unknown virus

[tacoeater]

customer's computer evidently has been virused but i was going to go online to scan and cannot get past a wsock32.dll fatal error. she says that it sends out 12 or so e-mails at a time, first ones to hit were porno type. she mentions one of them said something about jimi hendrix. has anyone any light to shed on the possible name of this beast?
received it from a friend in australia!
alan

[Edited by tacoeater on 03-26-2001 at 07:07 PM]

[Statica]

TROJ_MTX.A has a trasmitted file called jimi_hendrix.mp3.vbs

There are other manifestations of the virus as well.

First confirm its MTX by going to:
http://housecall.antivirus.com/housecall/start_corp.asp for an online scan if possible

MTX remover [ http://www.antivirus.com/vinfo/security/fix_mtx.exe ] will remove it automatically, if it cant be downloaded use these guidelines.

Directions:
Remove the following registry keys using regedit
HKEY_LOCAL_MACHINE\Software\[MATRiX]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
SytemBackup="c:\windows\mtx_.exe'


Delete the files .. they should be hidden so you have to unhide them.
IE_PACK.EXE
WIN32.DLL
MTX_.EXE

Delete WSOCK32.DLL and load a fresh copy from your WINDOWS installation CD.

[Edited by Statica on 03-26-2001 at 08:17 PM]

[tacoeater]

That was it. Thank you, Statica, very much for responding. Many times customers or friends can only give sketchy details about what their system has done since infection. Your suggested virus was exactly the right one!
Thanks,
Alan