Computing.Net > Forums > Security and Virus > w32.benjamin

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Click here to start participating now! Also, check out the New User Guide.

w32.benjamin

Reply to Message Icon

Name: philc
Date: May 24, 2002 at 04:49:16 Pacific
Comment:

i have this virus and i have norton corprate antivirus,but it wont get rid of it. does anyone know how to get this thing out ? thanks in advance



Sponsored Link
Ads by Google

Response Number 1
Name: Norm
Date: May 24, 2002 at 06:32:57 Pacific
Reply:

I found this download, antibenjamin.exe
use at your own risk, or wait for more info.

http://www.wilders.org/downloads.htm


0

Response Number 2
Name: sixonetonoffun
Date: May 24, 2002 at 07:20:55 Pacific
Reply:

Bitdefender has provided this removal tool can't testify to how well it works. I haven't been blessed with benjamin yet.


http://www.bitdefender.com/download/antibenjamin.exe



0

Response Number 3
Name: DW
Date: May 25, 2002 at 05:43:16 Pacific
Reply:

Here's a link to the write up & removal instructions at Symantec
W32.Benjamin.Worm
If you use Windows ME or XP you'll also need to remove it from the Restore folder, this link will help with that
Good luck


0

Response Number 4
Name: Ben
Date: May 25, 2002 at 06:01:33 Pacific
Reply:

I have NAV 2002 and as soon as i am stupid enough 2 download it it picks up the worm just like that


0

Response Number 5
Name: Bhushan Paranjpe
Date: July 7, 2002 at 07:41:57 Pacific
Reply:

This threat is considered a Low-Profiled risk as it is not wide-spread and has gotten media attention.
When this worm is run, it copies itself to %WINDIR%\SYSTEM\EXPLORER.SCR, where %WINDIR% is the directory Windows is installed in. Then it adds the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
Run\SystemService=%WINDIR%\SYSTEM\EXPLORER.SCR
To spread, the worm requires that the Kazaa software is installed on the machine. It creates a directory called %WINDIR%\TEMP\SYS32, and changes the Kazaa settings so that remote users can download from this directory. Then it copies itself to that directory under many different names which other users may search for. The size of these files can vary since the worm pads them with garbage bytes. This method of spreading is comparable to the VBS/GWV worm.

Presence of EXPLORER.SCR and registry key pointing to it.
Presence of %WINDIR%\TEMP\SYS32 and many files inside.

Since this worm offers itself over the Kazaa network under names that users may find tempting, users who are not infected may download and run the worm from infected machines, and thus spread the worm themselves.



0

Related Posts

See More



Sponsored Link
Ads by Google
Reply to Message Icon

w32.stator@mm virus (worm... virus estrella.exe



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: w32.benjamin

w32.benjamin.worm www.computing.net/answers/security/w32benjaminworm/1529.html

Benjamin Virus or Kazaa Virus www.computing.net/answers/security/benjamin-virus-or-kazaa-virus/727.html

Is this a W32 series virus? www.computing.net/answers/security/is-this-a-w32-series-virus/1897.html