G
Guest
I am having difficulties with virus (malware?) called mrt.exe or mrtstub.exe.
The process is defined at:
http://www.processlibrary.com/directory/files/mrtstub/. The symptom is that
it utilizes almost all the processing cycles. It installs the files
"mrt.exe", "mrtstub.exe" and "$shtdwn$.req" in a random number directory that
it creates such as "94edcd2b9002bfe3988e14886a". It also installs the file
"mrt.exe" in the C:/{windows}/system32 directory.
Neither the current version of McAfee or Microsoft AntiSpyware will catch
this virus. When either log-off/log-on or shutdown/log-on, the virus will
turn off McAfee on restart. (I don't remember if it turned off AntiSpyware.)
Since it is turning off McAfee, I would consider it a virus and not just
Adware/Spyware/Malware.
I suspect that the virus is trying to create popups and I have a popup
blocker... so when it can't create the damn popup, I suspect that it goes
into an endless loop that uses almost all my processing cycles.
To temporarily remove this virus, you must shut down and enter "Safe" mode.
You must delete the random directory (described above) plus the mrt.exe file
in system32. If you only rename the files and do not delete the directory, it
will immediately reinstall. The virus will also recreate after a few hours.
The file "$shtdwn$.req" was last created on my computer at 3:01 AM, so this
would tell me that the process can start when I am not at the computer.
Previously, I found an entry in the registry for "mrtstub.exe" and deleted
the key. I DO NOT recommend this since it totally screwed up the user profile.
A confusion of the file name "mrt.exe" exists with a file that Microsoft
provides. In the case of Microsoft, the "mrt" stands for "malicious removal
tool".
So, my question is:
1) How to get this virus on the radar screen of both McAfee and AntiSpyware?
2) How to prevent it from reinstalling itself until they do?
The process is defined at:
http://www.processlibrary.com/directory/files/mrtstub/. The symptom is that
it utilizes almost all the processing cycles. It installs the files
"mrt.exe", "mrtstub.exe" and "$shtdwn$.req" in a random number directory that
it creates such as "94edcd2b9002bfe3988e14886a". It also installs the file
"mrt.exe" in the C:/{windows}/system32 directory.
Neither the current version of McAfee or Microsoft AntiSpyware will catch
this virus. When either log-off/log-on or shutdown/log-on, the virus will
turn off McAfee on restart. (I don't remember if it turned off AntiSpyware.)
Since it is turning off McAfee, I would consider it a virus and not just
Adware/Spyware/Malware.
I suspect that the virus is trying to create popups and I have a popup
blocker... so when it can't create the damn popup, I suspect that it goes
into an endless loop that uses almost all my processing cycles.
To temporarily remove this virus, you must shut down and enter "Safe" mode.
You must delete the random directory (described above) plus the mrt.exe file
in system32. If you only rename the files and do not delete the directory, it
will immediately reinstall. The virus will also recreate after a few hours.
The file "$shtdwn$.req" was last created on my computer at 3:01 AM, so this
would tell me that the process can start when I am not at the computer.
Previously, I found an entry in the registry for "mrtstub.exe" and deleted
the key. I DO NOT recommend this since it totally screwed up the user profile.
A confusion of the file name "mrt.exe" exists with a file that Microsoft
provides. In the case of Microsoft, the "mrt" stands for "malicious removal
tool".
So, my question is:
1) How to get this virus on the radar screen of both McAfee and AntiSpyware?
2) How to prevent it from reinstalling itself until they do?
I dunno much about virus normally if I have one I reinstall the laptop complete.