W32.Matcher Virus Information

NetPlus Users Beware! There is a new virus spreading rapidly throughout the internet. If you receive an email with the attachment Matcher.exe DO NOT open it. It will infect your system and anyone in your address book. Please read the below information for more on this virus. OR for the latest information on the Matcher virus visit the Symantec site at: http://www.symantec.com/avcenter/venc/data/w32.matcher.html 

Distribution

• Subject of email: Matcher
• Name of attachment: Matcher.exe
• Size of attachment: 28,672

Technical description:

W32.Matcher is an email worm that arrives as:

Subject: Matcher

Message: Want to find your love mates!!! Try this its cool... Looks and Attitude Maching to opposite sex.

When executed, the worm does the following:

1. Copies itself to the \Windows\System folder as Matcher.exe.
2. Next, the worm adds the following value:

(Default)    <\Windows\System folder> \Matcher.exe

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run

This will execute the worm when Windows starts.

3. The worm then sends itself to everyone in the Outlook Address book with the previously mentioned email. The worm will continue to send emails in an infinite loop.
4. The worm also modifies the C:\Autoexec.bat file, and appends the lines:

@echo off
echo from: Bugger
pause

Removal instructions:

To remove this worm, delete all detected files, remove the entry that it made to the registry \Run key, and delete the entry that it made to the \Autoexec.bat file.

To remove this worm:

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and then run a full system scan, making sure that NAV is set to scan all files.
3. Delete any files detected as W32.Matcher