Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/Matcher.28672

Win32/Matcher.28672 is a worm written in Visual Basic.  It spreads as a file name "matcher.exe" in the file attachment of an email message with subject "Matcher".  The message body contains the following text:

Want to find your love mates!!!
Try this its cool... Looks and Attitude Maching to opposite sex.

After the file "matcher.exe" is activated the worm creates its copy with the same name in the subdirectory SYSTEM of the directory where Windows is installed.  Adding a startup instruction in the registry  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\  it ensures activation of the file matcher.exe at each  Windows restart.  The worm sends its copy to each address from the address book in the Microsoft Outlook.  It also adds the following commands into the file C:\autoexec.bat (autoexec.bat gets executed whenever the operating system starts):

@echo off

echo from: Bugger
pause

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.