mrt hangs on file c:\windows\system32\wbeb\webmess.dll

Question

mrt hangs on file c:\windows\system32\wbeb\webmess.dll

Scott Weber 0

No matter how long I wait or how many times I restart the computer, mrt still gets stuck on file c:\windows\system32\wbeb\webmess.dll and will not finish the scan.

Any ideas why and how to fix it?

Scott Weber 0 Reputation points

2026-05-04T16:15:07.03+00:00

Here is the last error.

I have tried to restart multiple times without success. I started in safe mode and it still hung.

Windows update just loaded the newest version of MRT this am and it still hung up.

reboot-mode: 0, quiet-mode: 0, detect-only-mode: 0, full-scan-mode: 0, wu-mode: 0

Microsoft Windows Malicious Software Removal Tool v5.140, (build 5.140.26040.2001)

Started On Mon May 4 11:04:09 2026

MAPS URL: SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx|SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx|REST:https://wdcp.microsoft.com/wdcp.svc/submitReport|REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport|BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport|BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport|ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport|ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport

Engine: 1.1.26010.1

Signatures: 1.445.550.0

MpGear: 1.1.26010.1

Run Mode: Interactive Graphical Mode

2 answers

Your answer

Scott Weber 0 Reputation points

2026-05-04T16:15:07.03+00:00

Here is the last error.

I have tried to restart multiple times without success. I started in safe mode and it still hung.

Windows update just loaded the newest version of MRT this am and it still hung up.

reboot-mode: 0, quiet-mode: 0, detect-only-mode: 0, full-scan-mode: 0, wu-mode: 0

Microsoft Windows Malicious Software Removal Tool v5.140, (build 5.140.26040.2001)

Started On Mon May 4 11:04:09 2026

MAPS URL: SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx|SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx|REST:https://wdcp.microsoft.com/wdcp.svc/submitReport|REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport|BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport|BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport|ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport|ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport

Engine: 1.1.26010.1

Signatures: 1.445.550.0

MpGear: 1.1.26010.1

Run Mode: Interactive Graphical Mode

Answer 1

nobuko c 123.2K Independent Advisor

Hello,

On my own system, the folder “wbeb” does not exist under C:\Windows\System32, and the file webmess.dll is not present either.

Only “wbem” exists, which is the normal folder used by Windows for WMI components.

This means that the presence of System32\wbeb\webmess.dll on your machine is not standard for a normal Windows installation, and it may explain why MRT freezes when it tries to scan it.

You can also try scanning the same folder with Windows Security (Microsoft Defender) instead of MRT.

Defender uses a newer engine and usually does not freeze on non‑standard files.

If Defender completes the scan normally, the issue is with MRT itself.

If Defender also stops or reports an error, then the file is likely corrupted.

Scott Weber 0 Reputation points

2026-05-04T18:46:37.9066667+00:00

Sorry,

The file is C:\Windows\system32\wbem\wbemess.dll

Thank you for your info.
nobuko c 123.2K Reputation points Independent Advisor

2026-05-05T06:59:57.33+00:00

I sincerely apologize. I accidentally posted in a language that is not supported in this forum, and I have removed the post.
nobuko c 123.2K Reputation points Independent Advisor

2026-05-05T07:04:12.64+00:00

Here are the results of the custom‑scan tests I performed on both a virtual machine (guest) and my physical PC (host).

To verify the behavior, I ran a custom scan of the wbem folder using the Microsoft Malicious Software Removal Tool (MRT) in both environments.

In both the VM and the host system, MRT paused for about 3.5–4 seconds when scanning:

C:\Windows\System32\wbem\wbemess.dll

After this brief pause, the scan continued normally.

This confirms that the file itself is normal, and the short delay is caused by how MRT handles WMI‑related DLLs, which are often locked by system services.

It is not a sign of corruption or malware.

For comparison, I also scanned the same folder with Microsoft Defender, and the scan completed smoothly without any delay.

This further indicates that wbemess.dll is a standard, healthy Windows file, and the slowdown is specific to MRT’s older scanning engine.

Answer 2

The Microsoft Windows Malicious Software Removal Tool (MRT) can hang or fail to complete if it encounters errors while scanning specific files. The documented guidance for MRT issues is to use its log and then apply a set of recovery steps.

To troubleshoot the hang on c:\windows\system32\wbeb\webmess.dll:

Check the MRT log for the exact error
1. Open Run (Win + R).
2. Type %systemroot%\debug and select OK.
3. Open mrt.log.
4. Scroll to the most recent run and look for entries around the time the scan hangs, especially any error codes.
Retry the scan
1. Start the Microsoft Windows Malicious Software Removal Tool again.
2. Select Next.
3. On Scan Type, choose a scan (for example, Quick scan first), then Next and see if it completes.
Restart Windows and run MRT again
1. Restart the PC normally.
2. Run MRT again and select a scan type as above.
Download a fresh copy of MRT Corruption in the MRT binary can cause scan problems.
1. Download the latest Malicious Software Removal Tool from the Microsoft Download Center using the link in the documentation:
  http://www.microsoft.com/download/details.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356&DisplayLang=en
2. Run the newly downloaded tool and start a scan.
Fully update Windows and retry
1. Use Windows Update to install all available updates:
  http://update.microsoft.com/
2. After updates and a restart, run MRT again and verify whether it still hangs on the same file.

If the log shows an error code that is not covered in the documented table, the official guidance is to contact Microsoft Support for further assistance.

References:

How to troubleshoot an error when you run the Microsoft Windows Malicious Software Removal Tool

Share via

mrt hangs on file c:\windows\system32\wbeb\webmess.dll

2 answers

Your answer