Alias:W32.Matcher.Worm
Type:Worm 
Size:29 Kbytes 
Origin: 
Date:04-26-2001 
Damage:Sent by email. 
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:Low 

DistributionThe email worm Matcher is an .EXE file, programmed in Visual Basic 6.0.

It spreads using the Address Book, over Microsoft Outlook and Outlook Express. The infected email contains:

Subject: Matcher
Body: Want to find your love mates !!! Try this its cool... Looks and A Maching to opposite sex.
Attachment: tcher.exe

Technical DetailsIn order for the virus to be activated, the file MSVBV60.DLL must be installed on the computer.

When the attachment is opened, the worm is installed in Windows system directory, as MATCHER.EXE.

Then, it changes the registry entry:
HKLM\Software\Microsoft\Windows\Current Version\Run@="C:\%WinDIR%\%SystemDIR%Matcher.exe
Thus, the worm is loaded every time Windows starts.

It opens Outlook and sends itself using the Address Book to all email addresses it can find there.

In most cases, the worm sends itself every 2 to 5 minutes.
After sending itself, the worm changes AUTOEXEC.BAT. The next time windows starts, a message appears ("from: Bugger") and a key must be pressed.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .