wininit.exe - multiple copies, unusual behaviour

[Angilion]

I've been running Win7 with my current firewall setup for years.

Just now, for the first time ever, wininit.exe.mui tried to go out through my firewall, which blocked it and asked me what I wanted done.

That made me concerned that it might be disguised malware, so I searched my drive for winini.exe and found 4 copies of it. 2 are in winsxs and appear to be duplicates of the other 2, as is to be expected with winsxs.

The 2 copies are in different folders and are different sizes but have the same version number:

The one in Windows\System32 is 126K
The one in Windows\SysWOW64 is 94K

Both are listed as version 6.1.7600.16385

So...malware or normal? 32-bit and 64-bit versions of the same system file? Avast! detects no malware.

Also, why would it want access to the net only now, after years of not doing so?

 

[Rroff]

They are the same size and places as on my Windows 7 installs.

Have any new entries appeared in your Windows startup?

 

[Angilion]

They are the same size and places as on my Windows 7 installs.

Have any new entries appeared in your Windows startup?

An old radio program comes to mind: I'm sorry, I haven't a clue I haven't looked at my startup for a long time...

...a quick look with msconfig shows only 7 items and the most recent one would be Radeon settings. There was an update to that a week or two ago.

Do you know why wininit would be accessing the net for the first time ever? Changes like that make me suspicious.