Expert: Lorry - 11/12/2007

Question
hi, ive got a strange problem with my pc.  My computer randomly opens programs, files and moves the mouse(mostly flashing of the mouse pointer) all by itself.  This does not always happen. its completely at random.  I notice that mshta appeared in the process window, so i deleted it from system32.  But it still happens, then igfxsrvc.exe started to appear when the problem was happening. so i deleted it, but it still happens.  Ive done a virus scan.  Updated to the new version of kaspersky virus scan, but no virus is detected, ive tried spybot too.  Please Can you help?? Im running xp service pack2

Answer
Hi Michael,

Do you have Spybot - Search & Destroy 1.5? If not, you can download it from the following site, make sure you update it everytime before running a scan:

http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10743107.html?tag=lst-...

A lot of people also use Ad-Aware 2007 7.0.2.5, as what one misses - the other catches.

http://www.download.com/Ad-Aware-2007-Free/3000-8022_4-10045910.html

Like Spybot, update it before running any scans.

Even though you have scanned with Kaspersky, try using Internet Explorer and go to:

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Click the GO button, then under Virus Detection, click Start. You might be told that you need to download and install ActiveX Controls for the scan to work, answer Yes.

Write down exactly anything it finds, then go to: http://www.symantec.com/search/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually. Make sure that you follow the instructions for removal, step by step, especially the part regarding disabling System Restore.

Regarding MSHTA.exe, the following is from:

http://www.answersthatwork.com/Tasklist_pages/tasklist_m.htm

Microsoft HTML Application Host. MSHTA is the process that runs .HTA files (HTML Applications = programs written in HTML) under Windows.  Typically MSHTA loads as soon as a .HTA application needs to run, and then terminates when the application completes.

Recommendation :
Essential – leave alone.  Note, however, that if there are bugs in the .HTA files it was running, MSHTA will sometimes not terminate when the .HTA application has already completed, and will consume significant amounts of resources.  When this happens, doing an End Task on MSHTA solves the problem (only do so if you are absolutely certain that nothing else that needs MSHTA is running).

Do you have a firewall program installed? Check out Zone Alarm at:

http://www.download.com/3000-2092-10039884.html

Hope this helps!
Lorry