Any Information on mtx.exe

[Atchett]

Hello,

Does anyone have any information on the process mtx.exe. There are 7 instances of it on a server running NT 4.0 SP 6a. It seems to make the server run slowly? When I reboot it only 1 mtx.exe process comes back and then gradually over time others reappear?

Any Info gratefully received.

Cheers,

 

[Klae]

It sounds like the W32.MTX virus run an upto date virus checker and see. this virus does have a file called mtx_.exe and iepack.exe and win32.dll. also infects other .exes and .dlls and runs itself from the run key in the registry the virus checker if its any good will remove the virus from the infected files but on the three files above you'll have to delete them

 

[Atchett]

Many thanks for the reply Klae.

Are you suggesting that there is a virus residing on the server? Also, what impact (if any) will removing the files, that you have suggested, have on the machine?

Many thanks,

 

[Shani]

Are you running an ativirus???? I could be wrong but I think that I remember this exe found as a virus. Check it out.

 

[Atchett]

Thanks Shani.

I'm on the case.

 

[Klae]

removing those three files on ther server I said (mtx_.exe, iepack.exe and win32.dll) wil have no affect to the server. But YES it sounds like you do have a virus on the server and you should get rid of it as it will affect dlls of importance and your network!

 

[Atchett]

Thanks for your help Klae,

I have been trying to sort this thing out for a while. The antivirus software (with the latest updates!) doesn't seem to pick up the virus, and I cannot find any of the files that you have mentioned. I have however found the file mtx.exe which I renamed .old to see what it did. Once restarted there were no more instances of the mtx.exe process but it did meddle with the IIS running on the server. All files are back how they were now but I am back to the situation where there are 8 mtx.exe processes and over half of the memory is being used by them. Could this just be an IIS issue, in which case any suggestions?

Many thanks, (once again )

 

[mikes999]

An except from MS KB:

"If the application is configured to run out-of-proc in IIS 4.0 (or on IIS 5.0 with medium or high Application Protection), then attaching debugger to Inetinfo.exe will not break execution of an Extension DLL. You will need to attach the debugger to the MTX.exe process (or DLLHOST.exe if using Windows 2000) that hosts the ISAPI DLL. Because there may be more than one MTX.exe (DLLHOST.exe) process running at one time, you may need to add code to the ISAPI DLL that shows the process ID (PID) that the DLL is loaded in...."

Hope it helps.