I-Worm.MTX Virus Information

NetPlus Users Beware! There is a new virus spreading rapidly throughout the internet. 

This is a virus-worm spreading under Win32 systems. The virus infects Win32 executable files, attempts to send e-mail messages with infected attached files, as well as installs a backdoor component to download and spawn "plugins" on an affected system.

The virus has an unusual structure. It consists of three different components that are run as stand-alone programs (Virus, e-mail Worm and Backdoor). The virus is the main component, and it keeps the worm and backdoor programs in its code in compressed form. While infecting the system, the virus extracts and spawns them.

For the latest information on the I-Worm.MTX virus visit the following site: 

http://www.viruslist.com/eng/viruslist.asp?id=4063&key=00001000130000100034

The worm also intercepts e-mail messages that are sent and attempts to send a duplicate message with an infected attachment to the same address (the same as "Happy" worm does). As a result, a victim address should receive two messages: first, is the original message, written by a sender; second, comes a message with an empty subject and text and an attached file that has one of the names that are selected by the worm depending on the current date:

README.TXT.pif
I_wanna_see_YOU.TXT.pif
MATRiX_Screen_Saver.SCR
LOVE_LETTER_FOR_YOU.TXT.pif
NEW_playboy_Screen_saver.SCR
BILL_GATES_PIECE.JPG.pif
TIAZINHA.JPG.pif
FEITICEIRA_NUA.JPG.pif
Geocities_Free_sites.TXT.pif
NEW_NAPSTER_site.TXT.pif
METALLICA_SONG.MP3.pif
ANTI_CIH.EXE
INTERNET_SECURITY_FORUM.DOC.pif
ALANIS_Screen_Saver.SCR
READER_DIGEST_LETTER.TXT.pif
WIN_$100_NOW.DOC.pif
IS_LINUX_GOOD_ENOUGH!.TXT.pif
QI_TEST.EXE
AVP_Updates.EXE
SEICHO-NO-IE.EXE
YOU_are_FAT!.TXT.pif
FREE_xxx_sites.TXT.pif
I_am_sorry.DOC.pif
Me_nude.AVI.pif
Sorry_about_yesterday.DOC.pif
Protect_your_credit.HTML.pif
JIMI_HMNDRIX.MP3.pif
HANSON.SCR
FUCKING_WITH_DOGS.SCR
MATRiX_2_is_OUT.SCR
zipped_files.EXE
BLINK_182.MP3.pif

 

Thank you

NetPlus Staff