[SOLVED] Bleeping computers suggested I post for help with corrupt mshta.exe file on W7

M

meeshymee

Active member
Joined
Jul 18, 2021
Posts
25
Hello,

After a malware removal with the help of bleeping computer I was left with a corrupt mshta.exe file. (I don't know if it was a result or a coincidence.)
After a month of help from bleeping computers - including replacing the corrupt files with good ones, doing sfc scannow and SFCfix etc - it couldn't be fixed and still shows as corrupt.

My W7 professional disks were provided by Lenovo and don't allow me to jut refresh or repair Windows - only do a factory reset which I'm not prepared to do.

(thread of what was done can be found here: Corrupt mshta.exe after malware removal - recovery disks won't let me refresh w7 - Page 6 - Windows 7 )

sfc log attached. CBS log link:
CBS/CBS.log and 6 more files

Thank you.
 

Attachments

Hello and welcome,

Step 1:
Is the issue in the other thread you created here for the same computer ?

Step 2:
WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.
  • Download the attachment SFCFix.zip and save it on your desktop.
  • Save any work you have open, and close all programs.
  • Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
    1p8eDnI.gif
  • SFCFix will launch, let it complete.
  • Once done, a file will appear on your desktop, called SFCFix.txt.
  • Open the file, then copy and paste its content in your next reply.
 

Attachments

Hello,

1. Yes, In my first post it wouldn't allow me to attach the scan results or then delete it so I created a second one.
2. M computer was taken for repair of the casing but I will post the scan results when I have it back.

thank you.
 
No problem, we can wait for that.
 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2021-07-23 23:54:12.886
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.




AutoAnalysis::
CORRUPT: C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe
CORRUPT: C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe


SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 2
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 0
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2021-07-23 23:56:54.773
----------------------EOF-----------------------
 
I'm sorry, I don't understand, it said to paste the contents of the text file after running SFCfix which i did..I already had the program on my computer. But even after downloading the zip from the attachment I don't understand what dragging it over means.. I extracted it (there is no exe unless I do that - unless that was a W10 thing? - I'm sorry, I'm confused.)
 
I don't understand what dragging it over means..
Click to expand...
See the video in the instructions.
Make sure the files SFCFix.exe and SFCFix.zip are on your desktop. Left-click the file SFCfix.zip, keep the left-mousebutton pressed, drag the file over the file SFCFix.exe and then release the left-mousebutton.

Does that help ?
 
i took it to mean drag it over an exe on my desktop - to be clear, you mean drag the zip over my files in windows folder? if so, i have mshta in 2 places system32 and the other one in syswow.. please clarify.

thanks so much.
 
then i'm sorry i just don't understand.. i don't know what i'm missing.. it's obviously very simple but i'm not getting it. i downloaded the zip to my desktop. it is the only SFC file on my desktop. (i assumed i should extract/unzip it but that doesn't seem to be the case) i'm not sure which sfcfix.exe i'm supposed to have on my desktop to drag the zipped one over it.

thank you.
 
Last edited:
In message #5 you posted a log file created by SFCFix.exe. Is the file
myjIXnC.png
SFCFix.exe on your desktop ?
 
Move the file
myjIXnC.png
SFCFix.exe to your desktop.
When done, perform step 2 in message #2 again.
 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2021-07-24 19:12:56.776
Microsoft Windows 7 Service Pack 1 - amd64
Using .zip script file at C:\Users\User\Desktop\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe
Successfully took permissions for file or folder C:\Windows\winsxs
Successfully took permissions for file or folder C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe
Successfully took permissions for file or folder C:\Windows\winsxs\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_37b47fc8249b0283\mshta.exe.mui

Successfully created directory tree \\?\C:\Windows\winsxs\SFCFix.
Successfully created directory tree \\?\C:\Windows\winsxs\SFCFix\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281.
Successfully created directory tree \\?\C:\Windows\winsxs\SFCFix\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086.
Successfully created directory tree \\?\C:\Windows\winsxs\SFCFix\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_37b47fc8249b0283.

Successfully copied file C:\Users\User\AppData\Local\niemiro\Archive\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe to C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe.
Successfully copied file C:\Users\User\AppData\Local\niemiro\Archive\SFCFix\SFCFix.txt to C:\Windows\winsxs\SFCFix\SFCFix.txt.
Successfully copied file C:\Users\User\AppData\Local\niemiro\Archive\SFCFix\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe to C:\Windows\winsxs\SFCFix\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe.
Successfully copied file C:\Users\User\AppData\Local\niemiro\Archive\SFCFix\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe to C:\Windows\winsxs\SFCFix\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe.
Successfully copied file C:\Users\User\AppData\Local\niemiro\Archive\SFCFix\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_37b47fc8249b0283\mshta.exe.mui to C:\Windows\winsxs\SFCFix\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_37b47fc8249b0283\mshta.exe.mui.
Successfully copied file C:\Users\User\AppData\Local\niemiro\Archive\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe to C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe.
Successfully copied file C:\Users\User\AppData\Local\niemiro\Archive\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_37b47fc8249b0283\mshta.exe.mui to C:\Windows\winsxs\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_37b47fc8249b0283\mshta.exe.mui.

Successfully restored ownership for C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe
Successfully restored permissions on C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe
Successfully restored ownership for C:\Windows\winsxs
Successfully restored permissions on C:\Windows\winsxs
Successfully restored ownership for C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe
Successfully restored permissions on C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe
Successfully restored ownership for C:\Windows\winsxs\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_37b47fc8249b0283\mshta.exe.mui
Successfully restored permissions on C:\Windows\winsxs\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_37b47fc8249b0283\mshta.exe.mui
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 4 datablocks.
Finish time: 2021-07-24 19:13:40.284
Script hash: Lgt/veHPESTVF10zX1QM8m3ItT5qfC/ycN/MeBr8bPU=
----------------------EOF-----------------------
 
The fix has replaced the corrupted files but strangely also copied them to a new folder. We will deal with that later.

Please perform a new scan with SFCFix.exe:
  • Double-click the file
    myjIXnC.png
    SFCFix.exe on your desktop to run the tool. A dialog may come up asking for approval. If it does go ahead and allow.
  • On completion a log file (SFCFix.txt) will be opened. Copy and Paste its content into your next reply.
 

Attachments

thank you

SFCFix version 3.0.2.1 by niemiro.
Start time: 2021-07-25 09:28:56.098
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 4 datablocks.
Finish time: 2021-07-25 09:29:12.773
----------------------EOF-----------------------
 
Great.
Try to delete the folder SFCFix in the folder C:\Windows\winsxs and report the result. Do NOT delete the folder C:\Windows\winsxs itself.
Please report the result.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top