Temp Folders Created on External Hard Drive

When I periodically browse to my external hard drive, I see dozens strange
folders like:
H:/d8ec8985ea99734705

My googling skills have led to forums saying these folders are created by
Windows Update, which uses the largest hard drive on the system (which is my
external hard drive) to create the temp folders.

However, each folder has the exact same four files in them:
mrtstub.exe
mrt.exe._p
MRT.exe
$shtdwn$.req

These first two files are always exactly the same size, while the last two
are either one of two file sizes.

Any ideas if this is malware or actual valid Windows folders? If they are
valid, why aren't they deleted automatically after updates? How can I make
it so that they aren't permanent?

Any help would be greatly appreciated, thanks,
Alex

"alex" <> schrieb:

> When I periodically browse to my external hard drive, I see dozens strange
> folders like:
> H:/d8ec8985ea99734705
>
> My googling skills have led to forums saying these folders are created by
> Windows Update, which uses the largest hard drive on the system (which is my
> external hard drive) to create the temp folders.

That's correct.

> However, each folder has the exact same four files in them:
> mrtstub.exe
> mrt.exe._p
> MRT.exe
> $shtdwn$.req

That's the "Microsoft Windows Malicious Software Removal Tool" updated
and release via AU/MU/AU every month: http://support.microsoft.com/kb/890830
That may explain why you have different folders with the same file names
(while the file dates should differ).

Bye,
Freudi

i have a folder under c:\ called c:\c6995bb2dcf5148abddc850ab01fc8
but inside ther's only mrt.exe._p
$shtdwn$.req and mrtstub.exe, there's no MRT.exe, does that mean it's a virus?

"Ottmar Freudenberger" wrote:

> "alex" <> schrieb:
>
> > When I periodically browse to my external hard drive, I see dozens strange
> > folders like:
> > H:/d8ec8985ea99734705
> >
> > My googling skills have led to forums saying these folders are created by
> > Windows Update, which uses the largest hard drive on the system (which is my
> > external hard drive) to create the temp folders.
>
> That's correct.
>
> > However, each folder has the exact same four files in them:
> > mrtstub.exe
> > mrt.exe._p
> > MRT.exe
> > $shtdwn$.req
>
> That's the "Microsoft Windows Malicious Software Removal Tool" updated
> and release via AU/MU/AU every month: http://support.microsoft.com/kb/890830
> That may explain why you have different folders with the same file names
> (while the file dates should differ).
>
> Bye,
> Freudi
>

No.

Tip: Disconnect all external drives before downloading/installing Windows
Updates/


andy wrote:
> i have a folder under c:\ called c:\c6995bb2dcf5148abddc850ab01fc8
> but inside ther's only mrt.exe._p
> $shtdwn$.req and mrtstub.exe, there's no MRT.exe, does that mean it's a
> virus?
>
> "Ottmar Freudenberger" wrote:
>
>> "alex" <> schrieb:
>>
>>> When I periodically browse to my external hard drive, I see dozens
>>> strange
>>> folders like:
>>> H:/d8ec8985ea99734705
>>>
>>> My googling skills have led to forums saying these folders are created
>>> by
>>> Windows Update, which uses the largest hard drive on the system (which
>>> is
>>> my external hard drive) to create the temp folders.
>>
>> That's correct.
>>
>>> However, each folder has the exact same four files in them:
>>> mrtstub.exe
>>> mrt.exe._p
>>> MRT.exe
>>> $shtdwn$.req
>>
>> That's the "Microsoft Windows Malicious Software Removal Tool" updated
>> and release via AU/MU/AU every month:
>> http://support.microsoft.com/kb/890830 That may explain why you have
>> different folders with the same file names (while the file dates should
>> differ).
>>
>> Bye,
>> Freudi