What is mrtstub.exe?

The genuine mrtstub.exe file is a software component of Malicious Software Removal Tool by Microsoft Corporation.
"Mrtstub.exe" is a benign Microsoft file. It exists to be downloaded with a packed file ("mrt.exe._p"), containing an updated version of the free Microsoft Malicious Software Removal Tool (MSRT), into a randomly-named folder at the root level, (e.g., "C:\d2c6febc4a2e9369b5ee1d\mrtstub.exe"), where it executes and unpacks "mrt.exe" into "C:\Windows\System32" for use. A third file named "$shtdwn$.req", whose purpose is unclear although the filename occurs with other Microsoft update downloads, also appears in this randomly-named folder. After the MSRT runs, if this folder is not automatically deleted it is safe to do so manually. If a user of Win7 (and later) has enabled Windows Update, the current month's MSRT version usually downloads on "Patch Tuesday," the month's second Tuesday. (Manual downloading is allowed.) Each month's version finds and removes only actively running, currently prevalent viruses, worms, and Trojan horses. It cannot detect spyware and is no substitute for an active antivirus program.

MRTStub stands for Malicious Software Removal Tool Update Stub

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the mrtstub.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for mrtstub.exe related errors

Mrtstub.exe file information

Windows Task Manager with mrtstub
Mrtstub.exe process in Windows Task Manager

The process known as Malicious Software Removal Tool Update Stub belongs to software Microsoft or Malicious Software Removal Tool Update Stub by Microsoft (

Description: Mrtstub.exe is not essential for Windows and will often cause problems. Mrtstub.exe is located in a subfolder of C:\—in most cases C:\d2cf4fd29fca9db1ed3f48\. Known file sizes on Windows 10/8/7/XP are 91,848 bytes (10% of all occurrences), 93,368 bytes and 8 more variants. 
The program has no visible window. The file is certified by a trustworthy company. The mrtstub.exe file is not a Windows core file. Therefore the technical security rating is 30% dangerous; however you should also read the user reviews.

Uninstalling this variant: The software vendor offers the option to uninstall the program using the Control Panel ⇒ Uninstall a ProgramMicrosoft Corp..

Recommended: Identify mrtstub.exe related errors

Important: Some malware camouflages itself as mrtstub.exe. Therefore, you should check the mrtstub.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

file size, Vista: 96216 bytes
w2k size 24,512 - found in root dir of my K-drive - one of 5 partitions on a 2nd HDD
Appears to be a component of updating Microsoft's malware removal tool
MRTSTUB is the responsible process for corrctly copying and running updated versions of MRT.exe (Malicious Removal Tool).
While I was searching for info about mrtstub.exe it disappeared !
Its in my C:\ and the folder is called "50707cf31c8607e74f" size: 21mb. There are 2 exe-files, mrt.exe and mrtstub.exe.
It is a virus disguised as a malware removal tool that is currently wreaking havoc on my computer.
Belongs to Microsoft for MSRT process but if you have a good antivirus program you dont need this.Runs only if MSRT STARTS automatically(by Microsoft or if you install one version of this and start it by yourself) .Works with mrt.exe
as on the top is gone while serching for info about it
It's malware. It's disguised as a malware removal tool component. My computer is now fucked.
It's part of a temporary folder create during some instances of Windows Update
I just plugged in my USB drive and found a folder called "8f29542393f2fd5ba8702407d9b83ec8" on it. Inside was mrtstub.exe, mrt.exe._p, $shtdwn$.req, and one other file that disappeared while I was typing this. This file/folder was created by Windows Update as I was doing an update that included Microsoft's Malicious Software Removal Tool when I noticed it and it was gone after the update. I don't know why it went to my USB drive, but it did. The folder just disappeared and a new folder popped up "d25e846428511717f63956" which contained more Windows Update files.
Categorized as harmful in here
  ghong   (further information)
It can appear in a folder with a garbled name on a flash drive or separate drive division sometimes with mrt.exe. If so, REMOVE IT.
The previous comment referring to included a reader's comment casting doubt on the report's accuracy; the website that reader provided led to what may be a more believable analysis (see link below). What it boils down to is that the mysterious folder containing mrtstub.exe was left over from when the Microsoft Malicious Software Removal Tool was run, when it should have been deleted automatically. Microsoft tells us the folder can be deleted manually and safely.
  Passingby   (further information)
When I have been running late and had things to do after work my computer refused to safely remove my USB external hard drive, because 'there was a process using it'. I decided to shut the computer down and then unplug the drive but it decided to take a very long time to shut down and said it was 'getting x number of Windows updates'. I was really getting impatient by then and really had to be somewhere else. I unplugged my USB external drive and left without waiting for the computer to finish. Following that I have found this mrtstub.exe and my other computer is now taking a long time to shut down and not releasing USB external drives. I'm still not sure if it's a virus or legit, but it is definitely annoying.
I think, the Mrtstub.exe is not a malware, but it can slow down your computer. It took 30% of my RAM. I prefer to stop it and remove it.
I think, the Mrtstub.exe is not a malware, but it can slow down your computer. It took 30% of my RAM. I prefer to stop it and remove it.
When I scanned it with norton on my second hard drive it disappeared and Norton crashed
I installed Windows 10 on the 1st date available -- July 29, 2015. On Aug 13th, my start button, search button, and notification buttons quit working. After researching online, it appeared the only fix would be to create a new account for myself and transfer everything to it. Wellll, guess what, in September, I scanned computer for malware, and it shows a "mrtstub.exe" which just HAPPENED to have installed on ... you guessed it, August 13th, 2015! I searched "What is "mrtstub.exe" and found it could cause the problem. After removing "mrtstub.exe", my 3 buttons resumed functioning, and I do not have to change all my information to a new account! Also found this comment about the file, dated Aug 18, 2015 Ahaap replied on this website "Mrtstub.exe is a part of the Microsoft Malicious Software Removal Tool which comes with the monthly batch of windows update , the random named folder is generated when windows updates are installing, it's a temporary unpacking folder which should be removed when the installation is done (but that doesn't always happen). It will get installed on the drive with the most space. ============== So, I guess if you have trouble with Start, Search, and Notification Window buttons, look for the mrtstub.exe file, and if it didn't delete itself, maybe you should! Seems like Microsoft could either fix the issue, or make the problem better known.
  Jeri Jeppesen  
It seems to slow down Search and the Start menu. I don't recommend keeping it.

Rating chart

Summary: Average user rating of mrtstub.exe: based on 24 votes with 21 user comments. 5 users think mrtstub.exe is essential for Windows or an installed application. One user thinks it's probably harmless. 8 users think it's neither essential nor dangerous. 6 users suspect danger. 4 users think mrtstub.exe is dangerous and recommend removing it. 6 users don't grade mrtstub.exe ("not sure about it").

Do you have additional information?

Best practices for resolving mrtstub issues

A clean and tidy computer is the key requirement for avoiding problems with mrtstub. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the mrtstub.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

mrtstub.exe [all]