How to Clean/Delete the MTX Virus?

Unfortunately this is a VERY DIFFICULT virus to remove. It alters some system files beyond repair. In some cases you will not be able to start Windows until you restore the original files from a Windows CD or from .cab files. You should create a startup disk with CD-ROM drivers on it before attempting to remove this virus.

Next, You'll probably want to download a cleaner/remover from Symantec's website. Its called fixmtx.exe and can be found at http://www.symantec.com/avcenter/venc/data/w95.mtx.fix.html. Save the file on your windows desktop.

First Remove the Registry Entries and Delete the files the virus created.

• Click START|RUN
  Type REGEDIT and hit ENTER key
• In the left panel, click the "+" to the left of any of the following:
  HKEY_LOCAL_MACHINE
  Software
  Microsoft
  Windows
  CurrentVersion
  Run
  If this contains the value
  SystemBackup = "c:\windows\mtx_.exe" delete the entire key by pressing the DELETE key. Answer YES when asked to confirm.
• Next, look for the following registry entry:
  HKEY_LOCAL_MACHINE
  Software
  (MATRIX)
  Delete this key too and close regedit.
• Click START|Find
  Type "wininit.ini". On the list box "Look in" indicate the Drive C and hit the ENTER key.
  If it returns a file matching our search, highlight on it and press the DELETE key.
• Click START|Find
  Type "wsock32.mtx". On the list box "Look in" indicate the Drive c:\ and hit the ENTER key.
  If it returns a file matching our search, highlight on it and press the DELETE key.

Now, run the fixmtx.exe cleaner from Symantec to discover which files are infected with MTX.

• Close all programs, including your Web Browser.
• Click Start, point to Programs, and then click MS-DOS Prompt. An MS-DOS window will open.
• Change to the following location where you saved the fixmtx.exe tool by typing the following and pressing Enter:
  
  cd \windows\desktop\fixmtx
  
  
• At the C:\windows\desktop\fixmtx> prompt, type the following and press Enter to scan ALL FILES ON THE INFECTED SYSTEM
  
  fixmtx c:\

The fixmtx will give you information about what could be repaired, and what couldn't. In general, you will have to extract new versions of wsock32.dll, explorer.exe, and rundll.exe from your installation CD or .cab files since those files will be unrepairable.

This extraction of new files should be done from a DOS prompt, you'll want to boot to DOS using the Start-up Disk, you should have made before you started any of this.

Extract new copies of the Wsock32.dll, Explorer.exe, and Rundll32.exe files
This is necessary because these files have very likely been infected by the virus and are critical for accessing the Internet and using the computer. You need to use the Extract command at a DOS prompt to restore good copies of these files from the Windows installation files.

There are two locations from which these files can be extracted:

• The Windows installation files on your hard drive. On many newer computers, the Cab files that contain the Windows installation files are stored on the computer's hard drive. If you are sure that this is the case, see the section How to extract files that are located on the hard drive.
• The Microsoft Windows 95/98 Installation CD. If you do not have the Cab files on the hard drive, see the section How to extract files that are located on the installation CD.

1. Type the following and then press Enter:
   
   dir /s \precopy1.cab
   
   This will search the hard drive for the location of the Cab files. If the file is not found, it is likely that the Cab files are not on the hard drive. Skip to the section How to extract files that are located on the installation CD.
   
2. Write down the location that follows "Directory of," for example, C:\Windows\Options\Cabs.
   
3. Change to the directory whose location you wrote down in the previous step by typing cd followed by the path. For example, to change to the location shown in step 2, type the following command and then press Enter:
   
   cd \windows\options\cabs
   
4. What you do next depends on which operating system you are using:
   
   NOTES:
   • If after entering any of these commands, you see a messages such as "File not found," type the command again to make sure that it was typed exactly as shown.
   • If you see a message asking if you want to overwrite a file, (Yes/No/All) type Y and then press Enter.
   • If you have Windows installed to a different location, please make the appropriate substitutions.

   
   If you are using Windows 98, type the following commands and press Enter after each one:
   
   extract /a precopy1.cab wsock32.dll /l c:\windows\system
   extract /a win98_40.cab explorer.exe /l c:\windows
   extract /a win98_40.cab rundll32.exe /l c:\windows
   
   If you are using Windows 95, type the following commands and press Enter after each one:
   
   extract /a win95_10.cab wsock32.dll /l c:\windows\system
   extract /a win95_10.cab explorer.exe /l c:\windows
   extract /a win95_10.cab rundll32.exe /l c:\windows
   
   If you experience no error messages, then you are finished with the extraction process. Go on to the section Edit the registry. Caution: On occasion, other files, such as taskmon.exe can also be corrupted beyond repair and must be replaced. Use the same procedure seen above in replacing these files.
   

1. Insert the Windows 98 Startup disk in the floppy disk drive.
2. Insert the Windows 98 installation Cd in the CD-ROM drive.
3. Turn off the computer and wait thirty seconds.
4. Turn on the computer. The computer will start to a startup menu.
5. The default menu item is Start Computer with CD-ROM Support. Do not change this, but instead press Enter.
6. Allow the computer to finish booting to a A: prompt. This could take a few minutes.
7. The next step is to change to the CD-ROM drive. Because you are using the Startup disk, the drive letter will be one letter greater than the drive letter that usually represents the CD-ROM drive. For example, if the CD-ROM drive is the D: drive in Windows, it will now be the E: drive.
   
   Type the following, changing the drive letter as necessary, and then press Enter:
   
   E:\Win98 (If the installation disk is for Windows 98)
   
   or
   
   E:\Win95 (If the installation disk is for Windows 95)
   
   If you see an error message, try retyping the command with a different drive letter, for example, F:\Win98.
8. What you do next depends on which operating system you are using:
   
   NOTES:
   
   • If after entering any of these commands, you see a messages such as "File not found," type the command again to make sure that it was typed exactly as shown.
   • If you see a message asking if you want to overwrite a file, (Yes/No/All) type Y and then press Enter.
   • If you have Windows installed to a different location, please make the appropriate substitutions.

   If you are using Windows 98, type the following commands and press Enter after each one:
   
   extract /a precopy1.cab wsock32.dll /l c:\windows\system
   extract /a win98_40.cab explorer.exe /l c:\windows
   extract /a win98_40.cab rundll32.exe /l c:\windows
   
   If you are using Windows 95, type the following commands and press Enter after each one:
   
   extract /a win95_10.cab wsock32.dll /l c:\windows\system
   extract /a win95_10.cab explorer.exe /l c:\windows
   extract /a win95_10.cab rundll32.exe /l c:\windows
   

Reboot the computer and Run a virus check.

Hopefully, the MTX virus will be out of your system at this point. 90% of the time, I've been able to clean it using this method, however I have experienced a couple systems where the virus would return again and again. I had to reformat these systems to absolutely clean it.

Good luck with cleaning the MTX virus. It is a nasty one that is VERY HARD to get rid of. I hope these instructions help.