mshta.exe suspicious script - logon problem

[Chris Russell]

I have noticed that my computer does not ask for a login
password at the Welcome screen anymore. Instead, it just
logs straight on without asking.

When I go to Control Panel, User Accounts and click on
Change the way users log on and off, the following
message appears:

"McAfee VirusScan

The file mshta.exe contains suspicious scripting activity
and has been stopped.

I want to ...

Stop this script
Allow this script this time
Find out more information
Continue what I was doing"

If I select 'stop this script', the User accounts window
closes without letting me select "Use the Welcome Screen"
or "Use Fast User Switching".

Going into User Accounts window again, I then
select "Allow entire script at this time". Now it lets me
select the above options and save them, but when I
resatrt the machine it again bypasses the Welecome/Logon
screen.

HAs anyone encountered and beaten this problem?

 

[Doug Knox MS-MVP]

This is normal. MSHTA is the executable that processes HTA files. HyperText Application files are really just HTM files, but they bypass the normal security features of Internet Explorer, when run locally. This allows them to execute scripting code that can access the file system and registry. A lot of the "eye candy" interfaces in XP rely on HTA files for their presentation.

 

[pauly [MSFT]]

Hi Chris,

Regarding your post below, it sounds like AutoAdminLogon is happening.

If this is true and you want to see if it can be disabled, please see the
following:

315231 How to Enable Automatic Logon in Windows
http://support.microsoft.com/?id=315231

Step #4c provides you with the value you may need to set/change.

=========

This posting is provided "AS IS" with no warranties, and confers no rights.

Windows XP Security Homepage:
http://www.microsoft.com/windowsxp/security/default.asp

Windows 2000 Security Homepage:
http://www.microsoft.com/windows2000/security/default.asp

Top 10 Windows Newsgroups Security Questions:
http://www.microsoft.com/technet/newsgroups/default.asp?url=/technet/newsgro
ups/nodepages/sectop10.asp

=========
Paul Hayes, MCSE
Product Support Services
Microsoft Corporation
(e-mail address removed)

--------------------
| From: "Chris Russell" <[email protected]>
| Subject: mshta.exe suspicious script - logon problem
| Date: Sat, 24 Jan 2004 17:30:19 -0800
|
| I have noticed that my computer does not ask for a login
| password at the Welcome screen anymore. Instead, it just
| logs straight on without asking.
|
| HAs anyone encountered and beaten this problem?
|