The Matcher worm, which was discovered only yesterday, has already spread its way around SA and the world.
AVS Content Security says Matcher is "wreaking havoc in SA and the company has been inundated with calls for anti-virus solutions". Symantec rates the virus`s distribution as "high" (over 1 000 infections), although it causes small amounts of damage and is easy to remove.
The worm, which spreads through the typical Outlook Mail address book method, is easy to spot. The subject line to look out for in e-mails is "Matcher", and the body of the message contains: "
"When the attachment, 'Matcher.exe`, is executed, the worm copies itself to the Windows System directory as matcher.exe, after which the worm adds a key to the registry allowing the worm to execute after restarting," says Clint Carrick, MD of AVS Content Security.
"After execution, the worm sends itself to everyone in the Outlook Address book with the above e-mail. The worm will continue to send e-mails in an infinite loop," he says.
The worm also modifies the autoexec.bat file - a batch file that executes automatically on Windows boot-up - so that the infected computer will pause on boot-up and display the word: "Bugger".
Removal of the virus is simple, requiring the user to delete the registry key "HKLM/Software/Microsoft/Windows/CurrentVersion/Run/{Default}=Windows System Directory/matcher.exe" and delete the added lines in the autoexec.bat file.
Share
