MPSigStub.exe reversed back to old version?

Question

Hello,

We are trying to run the Windows Updates to get the MpSigStub.exe file updated to correct vulnerability CVE-2019-1161 but after updating it from version 1.1.13251.0 to 1.1.18500.10 it reversed back after 30 minutes to 1.1.13251.0. Why?

Any process which reverse the Windows Updates?

I noticed if I unapproved the old Definition Updates 1.235.xxxx.x in WSUS Console it works as expected the MpSigStub.exe stays on 1.1.18500.10 ... but why should I unapproved the old definition updates manually and one-by one?

Thanks,

Dom

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

It's conceivable that a conflict with another process or application is preventing Windows Update from correctly upgrading the MpSigStub.exe file. It's also possible that the update is being ignored or that it's being replaced by a different program or service. You must look for any conflicts and confirm that the update is being applied properly in order to resolve this problem. Aside from that, you might also need to check for any outstanding updates and wipe up any registry entries connected to the MpSigStub.exe file.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you

Answer 2

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

It's conceivable that a conflict with another process or application is preventing Windows Update from correctly upgrading the MpSigStub.exe file. It's also possible that the update is being ignored or that it's being replaced by a different program or service. You must look for any conflicts and confirm that the update is being applied properly in order to resolve this problem. Aside from that, you might also need to check for any outstanding updates and wipe up any registry entries connected to the MpSigStub.exe file.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you

Answer 3

Hi,

Yes all registries and files or folders attached to the MpSigStub.exe files were deleted several times but apparently the old version is coming back when patching again as required by the old Definition Updates 1.255.xxxx.x.

The current version is 1.381.3210.0 at least ...

Is it normal the old Definition Updates come again?

• Should they be unapproved one-by-one?
• They are superseded but our WSUS team did not excluded the superseded path(es), should they be? Thanks, Dom