Windows automatically looks for share.cmd share.bat etc?

[hotzen]

Hello,

I am currently seeing very strange behaviour of my tiny HTPC-box, following dmesg of the ZFS server:

Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.bat share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.cmd share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.exe share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.com share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.pif share not found
Dec 23 18:54:15 knecht last message repeated 1 time
Dec 23 18:54:15 knecht smbsrv: [ID 421734 kern.notice] NOTICE: [KNECHT\htpc]: filme.lnk share not found

the server is actually providing a share "filme" and the HTPC-box (Win 7) has very minimal software, so I think it is some weird windows-behaviour...
Has anyone seen such a behaviour? It looks somewhat virii

 

[spock]

I know this is an ancient thread but I just found the same behaviour. One of my Windows clients is doing this...

Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos access denied: IPC only
Oct 10 21:36:22 GLaDOS last message repeated 19 times
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.exe share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.dll share not found
Oct 10 21:36:22 GLaDOS last message repeated 2 times
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.lnk share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.cmd share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.bat share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.com share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time
Oct 10 21:36:22 GLaDOS smbsrv: [ID 421734 kern.notice] NOTICE: [NT Authority\Anonymous]: tank_photos.pif share not found
Oct 10 21:36:22 GLaDOS last message repeated 1 time

 

[Philmatic]

These both look like viruses or adware trying to spread. I would check the source computer and run a MalwareBytes scan on it.