Program file
7.hta: what the file is and whether it is a virus
7.hta is an HTML Application (HTA) file that reports link to TeamViewer, where it is said to display a promotional or notification pop-up. Security tools sometimes flag it. Check where it sits and who signed it before you decide; an HTA file is a script that Windows runs, so a copy in the wrong place deserves care.
Prefer to check it yourself? The manual checks follow.
The old report associates 7.hta with TeamViewer and says it is not a Windows component. An alert from a security product was reported to be a false positive in most cases.
HTA files run script code through mshta.exe, and attackers have used that route for years. A 7.hta outside a TeamViewer folder, or one you cannot tie to an installed program, is not safe to assume.
- File type
- HTML Application (.hta), a script file run by mshta.exe
- Reported program
- TeamViewer (remote access and support software)
- Reported purpose
- Showing a promotional or notification pop-up, per the old page
- Part of Windows
- No. The old page states it is not an essential operating system component
- Folder
- Inside the TeamViewer program folder if genuine; the old page gives no path, so check yours
- Reported detection
- A generic heuristic name, “IDP.Generic”, from one antivirus product; reported as a false positive
- Other claims
- An “Amazon Assistant virus” link appeared on the old page; no source supports it
What 7.hta is
An HTA is a Microsoft HTML Application: a page of HTML and script that Windows runs as a stand-alone program through mshta.exe, outside the browser and its security settings. Internet Explorer retired on 15 June 2022, but mshta.exe and the HTA format remain in Windows.
The old page reports that TeamViewer uses 7.hta to show promotional pop-ups and similar notices. We could not confirm this from TeamViewer’s own documentation, so treat it as a report, not a fact. The file can also arrive with other programs, some legitimate and some unwanted.
Malware authors reuse the names of ordinary files, and HTA is a well-known way to run scripts: MITRE ATT&CK lists it as technique T1218.005, used by groups including APT29, FIN7 and Lazarus Group. So the name 7.hta alone says nothing; the location and signer decide.
How to check 7.hta
Do these in order. Stop when the file is explained.
- Find where the file is Search for it and note the full folder. A copy inside the TeamViewer installation folder fits the report. A copy in Downloads, Temp, AppData or a folder with a random name does not.
dir /s /b C:\*7.hta - Check that TeamViewer is installed Open Settings > Apps > Installed apps and look for TeamViewer. If you never installed it and the file is there, treat the file as unexplained.
- Check the file with Microsoft Defender Update Windows, then run a full scan from Windows Security > Virus & threat protection > Scan options. If the alert stays or you doubt the result, run the Microsoft Defender Offline scan, which runs before Windows starts.
- Look at what runs mshta.exe In Process Explorer from Microsoft Sysinternals, check whether an mshta.exe process is running and what started it. mshta.exe running with no program you recognise behind it needs investigation.
- Get a second opinion A single generic detection name is weak evidence either way. A reputation check of the file’s hash in an online multi-engine scanner shows whether many engines agree.
A clean scan does not prove the file is TeamViewer’s, and one generic detection does not prove it is malicious. The folder and the program behind it settle the question.
Do you need 7.hta?
No Windows feature depends on 7.hta. If it belongs to TeamViewer, it is part of that program, not something to delete alone.
- Keep it if you use TeamViewer If TeamViewer is installed on purpose and the file sits in its folder, leave it. Deleting one file from a program can break it or be undone by an update.
- Stop TeamViewer starting with Windows Open Task Manager > Startup apps, select TeamViewer and choose Disable. Inside TeamViewer, the options also let you turn off starting with Windows.
- Uninstall the program if you do not use it Settings > Apps > Installed apps > TeamViewer > Uninstall. Remove the program, not the single file, so nothing reinstalls it.
- If it is not from TeamViewer If the file is somewhere unexplained, run the full and offline Microsoft Defender scans, then check Task Manager > Startup apps and Task Scheduler for entries you do not recognise. Remove unfamiliar programs from Settings > Apps.
Warning signs around 7.hta
| What you see | What it means |
|---|---|
| A security product reports 7.hta as IDP.Generic | A generic heuristic match. The old page reports it was usually a false positive when the file came with TeamViewer. |
| 7.hta outside the TeamViewer folder | Not explained by the program. Scan it and find what put it there. |
| mshta.exe running without a program you recognise | HTA files are launched this way, and MITRE ATT&CK documents it as an execution route for malware. |
| More ads, pop-ups and banners than before | A sign of an unwanted program, listed on the old page. It does not point at 7.hta by itself. |
| Browser redirects to questionable sites | The old page lists this as a symptom of unwanted software; check browser extensions and installed apps. |
| Repeated Windows errors after an install | Another symptom on the old page. Note what you installed just before they began. |
Someone claiming to be Amazon asked me to install TeamViewer
Is this a scam, and what is its link to 7.hta?
Yes, almost certainly. The FTC says anyone who offers a refund and asks for remote access to your computer is a scammer, and that you should never give remote access to someone who contacted you unprompted. Typical scripts claim a suspicious Amazon charge or a refund keying error, then ask you to install a remote-control program.
TeamViewer is a genuine program that scammers misuse. A 7.hta file on your PC only shows TeamViewer was installed; it does not mean the person was real.
What do I do if I already let them in?
End the session, close TeamViewer and uninstall it if you did not intend to keep it. Disconnect from the internet if the session is still open.
Call your bank on its published number, change passwords from a clean device, and run full and offline Microsoft Defender scans. Report it at ReportFraud.ftc.gov or your national fraud service. Do not send money back to anyone: fake “refunds” are often shifted between your own accounts.
Questions people ask
Is 7.hta a virus?
Usually not, if it sits in the TeamViewer folder and TeamViewer is installed. The old page reports that a heuristic alert on it was a false positive in most cases. It cannot be ruled out from the name alone, because HTA files run scripts and malware uses the format. Check the folder, the signer and a full scan.
What is an HTA file?
An HTA is an HTML Application: HTML and script code that Windows runs as a program through mshta.exe, outside the browser. It has the permissions of the user who opens it. That is why it is useful to developers and also why attackers use it to run scripts.
Why does my antivirus flag 7.hta?
A generic detection such as IDP.Generic is based on how the file looks, not on a known threat, and script files trigger it often. Update the security software and rescan. If the alert remains, run the Microsoft Defender Offline scan and check the file’s folder.
Is 7.hta connected to an Amazon Assistant virus?
No source we checked supports that link. The old page repeated a claim that researchers associate the file with Amazon Assistant. Judge the file by its folder, signer and scans, and check Settings > Apps and your browser extensions for programs you did not choose.
Can I delete 7.hta?
You can, since Windows does not need it, but delete the program it belongs to, not only the file. If it comes from TeamViewer, uninstall TeamViewer from Settings > Apps. Removing just the file can break the program or be reversed when it updates.
How did 7.hta get on my PC?
Most likely with TeamViewer. Other programs can bring HTA files too, and some are bundled with freeware. Choose Advanced or Custom setup, untick extra offers, and download only from the publisher’s own site. Read each setup screen, because quick or recommended settings often hide third-party offers that install without clear notice.
Sources
- MITRE ATT&CK T1218.005: System Binary Proxy Execution, Mshta
- FTC: Amazon impersonators, what you need to know
- FTC: Scammy texts offering refunds for Amazon purchases
- TeamViewer Community: tech support scam discussion
Version data read on Oct 8, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…