"windows timer.hta" problem

[Guest]

A recent occurance has taken place. When I log on to my computer, a Norton
Antivirus alert comes up that says there is a suspicious script in a file
called, "windows timer.hta". This file is located in C:\Documents and
Settings\All Users\Start Menu\Programs\Startup\Windows Timer.hta. If I
delete the file, my internet browser does not work. If I move it out of this
folder, I avoid the problem. I am concerned, however, with the issue of it
containing malicious script. I do not know what this file does, if it is
needed or if it is indeed malicious. I have XP Professional with Service
Pack 2. Nothing has changed in the recent past that I am aware of that would
cause this problem. Any suggestions would be helpful.

 

[Will Denny]

Hi

Try an online virus scan for a 2nd opinion:

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

--


Will Denny
MS-MVP Windows Shell/User
Please reply to the News Groups

 

[Frank Saunders, MS-MVP]

A recent occurance has taken place. When I log on to my computer, a
Norton Antivirus alert comes up that says there is a suspicious
script in a file called, "windows timer.hta". This file is located
in C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\Windows Timer.hta. If I delete the file, my
internet browser does not work. If I move it out of this folder, I
avoid the problem. I am concerned, however, with the issue of it
containing malicious script. I do not know what this file does, if
it is needed or if it is indeed malicious. I have XP Professional
with Service Pack 2. Nothing has changed in the recent past that I
am aware of that would cause this problem. Any suggestions would be
helpful.

First eliminate any scumware.
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

CAUTION!!!!! Before you try to remove spyware using any of these programs ,
download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

See
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated with the program's update function
before every use, even when just downloaded. There's also a lot more to do
than just those two programs. CWShredder is also available here:
http://www.kellys-korner-xp.com/regs_edits/cwshredder.zip
**Post your HijackThis log to
http://www.spywareinfo.com/forums/
http://forums.tomcoyote.org/
http://www.wilderssecurity.com/ or the Spyware forum at
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.


See this link for information about malware:
http://arstechnica.com/articles/paedia/malware.ars

If nothing there helps, please post back to this thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx

 

[Alex Nichol]

A recent occurance has taken place. When I log on to my computer, a Norton
Antivirus alert comes up that says there is a suspicious script in a file
called, "windows timer.hta". This file is located in C:\Documents and
Settings\All Users\Start Menu\Programs\Startup\Windows Timer.hta. If I
delete the file, my internet browser does not work. If I move it out of this
folder, I avoid the problem. I am concerned, however, with the issue of it
containing malicious script. I do not know what this file does, if it is
needed or if it is indeed malicious.

It is not legit and is probably malware. So a separate scan with an
alternate AV (eg free AVG) and for malware with AdAware and Spybot is
indicated.