Member Avatar for j_mach

Hi,

I have Norton installed on my computer, and every time I turn my computer on I get a "Malicious script detected" message:

Object: FileSystem Object
Activity: CreateTextFile
File: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\OfficeTools.hta

I'm not sure what this is...I don't want to delete it right away because I don't know if it is necessary. I'm guessing I don't need it since I have just begun getting the message. Anybody know what this is for or if I need it?

Thanks!
Jason M.

  • 2 Contributors
  • 2 Replies
  • 112 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

This looks like a classic case of an HTA being used for persistence. As noted, it makes sense not to delete anything blindly; as pointed out, vendor guidance is important. HTA files run under mshta.exe and can execute VBScript/JScript, so an HTA left in a startup location is a common way malware survives reboots.

Practical next steps (safe, low-risk order):

  • Do not double‑click or open the file in a browser. Disconnect the PC from the network if active compromise is suspected.
  • Update your antivirus/antimalware definitions and run a full offline scan (boot Safe Mode if the scanner recommends it).
  • Run an independent on‑demand scanner (for example a current antimalware tool different from your main AV) to catch anything the first pass missed.
  • Use Autoruns (Sysinternals) or msconfig to inspect and remove startup entries safely rather than deleting files blindly. After removing the startup entry, reboot to see whether the item returns.
  • Check Task Scheduler, common temp folders and alternative persistence points if the file reappears.

If further verification or analysis is needed:

  • Do not analyze on the same production PC. Copy the sample to an isolated VM or use an online multi‑engine scanner to see community detections (be aware of privacy when uploading).
  • If recovery is uncertain or the system shows other signs of compromise (unknown users, unusual network traffic, password exposure), restore from a known clean backup or perform a clean install.

Final notes: vendor removal instructions are the primary reference (as suggested), but combine them with updated second‑opinion scanners and Autoruns checks to ensure no residual persistence remains. If unsure, prefer a full reinstall from trusted media — it’s faster and safer than chasing hidden backdoors.

Recommended Answers

All 2 Replies

Member Avatar for dlh6213

Just wondering if you got to this before it was too late?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.