What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

mshta.exe virus! can you help pls TB-Psychotic or anyone? [Solved

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #35

Looking over your new FRST , those entries have been removed and are gone

 

Lets check the actual file and see if its infected

 

You need to enable windows to show all files and folders, instructions Here
 
Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, if it says this file has been checked before, have them recheck it. When the scan is done just copy and paste the link back to this forum for me to see.
 
C:\Windows\System32\mshta.exe
 
If the site is busy you can try this one
http://virusscan.jotti.org/en
Post #37

The file is fine and its needed by windows.  Mshta showed up on your original DDS log, I would like you to run Combofix as its written by the same author and may pick up that virus

 

 

Download ComboFix from one of these locations:
 
Link 1
Link 2
 
 
* IMPORTANT !!! Save ComboFix.exe to your Desktop
 
 
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link  for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.
    •  
  • Double click on ComboFix.exe & follow the prompts.
    •  
     
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.  It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. 
    •  
     
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    •  
     
    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
     
     
    [external image: RC1.png]
     
     
    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
    [external image: RC2-1.png]
     
    Click on Yes, to continue scanning for malware.
     
    When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.
     
    *If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
    Post #39

    on a side note I wonder if you can help me.  my wife has windows 8.   she keeps getting the same pop ups - reg clean pro  , clean your registry.   we uninstall the program but it keeps coming back. 

     

    the pop ups pop up very frequently and are annoying.

     

    can you help pls, suggest a good program to install to remove the pop ups

     

    I have looked in the settings

     

    she has Norton 360 but no other firewalls or antvirus.

     

    my wife is thai and our 2 children do use her computer. when they download a program they want they may not always look at the boxes that pop up after, which asks do you want to install ask.com, or searchdial etc etc.  I know it is important to read all these boxes carefully, but I don't think she does

     

    any help pls with a program please?  and I will ask her to be more careful when downloading

     

     

    Post #40

    Your system is fairly new so most new computers have a recovery console installed by the manufacturer

     

     

    Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard,  then paste it into Notepad, make sure there is no space before and above Registry::
     
     
     
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemBooteHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"=-
"RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"=-
 
DDS::
uRun: [SystemBooteHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] mshta.exe http://gbc.psiuyfbe….yJP8FDAh2&log=1
uRun: [RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] mshta.exe http://gbc.psiuyfbe….uq9jR1yJP8FDAh2
uRunOnce: [RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] mshta.exe http://gbc.psiuyfbe….uq9jR1yJP8FDAh2
     
    Save this as CFScript to your desktop.
     
    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
     
    [external image: CFScriptB-4.gif]
     
     
    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.
    Post #41 last edited

    Sorry, we crossed posts, what you need to do is start a new topic for your wifes computer, DDS may not run on Win 8 so have her download and run FRST and post the log also explaining her problems, you can do this for her no problem, just name the reply Wifes Computer.  We can use FRST to uninstall and remove RegCleanPro

     

     

    shopsave toolbar  <  CF also found this if you can I would uninstall it

    Post #43 last edited

    sorry I cannot find shop save toolbar  - I cannot search for it or find it on uninstall programs

     

    thanks for reply for my wife.  I will start a new topic maybe tomorrow.

    Post #45

    If you still have OTL on your desktop we can remove shop saver

     

    Open OTL.exe
    • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
      •  
       
:OTL
 
 
:Services
 
:Reg
 
:Files
c:\program files (x86)\shopsave toolbar
ipconfig /flushdns /c
 
 
:Commands
[purity]
[resethosts]
[EMPTYJAVA] 
[emptytemp]
[start explorer]
[Reboot]
       
    • Then click the Run Fix button at the top. <–Not run Scan
    • Let the program run unhindered, reboot when it is done
    • Then post the results of the log it produces

      • Ask AI

      AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

      Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI