Strange folder on C:\ containing mrtstub.exe

Hello,
I have a folder whose name is a large mixture of characters and letter. Required Admin privilege to open and in there is one file mrtstub.exe, 83 KB dated 3/4/12.
Looked it up and some sites state it is a virus, might be a virus or is part of the Microsoft Malicious Software Removal Software. I've software in MS updates but I've never seen it run and don't know how to run it or if I want to run it. I have MSE updating but not running real-time protection. Use it as a manual scan once a week.
So the question is, can I delete the file and the folder. I mean it is dated 3/4/12.
Any assistance is appreciated!
Glenn

Hi Glennc

Please read this page:
The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows 7, Windows Vista, Windows Server 2003, Windows Server 2008, or Windows XP

and especialyy the section: How to remove the Malicious Software Removal Tool
Good luck

Hanna 1 said:

Hi Glennc

Please read this page:
The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows 7, Windows Vista, Windows Server 2003, Windows Server 2008, or Windows XP

and especialyy the section: How to remove the Malicious Software Removal Tool
Good luck

Thank you Hanna 1,
That sure covers that, much appreciated! Looks like one of those sometimes occurred.
Cheers
Glenn

You are very welcome

My laptop downloaded updates tonight and restarted. After restarting I had two files with an odd combo of letters/numbers. I deleted one. One says I must have admin permission to delete it. I am the only person who uses my computer and I am the administrator. Also, the file has a little lock icon on it. Here, please see this image to see the weirdness in my C:\ drive: http:// img3. imageshack. us/img3/3806/whatisthisz. png

Remove spaces to go to the link. I didn't know if I was allowed to post links or not since I just joined.

Also my C:\ drive doesn't have the mrtstub.exe file but I encountered the start of my problems when things were downloading and I looked in my task manager and saw mrtstub.exe and mrt.exe (which was using up a lot of CPU) and then restarted to install updates then when it rebooted I had all this weird stuff. I also was not allowed to run my malwarebytes so I redownloaded it to my desktop under a different name and ran it from there (it didn't find anything).

If you can provide any assistance I would be forever grateful.

I just checked and my windows update says that the one from today failed. Apparently I have to delete everything that is in the install thing from today and then try to reinstall? There are quite a few files and I need to go to bed now.

sjacks88 said:

My laptop downloaded updates tonight and restarted. After restarting I had two files with an odd combo of letters/numbers. I deleted one. One says I must have admin permission to delete it. I am the only person who uses my computer and I am the administrator. Also, the file has a little lock icon on it. Here, please see this image to see the weirdness in my C:\ drive: http:// img3. imageshack. us/img3/3806/whatisthisz. png

Remove spaces to go to the link. I didn't know if I was allowed to post links or not since I just joined.

Also my C:\ drive doesn't have the mrtstub.exe file but I encountered the start of my problems when things were downloading and I looked in my task manager and saw mrtstub.exe and mrt.exe (which was using up a lot of CPU) and then restarted to install updates then when it rebooted I had all this weird stuff. I also was not allowed to run my malwarebytes so I redownloaded it to my desktop under a different name and ran it from there (it didn't find anything).

If you can provide any assistance I would be forever grateful.

sjacks88 said:

I just checked and my windows update says that the one from today failed. Apparently I have to delete everything that is in the install thing from today and then try to reinstall? There are quite a few files and I need to go to bed now.

Hello sjacks88 and welcome to Seven Forums.

I'm not an expert at anything but here's what I think I know.

I tried removing the spaces from the imageshack link you provided but I got a "page not found" error. Don't know if you mis-typed it or if I did something wrong. But it's OK to upload screenshots and files on this Forum. Why did you feel the need to delete one of the files? Did you know for sure what the file was for?

Screenshots and Files - Upload and Post in Seven Forums

mrtstub.exe and mrt.exe are part of the Malicious Software Removal Tool. Microsoft releases an updated version of the tool on the second Tuesday of every month as part of "Patch Tuesday". When the tool is downloaded it will scan your computer for malware and while doing so it can use a good amount of resources. If it finds malware it will help to remove it. If the computer is clean, I believe the tool is automatcially removed from the computer. You can also run the latest version at any time from here:

Download: Windows Malicious Software Removal Tool - Microsoft Download Center - Download Details

It's possible that during the attempt to install updates one or more files became damaged or corrupt. Depending on how many updates there were, it's sometimes better to turn off automatic updating and install the updates manually just a few at a time. Keep track of the KB numbers and reboot after each group or 3 or 5. If problems occur you'll know which group of updates is at fault. You can then uninstall those 3 or 5 updates and install them one at a time, rebooting after each one. They'll either all install correctly or you'll know exactly which update is the problem. Yes, it's a lot slower this way but I've had great success on my own computers. Do you have a system restore point that wa made prior to this latest batch of updates? If so, you could roll back your computer to a date/time prior to the updates and then try reinstalling just a few at a time.

System Restore

After using a restore point or manually removing the latest updates, I'd also suggest running a System File Checker scan from an elevated command prompt (option two, this tutorial.) The SFC scan will try to fix any damaged or corrupt system files.

SFC /SCANNOW Command - System File Checker

And after restoring your machine (or manually removing the latest updates) and running the SFC scan, I'd suggest running a full scan with your primary antivirus suite and then another scan with Malwarebytes. Please post back if any of this helped or not.

Thanks for the tips. I've hopefully uploaded the screenshot I meant to share with you originally. I'm trying to uninstall a few updates at a time and keeping track of the kb numbers and I'll report back once I've uninstalled everything and reinstalled the update properly.

Thanks again for your help. Given the behavior of my computer I think it probably is just the update fail that caused my problems.

Okay so I uninstalled the updates that said they failed and reinstalled them, ran MST.exe, did the "sfc /verifyonly." sfc /verifyonly said "Windows Resource Protection did not find any integrity violations."

The weird locked folders look the same as in the screenshot still.

I didn't uninstall every download from last night since I found the kb #s for the ones that failed in my upload history and just reinstalled those. Could that still be causing problems?

There don't appear to be any problems with the way my computer is running. I scanned the weird locked folders with malwarebytes and it didn't detect anything. I can get into the weird letter/number combo folder but it won't let me open any of the sub folders. Here's a screenshot of what it looks like inside (there are several more numbered folders if you scroll up).