Endpoint Protection Small Business Edition

It seems that something has happened with SEP Small Business and the userinit.exe on our Windows SBS 2003 server.

Everything is up and running from that server, but I cannot log into it.  This happened before and I had to uninstall SEP from that server, then I reinstalled SEP, has been working fine for the past 2 weeks, then this.

Any suggestions on what I can do here? I mapped drives to the server and scanned for viruses, found nothing.

Thank you!

Greetings,

With the drive mapped, can you see if userinit.exe is located in X:\Windows\System32? If it is, are you able to check the version and size and compare to a working machine to see if they match?

If it is not there, it is possible that Symantec is deleting it as a virus for some reason. Please post back and let us know.

Unfortunately I can't open the mapped drive, which I'm assuming is because of the userinit.exe problem.

I did try doing a CTRL+ALT+DEL on the machine after clicking ok on the userinit.exe error, then go to task manager, but can't get there either.

Any other suggestions?

Greetings,

You have a copy of the error you are getting?

I would try either slaving the drive and replacing userinit.exe with a known clean copy, either from a backup or from another machine with the exact same OS and patch level. If that fails you can try the Windows Recovery Console if you have your Windows CD, that will replace any missing/broken files as well.

Thanks, I'm not going to mess with it at the moment, since the network is up and functioning.  I'm going to come in tonight and put the server cd in and try to replace the userinit.exe, then assuming I can log back in, run /sfcscannow to look at all the OS files.

I will post back tomorrow.

Thank you

Greetings,

I would recommend contact Symantec if you have a support contract so we can check the machine for a virus. The userinit.exe typically doesn't just break by itself, the only time I have ever seen that fail is either some power failure when writing/reading the file or a virus altering it.