[Guide] What is mrtstub.exe?

Mrtstub.exe are files associated with the Windows Malicious Software Removal Tool. By default, this file is installed on your PC. Here is how to uninstall it.

 

The legit mrstub.exe file is a software component of the Malicious Software Removal Tool by Microsoft Corporation. The "Mrtstub.exe" file is benign and it exists so that it can be downloaded with a packed file("mrt.exe._p"), containing an updated version of the free MSRT (Microsoft Malicious Software Removal Tool)

MRTStub stands for Malicious Software Removal Tool Update Stub. The .exe extension on the file name shows it is an executive file. It is possible that in some cases an executive file can harm your computer.

While using Windows as your primary operating system, you might run into a file or process called mrtstub.exe or mrt.exe_p. These files are located in a folder with a long, alphanumeric name such as "d2cf4fd29fca9db1ed3f48" and other variations in the C:\Windows\System32 directory.

what is mrtstub.exe

Windows users are concerned about the folder or the files occasionally disappearing and reappearing on their own. Deleting them is near impossible in the old fashioned way - even if you think you do, the files come back.

By default, these are harmless files associated with the Windows Malicious Software Removal Tool (MSRT) made by Microsoft themselves. In some cases, this tool is automatically installed on your computer as a part of Windows itself.

The tool is designed to delete mrtstub.exe and the folder it’s located in after a run/scan is complete, then recreates it automatically the next time it's needed.

All this doesn’t mean that mrtstub.exe isn’t malware or a virus. It’s known that some dangerous applications disguise themselves as mrtstub.exe and harm your computer without you realizing it.

The damage caused by fake mrtstub.exe processes can be huge. The virus is able to infiltrate your computer and install malicious third-party applications, temporary internet cookies, and mislabeled files.

It’s always recommended to check if your mrtstub.exe file is legit or not. If you want to make sure your computer is safe, follow one of our methods below.

How to determine if mrtsub.exe is safe?

Are you not convinced that your computer is safe from a fake mrtstub.exe file? There are multiple methods to verify the file and get rid of it in case it is a virus.

Follow the steps below to determine whether or not mrtstub.exe is safe and how to remove it.

Check Digital Signature

One of the best ways to check if an application is legit is by taking a look at the digital signature included with the app.

Follow these simple steps to check the digital signature of mrtstub.exe:

a. Find mrtstub.exe on your computer:

  1. If mrtstub.exe is running as a process, you can locate it from the Task Manager.

    Right-click on your taskbar and choose Task Manager.
              task manager
    - Switch to the Details or Processes tab depending on your operating system.
              switch to details
    - Locate mrtstub.exe from the list.

  2. Otherwise, you need to manually find mrtstub.exe within your files. It’s usually found in the C:\Windows\System32 directory.

To do that follow the steps below;

  1. Right-click on mrtstub.exe and choose Properties.
    mrtstub.exe properties
  2. Switch to the Digital Signatures tab.
     mrtstub digital signature
  3. Check the signature. If it says Microsoft Windows, you should be safe. If it says anything else, you should remove the file immediately.
     remove files

    Note: Make sure to check if Microsoft Windows is spelt correctly. Malicious apps often try to disguise their files and make them appear as legit as possible.

Check mrt.log

If you have a legit mrtstub.exe file, you should also have one called mrt.log. This is the log file the Windows Malicious Software Removal Tool uses for generating reports after a scan.

It’s a huge red flag if the mrt.log file is missing, or if it’s empty after you see mrtstub.exe running on your computer.

You can use this method if you weren’t able to verify the digital signature because the file disappeared too quickly.

Here are the steps to locate mrt.log and verify if mrtstub.exe is malware or not:

  1. Open Run:

    - Hold down the Windows + R keys on your keyboard.
    Right-click on the Windows logo and select Run.
    Search for Run in your taskbar.

  2. Type in %systemroot%\debug and click on OK.
  3. Find mrt.log and double click on it.

    If you can’t find mrt.log in this location, your computer is most likely infected. You can jump to the steps about removing mrtstub.exe immediately.

  4. Check if the timestamps in the log match up with the time you saw mrtstub.exe running on your computer. 

If the mrt.log file is empty or the timestamps are different, your computer is most likely infected and mrtstub.exe should be removed immediately.

Scan your Computer

Even after performing the methods above, it’s recommended to run a full system scan on your computer after you discover mrtstub.exe running on it.

You can find a variety of antivirus software online, however, not all of them are of good quality. Especially if you’re looking for something that’s free.

An application that received good reviews from users is Malwarebytes. Even its free version is able to detect malicious files on your computer and provide a relatively high level of security.

Some other solutions are Emsisoft, Norton AntiVirus, Avast, Bitdefender, or AVG. Some of these applications offer paid services, which is excellent for users who require advanced features.

You can follow these steps to download and run any of the antivirus applications mentioned above:

  1. Open the official website of the application. In this guide, we will be downloading Malwarebytes from malwarebytes.com.
  2. Find the download link for the edition you wish to have and download the installer.
  3. Open the file you downloaded and follow the on-screen instructions to install Malwarebytes.
  4. Launch Malwarebytes.
  5. Switch to the Scan tab on the left

      switch to scan

    6. Select Threat Scan. Optionally if you purchase Premium or gained a free trial period of it, you can do a Hyper Scan.

     Mwalwarebyte threat scan

    7. Click on Start Scan.

    8. Wait for Malwarebytes to finish scanning your computer. This might take a long time, but after it’s done, your computer should be free of any harmful apps and viruses.

How to Install or Remove mrtstub.exe

How to download the Malicious Software Removal Tool (mrtstub.exe)

  1. The only place you should ever download mrtstub.exe from is Microsoft’s official website. You can confirm that you’re on the right site by checking on the lock symbol in front of the website URL in your browser.
          secure connection
    Make sure to check if “Microsoft” is spelt correctly. Scam websites usually try to match the look of official Microsoft websites, but they can never use the same URL and have a secure connection as well.

    If the website offering you a download for the Malicious Software Removal Tool (mrtstub.exe) isn’t microsoft.com, do not download it under any circumstances.

  2. You can choose the bit version you want to download by clicking on Change systems.
  3. Click on the Download button.

How to install the Malicious Software Removal Tool (mrtstub.exe)

  • To run the tool after it’s done downloading, open the downloaded file and click on Run.
  • You can save the file for later if you want to run the removal tool later by clicking on Save.

System Requirements

Supported operating systems:

  • Windows 10
  • Windows 10 Tech Preview
  • Windows 7
  • Windows 8
  • Windows 8.1
  • Windows Server 2008
  • Windows Server 2008 R2
  • Windows Server 2012
  • Windows Server 2012 R2
  • Windows Server 2016
  • Windows Server Tech Preview

Your user must have administrative permissions to run this tool.

How to remove the Malicious Software Removal Tool (mrtstub.exe)

a. If mrtstub.exe is running as a process:

  1. Right-click on your taskbar and choose Task Manager.
  2. Switch to the Details or Processes tab depending on your operating system.
  3. Locate mrtstub.exe from the list.
  4. Click End task.

b. Delete the files with antivirus software or by locating them on your hard drive. You can search for mrtstub.exe and mrt.exe to find them.

We hope that you were able to find out what mrtstub.exe is, how to install it, and why it might be potentially dangerous to your system. Make sure to regularly run scans with one of the antivirus applications provided above to ensure the safety of your system at all times.

If you want to read more useful articles about Windows, its applications, and other technology-related topics, feel free to browse our section by clicking here.