George , According to Symantec this is an "UGLY" combination worm/virus. I
have copied excerpts from the Symantec website because this virus prevents
you, in some cases, from accessing the Anti-virus web sites for assistance.
You may need to access Symantec or...?, on a non-infected computer or use
one of the alternate URL's provided below. Good Luck. Dave S.
The following is from Symantec:
As of this writing, the following information is known about the W95.MTX
virus.
Infects Operating Systems(s): Windows 95, Windows 98. Last Modified:
12/15/2000
W95.MTX has a virus component and a worm component. It infects some Win32
executables in specific folders. The virus also has the capability to block
access to certain Web sites, including Symantec Web sites. This may prevent
you from downloading new virus definitions directly to an infected computer.
How to repair: This is a complex and difficult virus to remove. It alters
system files, and on some computers these files cannot be repaired. In some
cases, after attempting to repair the virus, you cannot start Windows until
you restore the essential system files from the original Windows
installation CD.
NOTES: Because this virus can not only disable Windows and executable
files, but can also block access to certain Web sites, including Symantec
Web sites, in some cases you must perform any needed downloads on an
uninfected computer.
A tool that will help remove this virus has been developed by the Symantec
AntiVirus Research Center (SARC). Because of the complex nature of this
virus, not all files can be repaired. After using the tool, click the link
that is provided on the tool download page. To download the tool, go to:
http://www.symantec.com/avcenter/venc/data/w95.mtx.fix.html
If you cannot get to this site, then the tool is also available at the
following sites:
http://www.ghostsoft.com/avcenter/venc/data/w95.mtx.fix.html
http://www.digitalriver.com/symantec/virus
----- Original Message -----
From: "George Parmenter" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Saturday, December 16, 2000 6:20 PM
Subject: need help: mtx worm
> Hello all,
> A relative of mine who had sent me attachments in the past, sent me the
> mtx worm recently. I was able to get to f-prot's url and download their
> latest def files. I have rebooted into dos, run f-prot. It finds the
> mtx_.exe, deletes it, finds the ie_pack.exe and deletes it, finds the
> win32.dll and deletes it. I downloaded their registry repair .reg file
> to my desktop and use regedit to execute that also while in full dos
> mode. When I reboot into windows and look at the registry the values
> under local machine/software and local
> machine/software/microsoft/windows/current version/run look ok.
> However, as soon as I right click on anything my dun "connect to" dialog
> box opens (where I type in my password to connect to my isp). After that
> if I check the windows directory, all three of the mtx components are
> back again. I also have a little utility called TaskInfo2000 which
> allows me to terminate processes running on my computer. Using that I
> have been able to terminate mtx_.exe and then temporarily at least
> delete it as well as its other components. I know that it will soon be
> back if I can't figure out how to completely get rid of it. Can anyone
> give me any help with this problem? Thanks in advance.
> George Parmenter
>
> PCSOFT maintains many useful files for download
> visit our download web page at:
> http://nospin.com/pc/files.html
>
PCSOFT maintains many useful files for download
visit our download web page at:
http://nospin.com/pc/files.html
|
