mrxsmb.sys

Windows SMB Redirector Driver

System DriverStableNetwork

CPU Usage

1-8%

Memory

50-200 MB

Location

C:\Windows\System32\drivers

Publisher

Microsoft Corporation

Quick Answer

mrxsmb.sys is a legitimate Windows SMB redirector driver. It enables client access to network shares by handling SMB requests between the local computer and remote servers.

Is it a Virus?

✔ NO - Safe

Must be located at C:\Windows\System32\drivers\mrxsmb.sys

Warning

SMB activity can spike during file sharing

mrxsmb.sys handles SMB client sessions; unusual spikes may indicate network issues or misconfigured shares

Can I Disable?

✔ NO

mrxsmb.sys is required for Windows network sharing; disabling will break access to remote shares and mapped drives

What is mrxsmb.sys?

mrxsmb.sys is the Windows SMB redirector driver that enables the client portion of SMB communications for network shares. It runs in the Windows kernel and handles requests to access network shares, map drives, and transfer files to and from remote servers when you connect to network shares or mapped drives.

mrxsmb.sys implements the SMB client path, coordinating session setup, signing, and data framing for file shares. It works with the Workstation service to manage connections and retries across the network, enabling reliable remote access.

Quick Fact: mrxsmb.sys is a core SMB client component that helps Windows communicate with network shares without user intervention.

Types of SMB Client Processes

SMB Client Session: Handles a logon session to a remote SMB server
Share Access: Manages read/write requests to network shares
Drive Mapping: Supports mapped drives to remote shares
Authentication Handler: Performs credential negotiation for SMB sessions
Retry & Error Handler: Manages retries when network hiccups occur
SMB Signing/Encryption: Ensures security for SMB communications

Is mrxsmb.sys Safe?

Yes, mrxsmb.sys is safe when it is the legitimate file from Microsoft signed for Windows SMB client functionality.

Is mrxsmb.sys a Virus or Malware?

The real mrxsmb.sys is NOT a virus. Malware may masquerade with similar names; verify the file path and signature.

How to Tell if mrxsmb.sys is Legitimate or Malware

File Location: Must be in C:\Windows\System32\drivers\mrxsmb.sys. Any other location is suspicious.
Digital Signature: Right-click the file in Explorer > Properties > Digital Signatures. Should show a signature from Microsoft Corporation.
Version and Publisher: In Properties > Details, verify Product name and Publisher reflect Microsoft Corporation and Windows components.
Hash Verification: Compute a SHA256 hash: certutil -hashfile C:\Windows\System32\drivers\mrxsmb.sys SHA256 and compare with official Microsoft values.

Red Flags: If mrxsmb.sys is outside the System32\drivers folder, lacks a valid signature, or shows a tampered timestamp, scan with an updated antivirus and verify with Windows Defender.

Why Is mrxsmb.sys Running on My PC?

mrxsmb.sys runs to support Windows SMB client functionality for network shares. It activates during login, when a network drive is mapped, or when file operations occur with remote servers.

Reasons it's running:

Active SMB Sessions: You are connected to one or more SMB shares; the driver handles ongoing read/write requests.
Background Share Access: Background tasks or apps access network shares (e.g., mapped drives, backup tools).
Startup and Auto-Reconnect: Windows can automatically reconnect to network shares at login or after network changes.
SMB Signing and Security: mrxsmb.sys enforces signing and encryption settings during SMB negotiations.
Network Latency and Retries: Fluctuating network conditions trigger retries and additional SMB traffic.

Can I Disable or Remove mrxsmb.sys?

No, you should not disable mrxsmb.sys. It is a core Windows SMB client driver required for network shares and mapped drives.

How to Stop mrxsmb.sys (Not Recommended)

Stop Workstation-Related SMB: Open an elevated Command Prompt and run: sc stop LanmanWorkstation
Disable SMB Client Features: In Services.msc, set LanmanWorkstation startup type to Disabled (not recommended).
Disable Legacy SMB: Control Panel > Programs and Features > Turn Windows features on or off > uncheck 'SMB 1.0/CIFS File Sharing Support' (where applicable)
Apply Changes: Reboot the system to apply changes.
Test Access: After reboot, verify you can still access required network shares or map drives.