MPSigStub.exe

[Trying]

I recently found this executable in a very strange folder on my machine (MPSigStub.exe). The properties indicate that it comes from MicroSoft. Does anybody no what it is? I spent most of an hour with MicroSoft and got "We're Not Sure" for and answer.

[Yodama]

Without further information it is hard to say if the file is safe or not. Even if support from Microsoft is not sure about the file, it does not mean that the file is bad, it just means, they have so many files that they lost track :(

The properties info of the file could be faked, so with the name and the info alone, there is no telling if the file is ok or not.

I believe it would be best if you would submit the file for analysis, if possible also include a Spybot and/or Hijackthis log. For example use this adress: detections-at-spybot.info (replace -at- with @ )


When submitting a suspicious file please, zip or rar the file an put a password like infected on the archive. Otherwise the file could be filtered by automatic scanners.

[Trying]

Thanks for responding.

I got paranoid about having the program on my machine so I erased it. Can't send you a copy.

I also found a log file that has MPSigStub as part of the name and it appears that the program may be part of the upgrade or update process for Windows Defender. At any rate I haven't noticed any problems with my machine so I think everything is okay.

Again, Thanks for your help.

[whereisian]

I also found this file on my fileserver. The server is running Windows 2003 and Windows defender. The file details also say MS. I haven't called them about it though.

It was found in F:\781115a6699d2ccd5d

I've attached a zip file with the .exe with the password of 'infected'. Any insight would be appreciated. Cheers.

[tashi]

Hello whereisian

Please see:
Infected Files. How To Submit. Please do not attach them here.
http://forums.spybot.info/showthread.php?t=1699

Thanks.

[whereisian]

Sorry 'bout that. I've submitted via email.