Remember the song “Looking for love in all the wrong places?” Well, security firm Trend Micro Inc. Wednesday found yet another place where love is promised, but only trouble is delivered.
The company identified a new Microsoft Corp. Visual Basic Script Trojan horse virus called “Matcher” early Wednesday morning in Europe and the U.S., said Susan Orbuch, senior director of communications at Trend Micro. A Trojan horse appears to be software that does one thing, but in actuality does another when run, often with mischievous results. Matcher comes disguised as a program that promises to find you a love match. The virus, which Trend Micro said is liable to spread fast, but is non-destructive, goes by the official name Troj_Matcher.A, or the alias Bugger, and will appear as an e-mail attachment called Matcher.exe.
The text of the e-mail, which comes with the subject line “Matcher,” promises that the Matcher.exe program will find you a match in love, but when run, instead makes a few subtle changes to the computer and then resends itself to other people listed in the e-mail program’s address book. After the change is made, the text “From: Bugger” appears on the computer’s screen at startup.
Though the virus will not damage an individual user’s computer, it may pose problems for large organizations, Orbuch said.
“In an organization, it has the potential to overwhelm an e-mail server,” crashing it, she said.
Trend suggests that users who have PCs infected with the virus either run the company’s anti-virus program using the latest update available at the company’s Web site and then delete any files reported to be infected. Anti-virus vendor Symantec Corp. also has an update available for its products on its Web site, Computer Associates International Inc. is working on one and Network Associates Inc. will provide a fix in their next virus update, scheduled for Friday. Companies should institute content-filtering based on either the subject line or attachment name, Orbuch said.
Users should take the standard precautions, including not opening any unexpected or strange attachments, said Michael Callahan, director of marketing for McAfee, a division of Network Associates, which classified Matcher as only a medium risk. Matcher “is under control and not a big risk,” he said.
The company believes Matcher to be copied from the “Melissa” virus, which plagued e-mail systems worldwide in early 1999, Trend Micro’s Orbuch said. The virus writer is believed to have taken the Melissa code and recompiled it into a executable file, she said.
Trend Micro, in Tokyo, can be reached at in Tokyo, can be reached at +81-3-5334-3650, or at its North American headquarters in Cupertino, California, at +1-408-257-1500, or http://www.antivirus.com/