mshta.exe is normally a legitimate Windows component called the Microsoft HTML Application Host. It runs HTML Application (.hta) files and can execute JavaScript or VBScript. The recurring popup is not proof that mshta.exe itself is infected: another program, scheduled task, shortcut, registry entry, local file, or URL is repeatedly asking it to run something.
Do not delete C:WindowsSystem32mshta.exe or C:WindowsSysWOW64mshta.exe. Capture the command line and parent process first, then remove or repair the trigger, scan Windows, and verify that it does not return.
As an Amazon Associate I earn from qualifying purchases.
What mshta.exe does
HTML Applications run outside the normal browser sandbox, so an HTA can access local files and Windows scripting interfaces. That is useful for some legacy utilities and installers, but it also makes the signed Windows host attractive to attackers. Microsoft documents malware that uses malicious shortcuts, JavaScript, VBScript, remote HTA content and persistence mechanisms with mshta.exe (malicious LNK examples; script-based malware and persistence).
On a normal installation, the executable is under the Windows directory. A copy in %AppData%, %Temp%, Downloads, %ProgramData% or a random user-created folder is a major warning sign.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
Is mshta.exe malware?
| Finding | What it suggests |
|---|---|
Microsoft-signed file in System32 or SysWOW64 |
Probably the legitimate host; the content it runs still needs checking. |
Local .hta belonging to an installed legacy application |
Could be legitimate; verify the publisher and installation. |
URL, javascript: or vbscript: argument |
Suspicious until you can identify and trust the source. |
| File under a temporary or profile-writable folder | High-risk location, especially with an unfamiliar name. |
| Recurring scheduled task or startup entry | Persistence is likely; investigate the task or entry. |
PowerShell, cmd.exe, rundll32.exe or downloader child process |
Strong indicator of malicious activity. |
A Microsoft signature authenticates the host binary, not the script, URL or file supplied to it. Conversely, a script-error dialog can come from obsolete software, a missing local file, a dead remote URL or a stale task after antivirus removed the original payload. A single error is not conclusive.
Record evidence before changing anything
- Copy the complete popup text, including script line and character numbers.
- Record every
.hta,.js,.vbs,.cmdor.ps1path and any URL shown. - Note whether it appears at sign-in, on a timer, only while online, or after opening one application.
- Capture the process ID, parent process and full command line while the popup is visible.
- Save the date the behavior began, recent installations and any security-detection name.
A screenshot helps, but the command line, file path, URL and task name are more useful for diagnosis. Do not double-click a suspicious HTA or script to inspect it.
Find exactly what launched it
Verify the executable and signature
Get-Command mshta.exe | Select-Object Source
$paths = @(
"$env:windirSystem32mshta.exe",
"$env:windirSysWOW64mshta.exe"
)
$paths | ForEach-Object {
if (Test-Path $_) {
Get-Item $_ | Select-Object FullName, Length, LastWriteTime
Get-AuthenticodeSignature $_ | Select-Object Path, Status, SignerCertificate
}
}Run PowerShell as the affected user. The path should be under the Windows directory and the signature should normally be Valid with Microsoft as signer. That result does not certify the payload.
Capture the command line
Get-CimInstance Win32_Process -Filter "Name='mshta.exe'" |
Select-Object ProcessId, ParentProcessId, ExecutablePath, CommandLineInspect CommandLine for a local HTA, an HTTP or HTTPS URL, inline script, PowerShell, command shell, a random filename or an obfuscated argument. Paths in %Temp%, %AppData%, %ProgramData% or Downloads deserve particular scrutiny.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Identify the parent process
$processes = Get-CimInstance Win32_Process
$mshta = $processes | Where-Object Name -eq 'mshta.exe'
$mshta | ForEach-Object {
$parent = $processes | Where-Object ProcessId -eq $_.ParentProcessId
[pscustomobject]@{
MshtaPID = $_.ProcessId
ParentPID = $_.ParentProcessId
ParentName = $parent.Name
ParentCommand = $parent.CommandLine
MshtaCommand = $_.CommandLine
}
}taskeng.exe or a service host can indicate a scheduled task; explorer.exe often points to Startup, a shortcut or a user action; a browser may indicate a download or compromised page; an installer may be legitimate. powershell.exe, cmd.exe or another script host as parent or child raises the risk.
Check scheduled tasks
- Press Win+R, enter
taskschd.msc, and open Task Scheduler Library. - Review tasks triggered at logon, startup, on a timer or when idle.
- On each suspicious task, inspect Actions, Triggers, author, description and associated file.
Search task actions from PowerShell:
Get-ScheduledTask | ForEach-Object {
foreach ($action in $_.Actions) {
if ($action.Execute -match 'mshta|powershell|cmd|wscript|cscript' -or
$action.Arguments -match 'mshta|.hta|javascript:|vbscript:|powershell|.js|.vbs') {
[pscustomobject]@{
TaskName = $_.TaskName
TaskPath = $_.TaskPath
Execute = $action.Execute
Arguments = $action.Arguments
}
}
}
}Do not delete a task solely because it mentions mshta.exe. Disable a clearly malicious or obsolete task first, record its settings, restart, and confirm the diagnosis before deleting it. Enterprise, update and accessibility tasks can look unfamiliar.
Inspect Startup and other persistence with Autoruns
Microsoft Sysinternals Autoruns inventories Startup folders, Run/RunOnce keys, scheduled tasks, services, Winlogon entries and more. The page currently lists Autoruns 14.3, published June 17, 2026; versions and labels can change.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Download it only from Microsoft Sysinternals and run it as administrator.
- Enable Hide Signed Microsoft Entries.
- Search for
mshta,.hta,javascript:,vbscript:,powershelland profile or temporary paths. - Use Properties to view the complete command line, publisher and file location.
- Uncheck a clearly malicious entry first, restart and verify that the popup stops. Remove its file only after preserving evidence and confirming it is unwanted.
Autoruns also provides Autorunsc for command-line work and can inspect other profiles or offline installations. It identifies entries; it does not decide whether an unfamiliar item is safe.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Scan and harden Windows
- Open Windows Security, update security intelligence, and run a Full scan.
- If the popup or persistence continues, save work and run Microsoft Defender Offline. Microsoft’s cleanup guidance is at Protect your PC from unwanted software.
- Review Protection history for the detection name and quarantined path.
Update-MpSignature
Start-MpScan -ScanType FullScan
Start-MpWDOScanStart-MpWDOScan restarts the computer and may require administrator rights; it is not exposed on every managed or nonstandard installation.
For potentially unwanted applications, open Windows Security → App & browser control → Reputation-based protection → Potentially unwanted app blocking and enable app and download blocking where available. Microsoft describes these controls at Protect your PC from potentially unwanted applications. PUA blocking does not detect every malicious HTA or persistence entry.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Repair a legitimate cause
If the command points to a known vendor application, repair or update that application from its official source. If it is obsolete, uninstall it and remove its no-longer-needed task only after confirming ownership. A dead URL or missing dependency can be fixed by the vendor; blocking or deleting the Windows host may break other software.
Recommended Free Tools
If the source is a malicious file or URL, disconnect from the network when active compromise is suspected, quarantine rather than open the file, disable its persistence, and run both Defender scans. Change important passwords from a known-clean device if credential theft is plausible. On a work or school computer, contact the administrator instead of deleting managed tasks or security controls.
Rank #4
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
What not to do
- Do not delete or replace the Microsoft
mshta.exebinary. - Do not assume Task Manager’s process name explains the payload; obtain the full command line and parent.
- Do not open a suspicious HTA, shortcut, JavaScript, VBScript or PowerShell file.
- Do not delete every unknown task or registry value; disable and investigate first.
- Do not run several real-time antivirus products together or permanently disable Defender.
- Do not treat a clean scan as proof that a startup or scheduled-task trigger is gone.
If the popup keeps returning
- Capture the command line and parent again while it is visible.
- Search all scheduled-task actions and review Autoruns as administrator.
- Check every Windows user profile, recently installed application and browser extension.
- Run Defender Offline and recheck Protection history.
- Restart, repeat the CIM query, and verify that the triggering entry is disabled or removed.
Escalate to a qualified professional or your organization’s security team if scans and persistence cleanup fail, credentials may have been stolen, security tools were tampered with, several devices are affected, or the computer holds sensitive information. A reset or reinstall can be appropriate when compromise cannot be confidently removed, but it is not the first response to every script error.
Frequently Asked Questions
Will ending mshta.exe stop the popups permanently?
No. Ending the process stops only the current instance; the task, shortcut, startup entry or parent application can launch it again.
Should I block mshta.exe with a firewall or policy?
Not automatically. Blocking it can break legitimate legacy or line-of-business software. First identify the command and, in managed environments, have an administrator assess application-control policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
