stdrt.exe running from windows temp??

[Snowdog]

My firewall keeps triggering on stdrt.exe

from: Windows/Temp/mrt643E.tmp (or Similar, because it regenerates if deleted)

I can delete that directory and it will regenerate. I see other queries about this one on the web. It isn't tripping anyone's virus detectors, but anything that keep regenerating itself, running out of temp and trying to contact the internet seems suspicious. I want to know what it is.

That directory is also full of file ending in .mfx. Which points to multimedia fusion.

Anyone have this directory in Temp, anyone know what is causing it?

 

[not so gray matter]

Apparently it's an MMF runtime. It appears when you test your applications via MMF.

That's because myappname.exe runs, containing the decompression code and your application (as stdrt.exe). It extracts stdrt.exe to a temporary directory and runs it.

 

[Snowdog]

But what the heck is MMF/Multimedia fusion? Is this part of windows?

It appears to be a framework for easy app building, so something I have installed was built with this app and it keeps putting an EXE in temp and calling home? Seems very shifty.

 

[not so gray matter]

I was assuming that you build applications...

Apparently it's also malware, maybe? I'd run Malwarebytes' Anti-Malware

Malwarebytes

All in all, remove the following files:

C:\WINDOWS\SYSTEM\REGSRV.EXE
C:\WINDOWS\TEMP\MRT2.TMP\STDRT.EXE

Source: http://www.greatis.com/appdata/d/s/stdrt.exe.htm

 

[Snowdog]

Actually I found it.

Kind of Duh, moment, but for future reference to anyone else hitting it.

It was Gigabytes Easytune software. Even though I don't have it set to run on startup, it was still running it's background process.

The Duh moment. There was a UAC query at startup to let it modify the system, I was just blindly hitting yes for a while.

When I finally said no, there was no stdrt.

Edit: not 100% sure on that. I deleted a few things and removed the REGSRV.EXE

Anyway whatever it was, is cleared now.

 

[Delphinus]

I have this bloody thing on my system as well. I thought I had cleaned it last week but it's back. I even deleted it and replaced it with another exe and hid the file, and it came back. It's using almost 300MB of memory and since I spotted it on my system have noticed serious performance issues.

It's pissing me off. Gonna try a few a few more things...

 

[mrcamoturtle]

Same thing here...

Stdrt.exe takes up all of my memory on start up... What the heck is this thing???

 

[Delphinus]

Stdrt.exe takes up all of my memory on start up... What the heck is this thing???

I am usually quite good at cleaning malware, but this thing tested me.

Malwarebytes ended up letting me down... So I went looking else where. UnHackMe, the free version, is what ended up cleaning it.

I also used Combofix and HiJackThis! for good measure.

 

[Jacee]

You might also want to use (and keep) TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB). Before running, it will stop Explorer and all other running apps. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.

TFC only cleans temp folders. TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail. TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

 

[Delphinus]

You might also want to use (and keep) TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB). Before running, it will stop Explorer and all other running apps. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.

TFC only cleans temp folders. TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail. TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

Great suggestion. I will do that myself also.

 

[Edwardelizabeth]

Hi to all, i have personally wrote a reply to this on january 2012. There seems to be a new version of the STDRT.exe virus.. I had tried numerous ways to delete this but upon reboot the file STDRT.exe always reappeared in my Temp folder.. I found a way to remove it after lots of trys with different softwares .. none of them worked.... The 1 bit of software that worked was NORTON POWER ERASER.... (NPE) once your system has rebooted it is also wise to run REGEDIT from your start search and do a search for STDRT ... (not STDRT.exe) you will find 2 or maybe 3 reg entries to remove. I hope this has helped you people out there and happy computing

 

[opling]

Hi to all, i have personally wrote a reply to this on january 2012. There seems to be a new version of the STDRT.exe virus.. I had tried numerous ways to delete this but upon reboot the file STDRT.exe always reappeared in my Temp folder.. I found a way to remove it after lots of trys with different softwares .. none of them worked.... The 1 bit of software that worked was NORTON POWER ERASER.... (NPE) once your system has rebooted it is also wise to run REGEDIT from your start search and do a search for STDRT ... (not STDRT.exe) you will find 2 or maybe 3 reg entries to remove. I hope this has helped you people out there and happy computing

what will happen if i delete that register?

 

[toilet goat]

this worked for me

hello all, I just want to say I had this annoying stdrt.exe virus bugging me for two days on my windows 7 and I tried many programs to get rid of it but now I've at least solved my case of it

there's another file which runs a while in the background called "adbcnsl.exe" which is connected to the stdrt.exe , it cant be found from the windows file/folder exploring even with show hidden files option on, and neither could any malware / unhackme programs detect it

SOLUTION: using ms dos prompt go to windows\syswow64 folder, example;> c:\windows\syswow64 and type "dir /p" and check if the file is there listed; if it is, then type "del adbcnsl.exe" , if not file is found try checking c:\windows\system32 folder

the file should now be deleted, and remember to delete your folders containing stdrt.exe from c:\windows\temp, I'm not sure what the folder name was, something like "mprt_" which had the file in it

now boot up your computer, and if the operation was successful there shouldn't be any file called stdrt.exe launching

I hope this works for you guys as it did for me , but remember that I don't take any responsibility if your computer shatters

cheers

edit: also remember to clean your registry from stdrt.exe

 

[covekotx]

worked for me also

Thanx toilet goat,
This f@#$#@ problem left me with no sleep for 48 hours. Tried every possible software solution with no effect. Finally a proper solution coming from you. How in the world did you discover the background file?
Thanx a billion times.

 

[khaneliman]

Had to reply just to thank you man. Had this issue with my brand new computer I built from a program suite that came with in. Glad I could keep the software and rid the malware.

 

[BigWallaby]

Toilet Goat! Thank you so very much. I have had this malware and its effects for three or four months, with NONE of the antivirus programs picking it up. Awful little file. Thank you for the work you must have put into finding it. I know I put in a lot with no success. Thank you so very much!

 

[gilksc]

Thank you!!

Thank you toilet goat!
I hardly got any sleep last night and went to bed very frustrated over this one.

Cudos to you for however you found the adbcnsl.exe file...

I probably would have just smashed my computer and bought a new one if I didn't find this thread hahaha.

I signed up for this forum just to thank you.

 

[BloodfyaMo07]

Toilet Goat! Thank You! Much Gratitude to all who take the time to share

 

[ztrls]

if what toilet goat said doesn't work, check for a new file named "LNSECSL.EXE". It disguises itself as "Adobe Licensing Console"...
My best guess is that stdrt is introduced and installed in one's computer by means of cracking or keygen software. stdrt has been around for ages now, and it's a shame antivirus and malware programs do not even detect it. You can have stdrt in your computer for years, exhausting your computer's processing power, and your antivirus do nothing. I think only "Vipre" detects it, and not even the most respectful Eset does... I have submitted this file to different av providers, Symantec, Eset, Kaspersky... nothing; absolutely nothing!!!
Also search your registry for folders that appear with the name "adobe licensing console"... delete them all, don't think twice, IT IS A MALWARE and YES, IT DOES LEAK YOUR DATA TO THE "BASE". LNSECSL.EXE, unless deleted, will keep creating a folder in your "\windows\temp\" folder that will always contain among others the file STDRT.EXE that WILL OVERCLOCK YOUR COMPUTER TO MADNESS.
I hope this helps anyone.

 

[bobatron]

I also had this stdrt.exe process using a steady 12% of my CPU, so I....

I deleted LNSECSL.EXE and STDRT.EXE off my computer, did a search for both "stdrt" and "lnsecsl" in regedit and deleted every result it found, then I ran Temp File Cleaner by OldTImer for good measure. Rebooted and no more stdrt process in the task manager!