Mrxsmb Info

[tjet]

I am helping a guy who says his machine keeps hanging up and gets lost on file searches.

This is usually caused by malware, file corruption or a memory problem in my experience.

Anyways, his error logging is showing MRxSmb errors and warnings.

This is related to networking and modem services.

But I also see that it is /has been used as a hiding place for malware.

Should I look into the malware thing or carry on looking for another cause?

[TheTerrorist_75]

What are the Event ID numbers for the errors?

[tjet]

The log also shows some application hangs but I was wondering if there is a high incidence of MRxSmb being used as a malware hiding place.

Waiting for him to get off work.

[TheTerrorist_75]

I would look up MRxSmb errors with the Event ID number. It may be something as simple as a DNS problem. To really confirm if it is malware related I would post a HJT log in the correct section of the forum.

[tjet]

Thanks for the help TT.

Never fear dad, you guys taught me well.

I was off kilter apparently.

Guy says for awhile it was just shutting off randomly (and saying it recovered from a fatal error) but hasn't done that lately, now locks up constantly and always gets stuck searching for files in folders and never finds them.

He thinks malware.

I am thinking corrupted files so I have him run CHKDSK /r.

CHKDSK does not report any files corrupted.

Ok then I say what does event log show.

Searches tell me MRxSmb errors relate to networking and modem problems but also see reports of malware being hidden in those system32 files

Am trying to decide weather to have a log done.

Don't want to waste a readers time with an unnecessary log.

So I thought I would get a security expert to tell me if there is a lot of stuff being hidden in this type of file going around.

Edited August 11, 2007 by tjet

[TheTerrorist_75]

The only way to really tell if it is malware related would be to see a log.

[tjet]

thnx

[Matt]

I once had an issue where the computer would crash on searches. If you decide it isn't malware, try turning off the indexing function on the search. That's what caused my issues.