Related Resources • Glossary of Terms • Virus Encyclopedia

Elsewhere on the Web • F-Secure Description   • MessageLabs Threatlist

It's said that opposites attract and this matchmaker program will certainly deliver the opposite of what users expect. Instead of providing the promised compatibility matching for your future soulmate, it delivers a mass-mailing email worm. Matcher doesn't just send itself once to recipients listed in the infected user's address book either. According to the folks at F-Secure, in some cases the worm repeats sending itself every 1 minute and as a result mail servers might be overloaded with the worm's messages.

The worm comes disguised as a matchmaking tool, in an email reading:

Subject: Matcher
Body: Want to find your love mates!!! Try this its cool... Looks and Attitude Maching to opposite sex.
Attachment: Matcher.exe

The worm also modifies the AUTOEXEC.BAT file so that when the system is next rebooted a message will appear on screen "from: Bugger" and the system will be paused for user input.

Matcher has no malicious payload and doesn't hide itself nor does it delete its copies from the Sent folder.

Because the worm's file MATCHER.EXE is locked while Windows is active, F-Secure recommends that users who wish to manually remove the infection from their system do so in pure DOS mode. After booting from a clean system diskette, users should either delete the file MATCHER.EXE from the \Windows\System\ directory or run a DOS-based scanner to find and remove the infected file. Changes made to the AUTOEXEC.BAT file can be easily edited and removed via a simple text editor such as Notepad.

MessageLab's threatlist indicates that Matcher is spreading at a faster rate than is typical for a new email worm and some antivirus vendors have assigned Matcher a high risk rating.