mrstub.exe "Malicious Software Removal Tool"

On Microsoft Windows XP, the autoupdate from Microsoft is trying to install the Malicious Software Removal Tool. CAVS is blocking it for being on the HIPS blocked list. Name of blocked file is mrstub.exe

You should change the HIPS setting so that it allows this file, either that or remove it from the allow/block list and then select to allow it next time you get a pop up.


I think there is an issue with how Comodo is working. Here is what I think happened.

  • I shut down the computer for the night and notice MS updates are being installed
  • I get up the next morning, and they are still being installed.
  • Furthur investigation revealed the following
  1. During the MS update process, a temporary file was created c:.…a bunch of letters…\mrstub.exe
  2. Comodo HIP added the temporary file to the block list
  3. Next morning file was gone, but still in Comodo block list
  4. Comodo would not let me remove the file from the block list, saying it didn’t exist
  5. I turned off HIP, allowed the install to continue, then turned HIP back on
  6. File is still on block list in Comodo and I can’t remove it

Ah yes, I remember now. There is a problem with not being able to remove files from the allow/block list if they are no longer on the computer. This worked in an earlier beta but does not work in the current one. I have currently uninstalled CAVS beta pending arrival of the new version under development.

Are you using the new Comodo Firewall 3? the HIPS in this is much more advanced than with CAVS beta and it is definitely worth replacing whatever firewall you are currently using. Once this is installed you can turn off the CAVS HIPS for good.