No announcement yet.

Event Log User init Event ID 1000

  • Filter
  • Time
  • Show
Clear All
new posts

  • Event Log User init Event ID 1000

    I recently have taken over a new customers network Administration.

    I have an issue on one of the terminal servers.
    The error
    userinit event id 1000 Could not execute the following script C:\WINDOWS\$NtUninstallKB944653$\spuninst\.bat. The system cannot find the file specified.

    ( I can browse to the file mentioned- it's in the correct path)

    This is is happening about 50 times per day.

    Googling suggests Malware/Virus/rootkit.

    I have diligently run down all of those paths
    I have used
    Gmer (clean scan)
    TDSKiller (cleanscan)
    Hijackthis (nothing noticable)
    ESET (clean scan)
    Stinger (clean)
    Trend RootKit (clean)
    Malware Bytes

    Cleaned the registry, uninstalled all non essential software.
    Nothing running in run once

    I am not sure what is causing the issue.
    Next would be print drivers...

    Has anyone seen this issue? If so what was it?

    Thank you

  • #2
    Re: Event Log User init Event ID 1000

    This event is happen also if you will add some programme to Logon script in GP and setting Run only allowed Windows application.

    As a example: in group policy in User Configuration -> Windows Settings -> Scripts -> Logon you will put fg c:\winnt\test.bat and you have to remember that in User Configuration -> Administrative Tempaltes ->

    System Run only allowed Windows application you have to add test.bat. If not logon script will not run and in the event logs you will see this message.

    For more information follow the given link

    As you have try so many tools i will recommend you to try this tool it will give you the instant alert if any critical event occur in future also give the full description of the particular event error