I've been dealing with an annoying popup that shows up every few days and can't seem to get rid of it. Windows Defender and Malwarebytes haven't solved the issue, and a startup scan didn't help either. In Task Manager, when I check the file location, it leads me to: This PC > Local Disk (C:) > Windows > SysWOW64 > mshta.exe. Anyone know how to resolve this?
1 Answer
First, you should check what command is launching mshta.exe because that could be the key to your problem. When the popup appears, open Task Manager and switch to the Details tab. Right-click on mshta.exe, select Properties, and then click on 'Open file location'. But here's the crucial part: you need to right-click on mshta.exe again and look at the 'Command line' column. It should show something like:
mshta.exe "C:Users...SomeRandom.hta"
Or it might be an obfuscated script like mshta.exe javascript:.... That info will help you figure out what’s causing that popup.
I still can’t seem to locate the command line. Any other tips?
Thanks a lot, I’ll try that out!