Re: Secret Malicious Software Removal Tool

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 11/18/05

  • Next message: Danny Sanders: "Re: I'm connected to the Domain but I'm not, please HELP..." 
    Date: Thu, 17 Nov 2005 18:22:53 -0500

    From: "Woody" <Woody@discussions.microsoft.com>

    |
    | I think that I may have the same issue... maybe.
    |
    | Today I noticed in a strange and un-related location a folder with some
    | random number... "d3d6210958507540672ebedd".
    |
    | I wondered where this foder came from... so i looked inside, and found 2
    | files... "mrt.exe" and "mrtstub".
    |
    | I have no idea where they came from. If it was from Mircosoft with my
    | automatic updates, why did it install it is such a random loacation?
    | (secondary HD)
    |
    | I researched this a bit, and found simmilar posts about people wondering if
    | this is a virus or whatever. I am wondering if i can get any answeres here.
    |
    | Is this mysterious folder that says... "malicious software removalt tool"
    | related to MS? Or is it a virus?
    |
    | Thanks

    MRT.EXE is the Malicious Software Removal Tool, a "On Demand" and malware scanner.

    Upon installation, the utility is...
    %windir%\system32\MRT.exe

    If you had a folder such as "c:\d3d6210958507540672ebedd" then this is a remanant of a
    HotFix or update via Windows Update and for some unknown reason was NOT auto-deleted when
    the files were extracted and used/moved.

    Command line switches...

    /? or /HELP = displays the command line switches
    /Q = quiet
    /N = detect only
    /F = force extended scan
    /F:Y = force extended scan and automatically clean infected files

    The following is the resultant log file...

    %windir%\Debug\mrt.log 

    -- 
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
  • Next message: Danny Sanders: "Re: I'm connected to the Domain but I'm not, please HELP..."

    Relevant Pages

    • RE: Locating corrupt driver
      ... This article describes the functionality and limitations of the Windows ... Create and format partitions on drives. ... MB of hard disk space on your system partition to hold the Cmdcons folder ... Windows NTBoot Console Command Interpreter. ...
      (microsoft.public.win2000.applications)
    • Re: Dim RetVal
      ... Looking in the folder there is a coed11.dat DAT file, the coed11 application, coed11.gdb GDB file ... The reason is that without the quotes, the command processor sees the ... In the command window, first type ... This *should* have exactly the same effect as the macro. ...
      (microsoft.public.word.vba.beginners)
    • Re: Batch Job
      ... You cannot use the 'del' command at a DOS prompt. ... files (since 'del' might not work into the special folder). ... while the above will delete the deleted files from the Recycle Bin but it also deletes configuration files used by the Recycle Bin. ...
      (microsoft.public.windowsxp.general)
    • Re: Help with cacls in WinXP Home
      ... Take Ownership of a File or Folder in Windows XP ... all the information I have of CACLS: ... Just because you can set permissions with Cacls doesn't mean you should. ... Try the Cacls command on a test folder first and make sure that your ...
      (microsoft.public.windowsxp.security_admin)
    • Re: User Account Suddenly Unaccessable
      ... As I started to type the second command, ... I get two error messages. ... Contact your network administrator. ... It tells me that only the Administrator has access to the CWLee profile folder. ...
      (microsoft.public.win2000.general)