please explain "msohtmlclip1"

Stimson · 19 Dec 2014

Greetings;

Can anyone explain where this file name comes from?

I first encountered it in a Temp folder --[C:\users\user name\appdata\local\Temp] -- when it seemed (not sure) to be associated with a malware infection. At that time I believe it was an .xml file.

After some hassle I cleared the offending files of that infection (I hope!) but since that time I have found, within that same Temp folder, a sub-folder named "msohtmlclip1" (empty) and an "msohtmlclip.tmp" file.

I've searched the name online, and within this forum, and am still not sure if I am dealing with something malicious or not.

Thanks for any help.

MrRichGuy · 19 Dec 2014

It is a normal temp file don't worry

Stimson · 23 Dec 2014

Thank you, MrRichGuy, for the response but until I can get a more complete answer from someone I'm leaning toward malware -- or at least some other problem that I don't understand.

One reason: I can find no good explanation of that file online. And the few references I find seem to associate the name with online marketing.

Second Reason: msohtmlclip1 files regenerate in my Temp folder soon after deleting for no good reason that I can discover. As follows --

C:\Users\... user acct\AppData\Local\Temp\msohtmlclip1\01\clip_colorschememapping.xml 1 KB
C:\Users\... user acct\AppData\Local\Temp\msohtmlclip1\01\clip_themedata.thmx 4 KB

Third reason: When those files are present in the Temp folder, the user account opens up slowly and registers various errors in the log.

If no one knows the origin of this file, can anyone say whether it occurs on their computer? -- either
benignly or otherwise!

Thanks again. This forum is the go-to place for authoritative Win7 info.

Stimson · 24 Dec 2014

I'm calling this thread solved -- but it's really only quasi-solved.

Here's what I've discovered purely through observing the situation on my computer.

The following files:

C:\Users\... user acct\AppData\Local\Temp\msohtmlclip1\01\clip_colorschememapping.xml
C:\Users\... user acct\AppData\Local\Temp\msohtmlclip1\01\clip_themedata.thmx

are created whenever I save a new Word2010 .docx document, but ONLY if I have pasted something into that document! Those files aren't created if I just type text into the document and save.

But, if this is normal Win7 behavior, why haven't any of the hundreds of smarter-than-me folks reading this post filled me in? So, maybe it's not that normal... but unique?

So essentially still puzzled, but maybe will pursue it out of curiosity in some future thread.

Merry Christmas to all.

Anak · 25 Dec 2014

I was able to find this:

Actually, whilst anything can be associated with a virus, I wouldn't agree with Trimdoner here. msohtmlclip usually just relates to MS Office and likely means you've probably cut and paste from Word or Outlook and you've therefore pulled some code in which is bad. You should never do that, you should always paste as plain text as has been discussed many times before in this forum. The unfortunate thing for you is you will have to remember the page/s you might have done that on and recreate it/them without cutting and pasting and delete the original offending page out of your project.

Source: Can't publish website - once again need your help

If you break it down to MS Office html clip IMHO, whatever you cut/paste in Word or Outlook is being identified with the msohtmlclip tag so Office knows where to look for it.

Every time I've seen it during a search it is always in the same location that you find it C:\Users\... user acct\AppData\Local\Temp\ , is that where you always find it? The only other place you should find it is in the MS Office or Outlook Folders, if you find it in C:\Windows\System32\ then I'd say you have a problem.

If you can find it in your system go here: https://www.virustotal.com/en/ and have virustotal take a look at it.

And a Merry Christmas to you also!

Stimson · 25 Dec 2014

Anak, I completely missed that in my own search. It's the most helpful reference I've seen.

Thanks for taking the time.

No, haven't ever found any file with that name anywhere but the Temp folder.

Thanks, again.

Anak · 25 Dec 2014

Stimson said:

Anak, I completely missed that in my own search. It's the most helpful reference I've seen.

Thanks for taking the time.

No, haven't ever found any file with that name anywhere but the Temp folder.

Thanks, again.

You're welcome!

Don't be so hard on yourself, msohtmlclip (MSO) has been difficult for me to find also. I looked in System Lookup and Pacs Portal their operated by the same Paul Collins, the only difference is he's had problems(?) with system lookup and it isn't being updated any more.

Couple of items for this hunt, (I like a good mystery) are you could try a search with system files and Folders unhidden, that may be why you can't find them. And, research thru the NetObjects Forum, the member I quoted said:

You should never do that, you should always paste as plain text as has been discussed many times before in this forum.

He makes it sound like MSO has been dealt with before, but in the context of working with their web designer software NetObjects Fusion right there maybe a clue; msohtmlclip + web designer software = ?

So, unhide those Folders and Files and see if MSO pops up. Use this tutorial if you're unsure how to unhide them: Hidden Files and Folders - Show or Hide you should reverse the changes to hide when you're done.

Meanwhile...I'll keep looking, by the way, thank you for the rep!

please explain "msohtmlclip1"

please explain "msohtmlclip1"

msohtmlclip1 -- still searching