file   Uli Dinklage
Zone Alarm picks it up after startup is complete. Denying it access at this point doesn't seem to cause any issues.   Dave
I suspect Event 1000 UserInit Error may coinside with monitor trouble  
it is an essential for windows. sometimes kaspersky antivirus recognises it as athreat and if you delete it then you will be stuck at the logon screen and you wont be able to start your session even in the safe mode. i had to format thrice and the same happened when i deleted the file   ron
It's a normal process of ur OS. it stays for few secondes when u LOG IN then disappear. But if it stayed longer seeing it in ur Task Manager 100% its a virus!!!   Luck Strucky
Yes it is a normal Microsoft BUT it can run things you don't need. In my case it will run Script Logic which if I let that run my PC's policy will be scewed - no more control panel and other things. There is more detail of my situation but just realize userinit exe can run anything else it wants.   David Norris
Userinit.exe started up for me after running my search utility. I was unsure if it was harmful or not but after reading the above I allowed my firewall to run it and so far things seem to be fine.   Kirby
%SystemRoot%\system32\userinit.exe is part of the Windows OS and vital for startup. Some trojans will run from different directories with this process name.   aku
It is indeed a Windows process that runs when you first log on. Mine disappearsfrom the process list a few seconds after logging on - if yours persists then I'd be worried.   Kevin
Every time I start my computer, it logs on to the internet and every time I try to cancel it just starts again. It only quits when I disable it in task manager.   Ashley Trader
It's use after log in. It's also risk by virus or worm when we always on line without fire wall. Until now,my PC can't be worked.   Irfan
For hte people who say that it makes htem loose connection: Its because of the nature of hte program... It does nothing harmful unless one of a various types of virus attaaches itself to it... If you see hte program running longer then 5 seconds after start-up then end it immediatly and get a better anti virus.   Ohjeez
without this file you cannot logon to windows xp, do NOT delete; I have anti-virus software that deleted this file, and I still couldn't fix the problem using the Recovery Console off the my Windows CD-ROM, any help would be appreciated  See also: Link   John C.
userinit.exe is an essential MicroSoft program that CAN be appended by a virus or trojan to self execute on Windows startup. Check File Size or unassemble/compare.   jeff
It depends on its size. If its around 24kb its system file if it is larger, say around 100kb it could be malware and you should copy file from i386 and replace file in system32 folder if you have problems starting computer. You will have to rename existing file in system32 first.   Gary
Userinit.exe is used as part of the login process but is often hijacked by several bogus anti-spyware and backdoor apps. It is run by the following setting in the registry :  
If your AV or antispyware report it wrong size or suspicious, scan it here: http://www.virustotal.com/ - do not delete it at first glance. You may have troubles with your OS. It should be located in C:\windows\system32\ by default. If location is different pay attention.  See also: Link   Italian IT Helper
On my system it was infected. I found out by right clicking on the file to see it's version. It was NOT a microsoft file, so I knew it had been hijacked. I simply renamed my file, and the microsoft operating system replaced it with the correct version in a matter of minutes.   mitchd123
whenever i log on the process userinit.exe starts and it gives me some warning saying your computer is not safe and takes me to download some fake spywares from the internet, my spyware is detecting it as a trojan and it is in the hkey in the registry so i am not sure what to do   worried
Userinit.exe is a virus and essential for windows. My trojan remover detected it as a virus but could not remove it. Please be careful what you download !!!  
usereinit.exe is part of windows but game thief r WOW have reverse engineered this file & if it makes way to your pc can be malicious. It will capture all usernames & passwords & mail it to a centralised server location where hackers can go pick up your sensitive info. Also check the modified date of this file in explorer. If it was modified after 2004 there is a high change the virus has got you. download the original file from your windows cd & restore it to your C drive to get rid of the virus. make sure you have closed all internet programs for the operation.   Mubasher Khawaja
This file is loading at startup and there is a red cross icon in the taskbar mentioning there is a security problem.   Anan
I use Wildblue security software...it blocks userinit.exe everytime I boot with no adverse effects. I did search the file and found it in the system 32 folder. The size is 24.0 KB (24,576 bytes), from what I've read about it, if it's larger that 24K, it's probably been infected. But I'm not on a network and I don't lock myself out of my PC, so that my be why I don't have any problem blocking it.   rick
I just had it replaced by a trojan.the original one is easy to spot because if you highlight userinit file and go to properties it will give a description of the file and who manufactured it but the trojan one did not have any of this information,it just had dashes after the description and manufacturer.Also the original is usually about 25-26kb when it is replaced mine was 48kb   Richie
Apparently linked to the VirusRemover2009 Malware   Duncan Idaho
It is windows file but can be disguuised a a virus  
there are many viruses that mainly work through userinit.exe. You can know when you have a problem if userinit.exe does not dissapear from task manager 20'' after you log in your computer or if the file itself is bigger than ~30KB. This file will prevent you from using safe mode and slowly kill your computer. You have to log on safe mode, select "Administrator" account and then you will notice that nothing happens. Press alt+cntrl+delete and you will notice that userinit.exe is bugged and still running. Close it and go to File- Run and type explorer.exe. Then you will be successfully logged in   Dexter
Then go to windows/system32/ and delete userinit.exe. Then the system will tell you that you just deleted an important file and that you have to insert SP2 or SP3 cds to repair. DO NOT RESTART YOUR COMPUTER AT THIS POINT. Insert the corresponding service pack cd and it will repair it itself. You are now free from this virus.   Dexter
In Vista I have in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon a key Userinit with value C:\Windows\system32\userinit.exe which seem to be ok, but in Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run I had a key userinit with value c:\users\i\appdata\roaming\twext.exe I deleted this.   Gottfried Forstner
There is a legitimate file named userinit.exe and if it starts on its own with no action taken by you, more than likely it is the legitimate file. However, at some point a trojan or or nasty could get on your system somehow and if it is added to the start menu startup folder or somehow requires you to say ok to start then you most likely have a problem.   Use your head.
All those who rated this a 1 are right!! Read their Posts again. Next, be sure you have the Filename right. Some Worms use very similar names. userinit.exe is necessary to run Windows XP. Goto C:\WINDOWS\system32 and find it, Right Click and choose Properties. Click the Version Tab and you should see that the Company is Microsoft and the File Version matches your Patch Level. If it does LEAVE IT ALONE!! If not run System File Checker and let it replace the file: sfc /scannow in the Run Dialog Box.   Microsoft Certified
Userinit.exe IS a vital part of the OS, however, if you are infected with a virus it attaches itself to Userinit.exe to run in stealth. Typically it disables your firewall and task manager. Observe your processes through you're internet security program to see if it is running after logon- if it is, then you have a virus. DON'T DELETE IT OR YOU WILL NOT BE ABLE TO LOGON. Unplug ethernet cable, use safe mode and run your cleaning tool (registry too). Also, configure your security so that it doesn't run on startup because it's only an app that is accessed very briefly and doesnt need to "run".   Victim of "Userinit.exe"
It sometimes locks up and Windows won't finish starting the startup apps until I log off and log in again.   Dale
it is use less i aquar problem on startup as well as on shutdown   prakash
the userinit prevents my pc from loading the taskbar and icons. the only thing i can see is the wallpaper. I get around this by running explorer.exe through task manager. It doesn't restrict my internet access, but it prevents me from anything related to stopping this virus. I can't even install avira, what can I do?   ShootPointBlank
Encountered the same error and I can't logon to Windows. What I did was CTRL+ALT+DEL, Task Manager, click New Task and typed Control Panel on the Run command prompt. After which, Windows already displayed desktop. Problem is, Network IPs were reset.   Rhyam Dale
userinit.exe is an essential windows file. Virus and malaware sometimes change registry keys related, check registry if userinit.exe is followed by anything else then you probable have an infection.   Dave Renham
A day after reinstall of OS on new hard drive, my firewall stated it was trying to access the Internet through Google's Chrome. Very odd. I blocked it from getting Internet access.   Paul
If the file is removed, you will not be able to logon to XP. Some malware replaces the registry entry for this file with their own file.   Al Hupp - pcHelp!
100% NECESSARY! However easily infected BECAUSE it's not always running. If you remove the userinit.exe file, your logins will fail. You will go to log into windows and you will get logged off immediately. The userinit.exe file only runs to log you in and then stops therefore being completely vulnerable to malware. The ONLY location for the userinit.exe file is windows\system32. If it's anywhere else, delete it. The registry key: HKLM \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon contains a string called Userinit and it points to C:\windows\system32\userinit.exe.  See also: Link   PCFixerGuy
According to Technet, from Microsoft, it simply does this - runs logon scripts, reestablishes network connections, and then starts Explorer.exe, the Windows user interface.  See also: Link   www.myspace.com/mollyvonrhin
Be warned because there is a virus or malware named userini.exe that will create up to 3 processes in the task manager. All of these will go from 0% to 100% of your CPU. Be careful as my computer was blocked from moving, always hanging. Now i am using a temporary.. SAFE SURFING   Another victim with another problem
It has been userinit.exe is necessary to run Windows XP. Goto C:\WINDOWS\system32 and find it, Right Click and choose Properties. Click the Version Tab and you should see that the Company is Microsoft and the File Version matches your Patch Level.   ronak
There are two files, one called "userinit.exe" and the other "us?rinit.exe" where the "?" is actually a unicode character that appears as the letter "e" in Windows Explorer (use a good tool like FAR Manager to see it as a "?"). When entering certain passwords, before pressing Enter, the network activity light blinks on the router -- it's as if they want to capture keystrokes regardless of whether the user presses the Enter key, and I can't help but wonder if they're stealing passwords. Anyway, sometimes the screen will go blank. I used F-Prot Anti-Virus from a clean machine to remove it. If you remove this live or from within Safe Mode, this program will intercept most Anti-Virus and Anti-SpyWare tools, so you need to scan it as a secondary hard drive from a clean machine. When hiding, it will be detected as a SpyWare program called "Antivirus2010" -- this is only a decoy, and the real deal will be removed for the trojan/virus that is really is when you scan from a clean machine. Make sure you're deleting the right file though; Windows Explorer is the wrong tool for this job (use DOS or a good tool like FAR Manager).   Randolf Richardson
I am experiencing that the userinit.exe has about 4 processes running in the task manager (OS XP). The bad thing is that I am unable to connect to the Internet via a web browser with these redundant processes. I decided to end ALL the userinit.exe processes and just after that, refrehed my browser...and all is well. I am trying to work around this but too busy. So after each boot, I have to end the userinit.exe processes. COuld be a malware.   McNeal
userinit.exe is a key process in the Windows operating system. On boot-up it manages the different start up sequences needed, such as establishing network connection and starting up the Windows shell. This program is important for the stable and secure running of your computer and should not be terminated.\r  See also: Link   Edmundwr3
It is an essential part of windows but some trojans are also designed with same name   tejesh
Iobit Malware Fighter (Free) Ver used IOBit form to explain what had occured, waiting for answer   J.P. Raymond
This is not a virus/harmful file. It is a important file in Windows XP/Vista/Win 7...  See also: Link   JP Sharma (Programmer)
If this file is the unexpected size, it blocks security websites such as microsoft.com   Gruntkiller4000
when starting up my computer it slow down my computer,it sometines can't start up,it need to restart,after start up also it slow down the computer   siama
Its a virus whenever you connect an internet this makes connection disconnected withing a few seconds after connecting internet. you need to delete all tmp files from %temp% folder some files can not be deleted but you have to delete forcefully any how this files after the removal of the file you can get rid out from the virus.   Avirat
Userinit is a useful application. Never delete it. It must be only in the system32 folder in windows and also in the startup folder.  
I deleted it after reading it was 55% dangerous. The computer could not be started and I had to reinstall from my back up   stanley canning
I have report that my friend detected as a virus under System32. Once it was deleted, she is stuck at the window Logon screen with the user avatar etc. Everytime it is clicked, the laptop proceed to shutdown instead of logon.  
when userinit.exe does not exec, my win7 fails to show desktop.   kameh
userinit.exe is a key process in the Windows operating system. On boot-up it manages the different start up sequences needed, such as establishing network connection and starting up the Windows shell. This program is important for the stable and secure running of your computer and should not be terminated. userinit.exe is a system process that is needed for your PC to work properly. It should not be removed.   karthik

If you know more about userinit.exe, share your knowledge and help other users.

Security Rating:
Your opinion
about this file:
Web page with more details:
Your first name:

More process information

Is userinit.exe spyware or a virus, trojans, adware or worm? Is there a known userinit.exe error?

Other Processes

userinit.exe [all processes]