mshta.exe scans the whole disc

G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

Hello!

Whenever I open Add/Remove Program in Control Panel the program MSHTA.EXE
will start to scan the whole hard drive (C:). since I got 61GB with data on
a 115GB disk(Pentium 4, 2.4 GHz) this takes a while... About 5 minutes.

How do I make it NOT scan or at least only scan specific directories?

I running Windows 2000 SP4

//Anders
--
English isn't my first, or second, language.
So anything rude or strange are due to the translation
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Wed, 7 Sep 2005 10:16:42 +0200, Anders Eriksson <andis59@gmail.com>
wrote:

>Hello!
>
>Whenever I open Add/Remove Program in Control Panel the program MSHTA.EXE
>will start to scan the whole hard drive (C:). since I got 61GB with data on
>a 115GB disk(Pentium 4, 2.4 GHz) this takes a while... About 5 minutes.
>
>How do I make it NOT scan or at least only scan specific directories?
>
>I running Windows 2000 SP4

Try htastop:

http://www.nsclean.com/htastop.html

Have you used a good up to date antivirus scanner? Spyware
scanners? Something is wrong. And there are malwares that screw
around with mshta.exe

Art

http://home.epix.net/~artnpeg
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Thu, 08 Sep 2005 00:24:42 GMT, Art wrote:

> On Wed, 7 Sep 2005 10:16:42 +0200, Anders Eriksson <andis59@gmail.com>
> wrote:
>
>>Whenever I open Add/Remove Program in Control Panel the program MSHTA.EXE
>>will start to scan the whole hard drive (C:).
>>How do I make it NOT scan or at least only scan specific directories?
>
> Try htastop:
>
> http://www.nsclean.com/htastop.html
>

I did run it and it made no change. MSHTA.EXE still runs and scans the
whole disc.

> Have you used a good up to date antivirus scanner? Spyware
> scanners? Something is wrong. And there are malwares that screw
> around with mshta.exe
>
I have Norman antivirus, Microsoft AntiSpyware. I run Ad-Aware and Spybot
S&D and SpywareBlaster once a week (.a bit paranoid maybe.)

// Anders
--
English isn't my first, or second, language.
So anything rude or strange are due to the translation
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Thu, 8 Sep 2005 15:08:54 +0200, Anders Eriksson <andis59@gmail.com>
wrote:

>>>Whenever I open Add/Remove Program in Control Panel the program MSHTA.EXE
>>>will start to scan the whole hard drive (C:).
>>>How do I make it NOT scan or at least only scan specific directories?
>>
>> Try htastop:
>>
>> http://www.nsclean.com/htastop.html
>>
>
>I did run it and it made no change. MSHTA.EXE still runs and scans the
>whole disc.
>
>> Have you used a good up to date antivirus scanner? Spyware
>> scanners? Something is wrong. And there are malwares that screw
>> around with mshta.exe
>>
>I have Norman antivirus, Microsoft AntiSpyware. I run Ad-Aware and Spybot
>S&D and SpywareBlaster once a week (.a bit paranoid maybe.)

Not paranoid at all :) Pays to be alert. I'm going to suggest running
a more powerful av scanner, but before that, you might check the
folder location of mshta. Sometimes a false one is located in a
different folder. Here's what's on my Win 2K sp4

c:\winnt\system32 24,576 Aug 29, 2002
c:\winnt\system32\dllcache same as above
c:\winnt\ServicePackFiles\I386 29,968 June 19, 2003

Here's a paste of instructions:
*********************************************************
The following procedure will give you a on-demand scan
with a clean/delete capability using the Kaspersky scan
engine and the extra defs:

Download mwav.exe from here:

http://www.spywareinfo.dk/download/mwav.exe

Allow it to extract the files to c:\Kaspersky

Next, download wget.exe from here:

http://users.ugent.be/~bpuype/wget/#download

And copy it to c:\Kaspersky

Use Notepad to create the following batch file:

@echo off
cls
echo -----------------------------------------------
echo Updating using updates1 ftp site
echo -----------------------------------------------
wget -N ftp://updates1.kaspersky-labs.com/updates_x/*.avc
wget -N ftp://updates1.kaspersky-labs.com/updates_x/avp.*
echo -----------------------------------------------
echo Updating completed!
echo -----------------------------------------------

Save the batch file as update.bat
copy it to c:\Kaspersky

Now run c:\Kaspersky\update.bat

Then run c:\Kaspersky\mwavscan
*****************************************************

Art

http://home.epix.net/~artnpeg
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Thu, 08 Sep 2005 13:37:50 GMT, Art wrote:

> c:\winnt\system32 24,576 Aug 29, 2002
> c:\winnt\system32\dllcache same as above
> c:\winnt\ServicePackFiles\I386 29,968 June 19, 2003
>
I have the same.

It seems a bit strange that the file in system32 is older than the one in
ServicePackFiles\I386!? But since you also have this I guess that's its OK.


> Then run c:\Kaspersky\mwavscan
> *****************************************************
>
I have now run the scan and it found nothing. Which is both good and bad
news....

If you start Add/Remove Programs does it start MSHTA.EXE and if so will it
scan the disk?

// Anders
--
English isn't my first, or second, language.
So anything rude or strange are due to the translation
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Tue, 13 Sep 2005 10:03:40 +0200, Anders Eriksson
<andis59@gmail.com> wrote:

>On Thu, 08 Sep 2005 13:37:50 GMT, Art wrote:
>
>> c:\winnt\system32 24,576 Aug 29, 2002
>> c:\winnt\system32\dllcache same as above
>> c:\winnt\ServicePackFiles\I386 29,968 June 19, 2003
>>
>I have the same.
>
>It seems a bit strange that the file in system32 is older than the one in
>ServicePackFiles\I386!? But since you also have this I guess that's its OK.

I dunno why either :)

>> Then run c:\Kaspersky\mwavscan
>> *****************************************************
>>
>I have now run the scan and it found nothing. Which is both good and bad
>news....
>
>If you start Add/Remove Programs does it start MSHTA.EXE and if so will it
>scan the disk?

MSHTA is indeed listed as a running process when I do that, but I'm
not seeing any problem with it. I don't know what you mean by
"scanning" or how you determined that it's "scanning". If you Google
the name mshta.exe you find that it's a non-essential process but one
that shouldn't be terminated unless it causes a problem. It's purpose
is to run HTA files. The only grasping at straws I can think of is
that it might be looking for some required file that's missing or
corrupted. But then you would think you'd see the system put up a
error message. So I'm at a loss for further suggestions. I'm glad
that the Kaspersky scan engine didn't find a nasty. When updated,
it's a very powerful tool.

Art

http://home.epix.net/~artnpeg
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Tue, 13 Sep 2005 13:32:24 GMT, Art wrote:

> On Tue, 13 Sep 2005 10:03:40 +0200, Anders Eriksson
> <andis59@gmail.com> wrote:
>
>>If you start Add/Remove Programs does it start MSHTA.EXE and if so will it
>>scan the disk?
>
> MSHTA is indeed listed as a running process when I do that, but I'm
> not seeing any problem with it. I don't know what you mean by
> "scanning" or how you determined that it's "scanning".

By scanning I mean that it read (write?) on the disk for about 5 to 10
minutes. I can hear the disk.

I also have run File Monitor by SysInternals (www.sysinternals.com) and it
shows that for every directory on my C: drive it does:

283477 07:15:49 mshta.exe:1548 FSCTL_IS_VOLUME_MOUNTED C:\Documents and
Settings\ame\ SUCCESS
283478 07:15:49 mshta.exe:1548 IRP_MJ_CREATE C:\Program Files\ SUCCESS
Options: Open Directory Access: All
283479 07:15:49 mshta.exe:1548 IRP_MJ_DIRECTORY_CONTROL C:\Program Files\
SUCCESS FileBothDirectoryInformation: Common Files
283480 07:15:49 mshta.exe:1548 IRP_MJ_CLEANUP C:\Program Files\ SUCCESS
283481 07:15:49 mshta.exe:1548 IRP_MJ_CLOSE C:\Program Files\ SUCCESS

(the above will probably wrap. Each line should start with a 6 digit
number)


I also does this for a number (more than 100) exe and dll:
51 07:12:09 mshta.exe:1548 FSCTL_IS_VOLUME_MOUNTED C:\Documents and
Settings\ame\ SUCCESS
52 07:12:09 mshta.exe:1548 FASTIO_QUERY_OPEN C:\Norman\Nvc\BIN\Niphk.dll
FAILURE
53 07:12:09 mshta.exe:1548 IRP_MJ_CREATE C:\Norman\Nvc\BIN\Niphk.dll
SUCCESS Options: Open Access: All
54 07:12:09 mshta.exe:1548 FASTIO_QUERY_STANDARD_INFO
C:\Norman\Nvc\BIN\Niphk.dll SUCCESS Length: 233472
55 07:12:09 mshta.exe:1548 FASTIO_QUERY_BASIC_INFO
C:\Norman\Nvc\BIN\Niphk.dll SUCCESS Attributes: A
56 07:12:09 mshta.exe:1548 IRP_MJ_CLEANUP C:\Norman\Nvc\BIN\Niphk.dll
SUCCESS
57 07:12:09 mshta.exe:1548 IRP_MJ_CLOSE C:\Norman\Nvc\BIN\Niphk.dll
SUCCESS

(the above will probably wrap. Each line should start with a 2 digit
number)


It's really strange!

I have tested on a Windows XP computer and there MSHTA.EXE will start and
the disk will be 'scanned' just for a while (less than 30 seconds) and the
scanning will stop as soon as all program are shown in the Add/Remove
Programs window.

I guessing that we have come to the end of this so thank you very much for
your input!

// Anders
--
English isn't my first, or second, language.
So anything rude or strange are due to the translation
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

5-10 minutes is not a terribly long time for hundreds (thousands) of
retries on a failing hard drive, especially a drive with a new "bad
spot" on the oxide surface where some high-priority code resides. The OS
doesn't see these; they're generated by the drive ROM, which will keep
trying and early in the failure history will ultimately get a good
access. All the OS does is wait on the task that issued the access
command; there's no error logged by the OS unless the hardware
ultimately reports a failure/timeout. Depending on the task in these
cases the OS may stutter, freeze entirely, or simply go about other
tasks in the meanwhile.

Detection always involves the drive manufacturer's bootable diagnostic,
downloadable from their website. Unless of course the drive drops dead
and everything on it is lost.

BTW, you assert several times that mshta is scanning the entire disk.
Are you really certain that's true?

Anders Eriksson wrote:

> On Tue, 13 Sep 2005 13:32:24 GMT, Art wrote:
>
>
>>On Tue, 13 Sep 2005 10:03:40 +0200, Anders Eriksson
>><andis59@gmail.com> wrote:
>>
>>
>>>If you start Add/Remove Programs does it start MSHTA.EXE and if so will it
>>>scan the disk?
>>
>>MSHTA is indeed listed as a running process when I do that, but I'm
>>not seeing any problem with it. I don't know what you mean by
>>"scanning" or how you determined that it's "scanning".
>
>
> By scanning I mean that it read (write?) on the disk for about 5 to 10
> minutes. I can hear the disk.
>
> I also have run File Monitor by SysInternals (www.sysinternals.com) and it
> shows that for every directory on my C: drive it does:
>
> 283477 07:15:49 mshta.exe:1548 FSCTL_IS_VOLUME_MOUNTED C:\Documents and
> Settings\ame\ SUCCESS
> 283478 07:15:49 mshta.exe:1548 IRP_MJ_CREATE C:\Program Files\ SUCCESS
> Options: Open Directory Access: All
> 283479 07:15:49 mshta.exe:1548 IRP_MJ_DIRECTORY_CONTROL C:\Program Files\
> SUCCESS FileBothDirectoryInformation: Common Files
> 283480 07:15:49 mshta.exe:1548 IRP_MJ_CLEANUP C:\Program Files\ SUCCESS
> 283481 07:15:49 mshta.exe:1548 IRP_MJ_CLOSE C:\Program Files\ SUCCESS
>
> (the above will probably wrap. Each line should start with a 6 digit
> number)
>
>
> I also does this for a number (more than 100) exe and dll:
> 51 07:12:09 mshta.exe:1548 FSCTL_IS_VOLUME_MOUNTED C:\Documents and
> Settings\ame\ SUCCESS
> 52 07:12:09 mshta.exe:1548 FASTIO_QUERY_OPEN C:\Norman\Nvc\BIN\Niphk.dll
> FAILURE
> 53 07:12:09 mshta.exe:1548 IRP_MJ_CREATE C:\Norman\Nvc\BIN\Niphk.dll
> SUCCESS Options: Open Access: All
> 54 07:12:09 mshta.exe:1548 FASTIO_QUERY_STANDARD_INFO
> C:\Norman\Nvc\BIN\Niphk.dll SUCCESS Length: 233472
> 55 07:12:09 mshta.exe:1548 FASTIO_QUERY_BASIC_INFO
> C:\Norman\Nvc\BIN\Niphk.dll SUCCESS Attributes: A
> 56 07:12:09 mshta.exe:1548 IRP_MJ_CLEANUP C:\Norman\Nvc\BIN\Niphk.dll
> SUCCESS
> 57 07:12:09 mshta.exe:1548 IRP_MJ_CLOSE C:\Norman\Nvc\BIN\Niphk.dll
> SUCCESS
>
> (the above will probably wrap. Each line should start with a 2 digit
> number)
>
>
> It's really strange!
>
> I have tested on a Windows XP computer and there MSHTA.EXE will start and
> the disk will be 'scanned' just for a while (less than 30 seconds) and the
> scanning will stop as soon as all program are shown in the Add/Remove
> Programs window.
>
> I guessing that we have come to the end of this so thank you very much for
> your input!
>
> // Anders
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Wed, 14 Sep 2005 09:12:00 +0200, Anders Eriksson
<andis59@gmail.com> wrote:

>On Tue, 13 Sep 2005 13:32:24 GMT, Art wrote:
>
>> On Tue, 13 Sep 2005 10:03:40 +0200, Anders Eriksson
>> <andis59@gmail.com> wrote:
>>
>>>If you start Add/Remove Programs does it start MSHTA.EXE and if so will it
>>>scan the disk?
>>
>> MSHTA is indeed listed as a running process when I do that, but I'm
>> not seeing any problem with it. I don't know what you mean by
>> "scanning" or how you determined that it's "scanning".
>
>By scanning I mean that it read (write?) on the disk for about 5 to 10
>minutes. I can hear the disk.
>
>I also have run File Monitor by SysInternals (www.sysinternals.com) and it
>shows that for every directory on my C: drive it does:
>
>283477 07:15:49 mshta.exe:1548 FSCTL_IS_VOLUME_MOUNTED C:\Documents and
>Settings\ame\ SUCCESS
>283478 07:15:49 mshta.exe:1548 IRP_MJ_CREATE C:\Program Files\ SUCCESS
>Options: Open Directory Access: All
>283479 07:15:49 mshta.exe:1548 IRP_MJ_DIRECTORY_CONTROL C:\Program Files\
>SUCCESS FileBothDirectoryInformation: Common Files
>283480 07:15:49 mshta.exe:1548 IRP_MJ_CLEANUP C:\Program Files\ SUCCESS
>283481 07:15:49 mshta.exe:1548 IRP_MJ_CLOSE C:\Program Files\ SUCCESS
>
>(the above will probably wrap. Each line should start with a 6 digit
>number)
>
>
>I also does this for a number (more than 100) exe and dll:
>51 07:12:09 mshta.exe:1548 FSCTL_IS_VOLUME_MOUNTED C:\Documents and
>Settings\ame\ SUCCESS
>52 07:12:09 mshta.exe:1548 FASTIO_QUERY_OPEN C:\Norman\Nvc\BIN\Niphk.dll
>FAILURE
>53 07:12:09 mshta.exe:1548 IRP_MJ_CREATE C:\Norman\Nvc\BIN\Niphk.dll
>SUCCESS Options: Open Access: All
>54 07:12:09 mshta.exe:1548 FASTIO_QUERY_STANDARD_INFO
>C:\Norman\Nvc\BIN\Niphk.dll SUCCESS Length: 233472
>55 07:12:09 mshta.exe:1548 FASTIO_QUERY_BASIC_INFO
>C:\Norman\Nvc\BIN\Niphk.dll SUCCESS Attributes: A
>56 07:12:09 mshta.exe:1548 IRP_MJ_CLEANUP C:\Norman\Nvc\BIN\Niphk.dll
>SUCCESS
>57 07:12:09 mshta.exe:1548 IRP_MJ_CLOSE C:\Norman\Nvc\BIN\Niphk.dll
>SUCCESS
>
>(the above will probably wrap. Each line should start with a 2 digit
>number)
>
>
>It's really strange!
>
>I have tested on a Windows XP computer and there MSHTA.EXE will start and
>the disk will be 'scanned' just for a while (less than 30 seconds) and the
>scanning will stop as soon as all program are shown in the Add/Remove
>Programs window.

Ok, I tried Filemon and when I go into Add/Remove I see that mshta.exe
seems to locate every folder on my drive. This procedure only lasts
for a second or two on my machine.

I assume you're not using a grossly underpowered machine to run Win 2K
since it seems you know what you're doing :) And I assume you don't
have a abnormally large number of subdirectories.

I'm reminded of something that's happened to me twice since I started
using Win 2K a few months ago. Perhaps unwisely, I chose FAT32 instead
of NTFS. I've had file system corruption ... lost clusters, etc., for
which I'm at a loss to understand why ... unless FAT32 was a poor
choice to make with Win 2K. Anyway, the symptom in both cases was
a "churning" of the hard drive that would sort of come and go.

>I guessing that we have come to the end of this so thank you very much for
>your input!

Sorry I couldn't help. Maybe one of the MS gurus will have a idea.

Art

http://home.epix.net/~artnpeg
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Wed, 14 Sep 2005 09:12:00 +0200, Anders Eriksson
<andis59@gmail.com> wrote:

>I also have run File Monitor by SysInternals (www.sysinternals.com) and it
>shows that for every directory on my C: drive it does:

Afterthought: Possibly something to do with the Pagefile and its
setting ????

Art

http://home.epix.net/~artnpeg
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Wed, 14 Sep 2005 12:28:10 GMT, Art wrote:

> Ok, I tried Filemon and when I go into Add/Remove I see that mshta.exe
> seems to locate every folder on my drive. This procedure only lasts
> for a second or two on my machine.
>
So it 'scans' the disk!

> I assume you're not using a grossly underpowered machine to run Win 2K
> since it seems you know what you're doing :) And I assume you don't
> have a abnormally large number of subdirectories.
>

I think my machine is OK:
Pentium 4 2.7GHz
770 MB RAM
115 GB disk

I have 47169 directories on this disk. Don't know is that abnormally
many;-)

But it seems like it is "by design" that Add/Remove Programs will run
MSHTA.EXE and tell it to search every directory for "something".

I still wish there was someway to limit the search/scanning to "Program
Files"...

// Anders

--
English isn't my first, or second, language.
So anything rude or strange are due to the translation
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.general (More info?)

On Wed, 14 Sep 2005 10:12:18 -0400, Dan Seur wrote:

> 5-10 minutes is not a terribly long time for hundreds (thousands) of
> retries on a failing hard drive, especially a drive with a new "bad
> spot" on the oxide surface where some high-priority code resides. The OS
<snip>

I don't think that this is my problem, but I shall try to check.

>
> BTW, you assert several times that mshta is scanning the entire disk.
> Are you really certain that's true?
>
Yes! Well mstha is running a .hta that searches/scans all directories.
I have tried to figure out what the .hta is doing but it's not the easiest
language to understand


// Anders
--
English isn't my first, or second, language.
So anything rude or strange are due to the translation