LHRIC logo TECHNICAL SERVICES
LHRIC logo home | search | contact | Virus Central  
LHRIC logo

Providing timely, reliable & cost-effective technical support 

Virus Central - Detailed

Virus Information

Name:

W95/HLLW.Matcher.A

Aliases:

Matcher, W 32.Matcher

Type:

Internet Worm

Discovery Date:

April 18, 2001

Detection:

Command AntiVirus version 4.58.3 or higher with definition files dated 04/18/2001 will detect and delete the virus.

Virus Description:

A worm written in Visual Basic that arrives as an email attachment

E-mail Subject:

Matcher Message:

E-mail Body:

Want to find your love mates!!! Try this its cool... Looks and Attitude Matching to opposite sex.

Attachment:

Matcher.exe

Virus Effects:

When the attachment is opened, the worm is executed. It places a copy of itself in the Windows System directory, and adds a key to the registry so that it will be activated at each Windows Start Up. W95/HLLW.Matcher.A then begins sending itself out to all recipients in the system's Microsoft Outlook Address book.

Finally, it modifies the C:\AUTOEXEC.BAT file so that it will output a message "from: Bugger" and pause until you press enter.

Note: The file "MSVBVM60.DLL" must be on the system in order for the worm to run.

Removal Instructions:

Run Regedit and in the left pane open the following:

HKLM\Software\Microsoft\CurrentVersion\Run

In the right pane, find the Default tab that contains the data value "C:\Windows\System\matcher.exe" and delete it. Also open the

AUTOEXEC.BAT and delete the following two lines:

@echo from: Bugger

pause

 

 


Site Last Updated: August 29, 2001
© Copyright 2001,2002 Lower Hudson Regional Information Center (LHRIC).