End Program - mshta.exe

[IS300]

This happened today to a couple of our W2K servers after a reboot.

When I try to log on when it first booted up, it hangs there for about 5 - 10 minutes before the icons load up. After that, I can't browse the Internet using Internet Explorer nor can I open anything in the Control Panel. Other things such as printers and network connections do not open either. All of this works in Safe Mode though. I can get to my computer browse drives.

When I tried to reboot the machine, it gave me two message boxes "End Program - mshta.exe" and "End Program - Power Meter". It also takes several minutes to shut down. All I did was install IIS on this machine.

Then I just rebooted another server and it does the exact same thing now. Has this happened to anybody before? I hope they are not infected with anything.

Please advise.

Thanks,

 

[CPUNeck]

Well unfortunately sounds like a virus since I have almost identical symptoms. I do not get the mshta.exe, but do get the UPS end app pop up. I can open my computer and navigate around the HD, but if I open the \winnt directory that's it. System freezes. I have to click the X and then end the unresponsive program :-( I can not do any windows updates etc.. Hope someone has some suggestions.

 

[Dante808]

http://www.spywareinfo.com/articles/htasploit/

http://vil.nai.com/vil/content/v_98796.htm

Some stuff to read

 

[IS300]

I've figured it out. It is the UPS software, from APC. Check out this thread for more info.

http://www.tek-tips.com/viewthread.cfm?qid=1102005&page=1

Turns out that APC PowerChute version 6.x will stop working as of July 27th, 2005 due to a Java certificate expiring. This is fairly recent, so you should see lots of comments about this one popping up really quick. Just uninstall the old version in safe mode, reboot in normal mode, and reinstall the new version.

Everything should work beautifully after that. I can finally stop banging my head.