Good Morning George,

Try the following link to the Network Associates / McAfee.com
VIRUS INFORMATION LIBRARY @
http://vil.mcafee.com/default.asp .

After reachng the site, do a search for viruses containing the text string
"mtx" (no quotes).

You'll find comprehensive information here on the many variants of the MTX
virus and step-by-step instructions on how to permanently remove it from
your infected system.

Jeffrey Ottie
[log in to unmask]



Original Message -----
From: "George Parmenter" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Saturday, December 16, 2000 7:20 PM
Subject: [PCSOFT] need help: mtx worm

A relative of mine who had sent me attachments in the past, sent me the
mtx worm recently. I was able to get to f-prot's url and download their
latest def files. I have rebooted into dos, run f-prot. It finds the
mtx_.exe, deletes it, finds the ie_pack.exe and deletes it, finds the
win32.dll and deletes it. I downloaded their registry repair .reg file
to my desktop and use regedit to execute that also while in full dos
mode. When I reboot into windows and look at the registry the values
under local machine/software and local
machine/software/microsoft/windows/current version/run look ok.

However, as soon as I right click on anything my dun "connect to" dialog
box opens (where I type in my password to connect to my isp). After that
if I check the windows directory, all three of the mtx components are
back again. I also have a little utility called TaskInfo2000 which
allows me to terminate processes running on my computer. Using that I
have been able to terminate mtx_.exe and then temporarily at least
delete it as well as its other components. I know that it will soon be
back if I can't figure out how to completely get rid of it. Can anyone
give me any help with this problem?

             PCSOFT maintains many useful files for download
                     visit our download web page at:
                     http://nospin.com/pc/files.html