MSHTA keeps running

AVG keeps telling me about a threat detection as follows;

wrksqumczgeilnapirro.cn/s_t_t.php Exploit JavaScript Obfuscation

It does nothing about it, it just tells me, over and over again.

In addition to this I end up with dozens of MSHTA processes running on the system and the only way to get rid of them is to end them via the End Process function.

I've searched everywhere on google and can find nothing similar. I have searched the PC for any existence of this strange PHP file and nothing there either.

Can any one help tell me what this is - I have atttached a Hijack This log if it helps. Many thanks

 

sorry - forgot the hijackthislog - thanks

• Edit by bjgarrick: Inline HJT log removed. READ & RUN ME FIRST sticky not followed.

​

 

http://www.majorgeeks.com/images/grenade.gifWelcome! to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif

Please follow the instructions in the READ & RUN ME FIRST link given further down and attach the requested logs when you finish these instructions.

• If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.
  • TDSSserv Non-Plug & Play Driver Disable
• If something does not run, write down the info to explain to us later but keep on going.
• Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide


Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in Safe Mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. To avoid additional delay in getting a response, it is advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!
4. Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

 

Hi Thank you for that comprehensive list - Which I think I've managed to run ok. I attach the last set of zip files for your perusal.

I have also attached a word document which contains a screen shot of an incident prior to the capture of all this information which may help understand why MSHTA keeps running - I had a thing called Process Explorer running - which you will see in the background, and in the foreground is AVG's message warning of the threat.

I saw a very brief but not very explanatory note on a search that AVG may have previously found a problem but not completed the job - the suggestion was that "It has deleted the 'file' but not the service that calls it'. All gobbleydegook to me, but thought it may help. Many thanks again for your time.

 

I still need some more logs from the READ ME.

• ComboFix Log
• SUPERAntiSpyware Log
• Malwarebytes Anti-Malware Log

 

ok sorry here they are

 

...oh and also the MSHTA problem still exists, one interesting new item to add is that each occurence of it now seems to be taking up more memory and a more consistent volume (around 13m) whereas before the amount of memory each instance occupied seemed to vary between 400k and 12m ?
Thanks again for your help thus far.
regards

 

First, let's shorten up the logs. Click Start > Run > type notepad and press ENTER.

Once Notepad comes up, type the below into Notepad.

Once your done, click on File > Save As > fix.bat and save to your desktop.

Once you're done, locate the file on your desktop "fix.bat" and double click on it. A command prompt will flash, once it goes away run ComboFix again and attach a new log.

Also, run the C:\MGtools\GetLogs.bat file by double clicking on it, attach the new set of logs to your next post.

 

Thanks again - here are the details.

 

Let's do once more quick fix to shorten the logs up...

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.​

Finally...

Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

​

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Sorry about the delay in replying but I've been away on holiday. Here are the attached logs from your most recent instruction, many thanks for your help.
I may be separated from my PC for a further 5 days so will return any further info to you then. Regards

 

Hi bjgarrick ? Have you had any more thoughts on this post? Been grateful for your help thus far. Many thanks

 

Ok thanks for this. I went back to Normal mode startup - and allowed all the various programs to start, including AVG. I tried my level best to disable AVG and stop its component parts running, but it is very insistent. Infact the only way to really stop it seems to be to 'untick' using msconfig, but that conflicted with what you wanted me to do in respect of starting up in Normal Mode.

Anyhow, its done now and I hope the results are a little more helpful - I attach them as requested.

The problem still persists, if its of any help there is almost a regularity about the warnings I get from AVG about this MSHTA thing, its as if something somewhere is using MSHTA to kick something off at a regular interval.

Anyway - hope you can help - I still cannot find anybody in the entire world on the internet who seems to have a similar problem to this.

many thanks

 

..and one other attachment as well so you can see what I'm seeing. Many thanks.

 

Thanks for this - I pretty much cleared out all the things you said, although many of them were not there (e.g. Windows Messenger). I attach the logs requested.

AVG is still popping up with the warnings and MSHTA is still running dozens of versions in the process window....well after about an hour there are dozens running.

Apologies but I forgot to run CCleaner till after MGTools, but I checked the directories you asked me to and they were virtually empty apart from a few files from todays date.

Many thanks I hoep this helps.

 

SOLVED

I think I found it. I figured out that the AVG prompt kept coming up at regular rather than random intervals , and so it was, exactly 15 minute intervals. I figured that the Scheduled Task window was a good place to check so I went into this via Accesories, System Tools and lo and behold there were around 90 items called at1 , at2, at3 etc etc and a right-click, properties revealed that each of them called MSHTA.exe with a parameter that was the enormously long and complicated php file name described in previous hosts.

I deleted them all and the problem has gone away, fantastic - what I do not know is how it got there in the first place, nor what it was trying to do.

Thanks for all your help, perhaps this may help someone else who gets this problem, although I've yet to find anyone else who has.

Many thanks

 

Appreciate all your help - many thanks