What is MPSigStub and can it be safely deleted?

[ramblinflebro]

Suddenly a folder appears on my external hard drive. It has a name of mixed letters and numbers about 3 inches long. Inside the folder is an executable named MPSigStub. All I can find out, it seems to have something to do with Windows updates. I also read, it could very well be spyware if I find it on my C drive, which I have. I have scanned it with Norton and two spyware programs and nothing. What is this? Can it be safely deleted? Thank you.

 

[richc46]

Did you scan with malwarebytes, if not do so.
Run the long scan
update before using.

 

[Bill2]

MpSigStub.exe is a MS installer application used in conjunction with Windows Automatic Updates. It extracts update files to a temporary directory.

How the Forefront Client Security Antimalware Service updates the anti-malware engine files and the anti-malware definition files

However, some malware may also camouflage themselves as MPSigStub.exe, particularly if they are located in c:\windows or c:\windows\system32 folder. So run a malware scan on your MPSigStub.exe process to make sure its clean.

I guess, if you delete it, it'll probably recreate itself. Rename it to see what happens. E.g. rename MpSigStub to MpSigStub.old. Most likely it will recreate if they are necessary ( or give you an error message) as the system won't be able to find them. If they turn out to be necessary just remove the .old and you are back in business.

 

[ramblinflebro]

I have ran full scans with Norton and Malwarebytes. Both report no infections. My concern is as Bill2 stated in his post, some malware can camouflage themselves. Why is it in 2 different location? Any input would really be appreciated.

 

[Bill2]

I have ran full scans with Norton and Malwarebytes. Both report no infections. My concern is as Bill2 stated in his post, some malware can camouflage themselves. Why is it in 2 different location? Any input would really be appreciated.

I would suggest you just rename the files to .OLD, if the windows updates process works smoothly even then, you know the files will recreate. Then you can delete the existing files or just let them be if they are not flagged by AVs.

 

[ramblinflebro]

Thanks Bill2.

 

[juanitatx11]

Same Issue Windows 7 32 bit

I have the application MPSigStub.exe also with a file name of baccdd9d29efdcfe6265e7 in C:. Only when I try to change the extension to old, my system lets me know that I need permissions from myself to make the change. I can get in to adjust permission, but it defaults back as if I am not. It was also listed in System 32 but that one I could delete.