# MA-022.102000: MyCERT Advisory - MTX Worm

**Date:** 24 Oct 2000  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-022.102000  
**Advisory ID:** MA-022.102000

---

1.0 Description
#### 1.1 Overview
The MTX worm has three components - worm, virus and backdoor. It spreads under Win32 systems - the virus component infects Win32 executable files, attempts to send e-mail messages with infected attachments and installs the backdoor component to download and spawn "plugins" on an affected system.
The payload changes the contents of files on the computer and might corrupt files. Some infected files are corrupted beyond repair.
#### 1.2 Limitation
1.2.1 The worm will only be activated once the win95.mtx file is executed.
**1.3 Aliases**
The virus is also known as:
\*I-Worm.MTX
\*MTX\_.exe
\*PE\_MTX
\*W32/Apology
\*W32/Apology-B
\*W32/MTX@mm
\*W95.MTX .
### 2.0 Technical Matters
**2.1 Installation and Functionality (as extracted from F-Secure)**
The virus has an unusual structure. It consists of three different components that are run as standalone programs (Virus, email Worm and Backdoor). The virus is the main component, it keeps the worm and the backdoor programs in its code in compressed form. While infecting the system, it extracts and spawns them:
The MTX worm-virus structure looks 
```
I The virus      I --> installs Worm and Backdoor to the system,          
I installation   I     then finds and infects Win32 executable files           
I and infection  I           
I routines       I           
------------------           
I Worm code      I --> is extracted to file and run as stand-alone program           
I (compressed)   I           
------------------           
I Backdoor code  I --> is extracted to file and run as stand-alone program           
I (compressed)   I           
------------------
```
The worm code does not contain all the necessary routines to infect the system where the infected e-mail (see below) is sent as an attachment. The worm file is infected by the virus as an ordinary file and then sent. The reason to use such a way is not clear. Probably the components were written by different people.
The Virus component contains the following text strings:
SABIÁ.b ViRuS
Software provide by [MATRiX] VX TeAm: Ultras, Mort, Nbk, LOrd DArk, Del\_Armg0, Anaktos
Greetz: All VX guy in #virus and Vecna for help us
Visit us at:
http://www.coderz.net/matrix
The worm component contains the following text strings:
Software provide by [MATRiX] VX team:
Ultras, Mort, Nbk, LOrd DArk, Del\_Armg0, Anaktos
Greetz:
All VX guy on #virus channel and Vecna
Visit us: www.coderz.net/matrix
The Backdoor contains the following text strings:
Software provide by [MATRiX] team:
Ultras, Mort, Nbk, LOrd DArk, Del\_Armg0, Anaktos
Greetz:
Vecna 4 source codes and ideas
**Virus Component**
The virus component uses EPO (Entry Point Obscuring) technology while infecting a file. This means that the virus does not affect the file at its entry code, but places "Jump-to-Virus" instruction somewhere in the middle of the file code section to make the detection and disinfection procedures more complex. As a result the virus is activated only if the corresponding affected program's branch receives control.
The virus is also encrypted, so first of all it decrypts itself when its code gets control. The virus then looks for necessary Win32 API functions by scanning Win32 Kernel. The virus tries Win9x, WinNT and Win2000 addresses to do this.
The virus then looks for anti-virus programs active in the system and exits if any of them is detected. The list of anti-virus programs the virus looks for is as follows:
AntiViral Toolkit Pro
AVP Monitor
Vsstat
Webscanx
Avconsol
McAfee VirusScan
Vshwin32
Central do McAfee VirusScan
Then the virus installs its components to the system. They are decompressed installed to the Windows directory and then spawned. Three files created in there with the hidden attribute set. Their names are:
IE\_PACK.EXE - pure Worm code
WIN32.DLL - Worm code infected by the virus
MTX\_.EXE - Backdoor code
The virus then infects Win32 executable PE EXE files in current, temporary, and Windows directories, and then exits.
**Worm Component**
The worm component uses technology that was first introduced by Happy99/Ska Internet worm to send infected messages. The worm affects WSOCK32.DLL file in the Windows system directory by appending a component of its code to the end of the file and hooking the "send" WSOCK32.DLL routine. As a result, the worm monitors all data that is send from an affected computer to the Internet.
Usually WSOCK32.DLL file is in use at the moment the worm starts and it is locked by Windows. To avoid that, the worm uses the standard way: it creates a copy of the original WSOCK32.DLL with the name WSOCK32.MTX, infects that copy and then writes "replace original file with infected" instructions to the WININIT.INI file:
NUL=C:\WINDOWS\SYSTEM\WSOCK32.DLL C:\WINDOWS\SYSTEM\WSOCK32.DLL=D:\WINDOWS\SYSTEM\WSOCK32.MTX
where "C:\WINDOWS\SYSTEM" is the name of the Windows system directory and may differ depending on the name of the directory where Windows is installed.
The infected WSOCK32 replaces the original one during the next reboot, and the worm gets access to data that is sent from the infected machine. The worm pays attention to the Internet sites (Web, ftp) that are visited, as well as to e-mail messages that are sent from the computer.
The most visible behaviour of the virus is that it stops visiting several Internet sites and disables sending messages to the same domains (they are anti-virus domain names). The virus detects them by four-letter combinations:
nii.
nai.
avp.
f-se
mapl
pand
soph
ndmi
afee
yenn
lywa
tbav
yman
Furthermore, the worm does not allow user to send e-mail messages to the following domains:
wildlist.o\*
il.esafe.c\*
perfectsup\*
complex.is\*
HiServ.com\*
hiserv.com\*
metro.ch\*
beyond.com\*
mcafee.com\*
pandasoftw\*
earthlink.\*
inexar.com\*
comkom.co.\*
meditrade.\*
mabex.com \*
cellco.com\*
symantec.c\*
successful\*
inforamp.n\*
newell.com\*
singnet.co\*
bmcd.com.a\*
bca.com.nz\*
trendmicro\*
sophos.com\*
maple.com.\*
netsales.n\*
f-secure.c\*
The worm also intercepts e-mail messages that are sent and attempts to send a duplicate message with the infected attachment to the same address (the same as "Happy99/Ska" worm does). As a result, victim address should receive two messages: first is the original message written by the sender, second is a message with empty subject and text and attached file that has one of the names that are selected by worm depending on current date:
README.TXT.pif
I\_wanna\_see\_YOU.TXT.pif
MATRiX\_Screen\_Saver.SCR
LOVE\_LETTER\_FOR\_YOU.TXT.pif
NEW\_playboy\_Screen\_saver.SCR
BILL\_GATES\_PIECE.JPG.pif
TIAZINHA.JPG.pif
FEITICEIRA\_NUA.JPG.pif
Geocities\_Free\_sites.TXT.pif
NEW\_NAPSTER\_site.TXT.pif
METALLICA\_SONG.MP3.pif
ANTI\_CIH.EXE
INTERNET\_SECURITY\_FORUM.DOC.pif
ALANIS\_Screen\_Saver.SCR
READER\_DIGEST\_LETTER.TXT.pif
WIN\_$100\_NOW.DOC.pif
IS\_LINUX\_GOOD\_ENOUGH!.TXT.pif
QI\_TEST.EXE
AVP\_Updates.EXE
SEICHO-NO-IE.EXE
YOU\_are\_FAT!.TXT.pif
FREE\_xxx\_sites.TXT.pif
I\_am\_sorry.DOC.pif
Me\_nude.AVI.pif
Sorry\_about\_yesterday.DOC.pif
Protect\_your\_credit.HTML.pif
JIMI\_HMNDRIX.MP3.pif
HANSON.SCR
FUCKING\_WITH\_DOGS.SCR
MATRiX\_2\_is\_OUT.SCR
zipped\_files.EXE
BLINK\_182.MP3.pif
The worm sends out the WIN32.DLL file that was dropped by the virus component during MTX's first installation to the infected system.
Note: the worm does not drop WIN32.DLL file, but uses that file to attach it to messages that are sent. So the "pure worm" is not able to spread more than once: when run on victim machine it will infect WSOCK32.DLL, but will not able to send its copies further. To "fix that problem" the worm sends its infected copy (WIN32.DLL is the worm component infected by the virus component, see above).
Fortunately, the known worm modification has a bug in its spreading routine and the e-mail server fails to receive affected messages from the infected machine. So, the known worm version cannot be widely spread.
Backdoor Component
Being run, the backdoor component creates a new key in system registry that indicates that the machine is already infected:
HKLM\Software\[MATRIX]
If this key exists, the Backdoor skips the installation procedure. Otherwise it registers itself in auto-run section:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SystemBackup=%WinDir%\MTX\_.EXE
where %WinDir% is Windows directory.
The backdoor then stays active in Windows as a hidden application (service) and runs a routine that connects to some Internet server, gets files from there and spawns them to the system. So the Backdoor can infect the system with other viruses or install trojan programs or more functional backdoors.
The backdoor in the known virus version has a bug that causes a standard error message when the backdoor tries to access the Internet site.
### 3.0 Possible Steps
#### 3.1 Prevention
DO NOT execute the file " win95.mtx " and do not open any email attachments mentioned as in 2.1.
Do not open any suspicious/unknown attachments and delete them immediately. Regularly update the virus definition file of your antivirus software and run a virus scan on the computer. This is to ensure that the software is able to detect the presence of a new virus. The list of known antivirus vendor can be found at:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
Always run a virus scan on any downloadable files before executing it. It is advisable that your antivirus software is running in "Auto Protect Mode" at all time.
**3.2 Detection**
To detect the virus, run a latest antivirus scan on any email attachments and any downloadable files that you receive.
**3.3 Removal**
1) REINSTALL OS
This is since it is difficult to remove the virus. This will be the fastest way.
1.1) Backup all the important data into virus free PC.
Make sure that the virus-free PC running the latest virus signature before do the backup.
1.2) Reinstall the OS.
2) TRY TO CLEAN UP THE VIRUS
2.1) Uninstall the anti virus software.
2.2) Reinstall the anti virus software.
2.3) Update the anti virus signature.
2.4) Run the anti virus.
All the process must be done OFFLINE to prevent from the virus to spread. You may put the latest virus signature on removeable medium (floppy disk, zip drive).
To update antivirus on computers disconnected from the network:
For Symantec, this is the URL:
http://securityresponse.symantec.com/avcenter/download.html
For NAI, this is the URL:
http://vil.nai.com/vil/content/v\_98797.htm
3) FOLLOW STEPS GIVEN BY SYMANTEC
http://www.norton.com/avcenter/venc/data/w95.mtx.html
Look under Removal: How to repair
Symantec's Fixtool
http://www.sarc.com/avcenter/venc/data/w95.mtx.fix.tool.html
3) USE THE STEPS GIVEN BY F-SECURE ON HOW TO REMOVE THE VIRUS MANUALLY
http://www.europe.f-secure.com/v-descs/mtx.shtml
"If the F-Secure Anti-Virus is not able to remove one of the dropped MTX components (in the case that the files are locked by Windows), please download and run the following REG file, restart your system and scan your hard drives again:
ftp://ftp.europe.f-secure.com/anti-virus/tools/mtxdisin.reg
You can delete the 3 components from your Windows directory manually from DOS:
IE\_PACK.EXE
WIN32.DLL
MTX\_.EXE
The Windows WinSock library WSOCK32.DLL that is patched by MTX should be restored from backups as the virus does not preserve the original file."
### 4.0 More Information
To obtain more information on this virus, please refer to the following site :
4.1 **Network Associates**
http://vil.nai.com/vil/content/v\_98797.htm
4.2 **Symantec Antivirus Research Center**
http://www.norton.com/avcenter/venc/data/w95.mtx.html
4.3 **F-secure**
http://www.europe.f-secure.com/v-descs/mtx.shtml