|
|
Worm.P2P.Benjamin. Viruses Information
| Name: |
Worm.P2P.Benjamin. |
| Category: |
Viruses |
| Description:
|
Details
Worm.P2P.Benjamin.a
This worm uses the Kazaa file exchange P2P network to spread itself. The Kazaa network allows its users to exchange files with each other using the Kazaa client software. To learn more about the Kazaa network visit their site at: http://www.kazaa.com.
Benjamin is written in Borland Delphi and is approximately 216 Kb in size - it is compressed by the AsPack utility. The size of a file can vary greatly as the worm ends each file with "dust" for masking.
Installation
Firstly the worm shows a false error report:
Benjamin then copies itself to the %WinDir%SYSTEM directory as
EXPLORER.SCR
and creates two keys in the system registry:
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun] "System-Service"="C:\WINDOWS\SYSTEM\EXPLORER.SCR" [HKEY_LOCAL_MACHINESoftwareMicrosoft] "syscod"="0065D7DB20008306B6A1"
The worm executes after system restarts.
Spreading
Spreading can most likely only take place if the KaZaa P2P client (software) is installed. Benjamin reads the system registry for information on the Kasaa client and creates the
%WinDir%TempSys32
directory catalog that registers as the directory accessible to all KaZaa network users. It fills this directory with copies of itself listed under numerous various names from a list contained in the body of the worm.
Spreading occurs as follows. A "victim" searching for a file in the KaZaa network finds it in the list of accessible files on already infected machine. Not suspecting a problem the user downloads this file and opens it, thus infecting his or her own machine.
Effects
The worm opens the benjamin.xww.de Web-site to display an advertisement. |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Solar.9
LoveChild.48
Alpha.200
Trickste
I-Worm.Yanke
IronMaide
Win32.RainSong.389
Worm.Win32.Kilonce.
Macro.Excel.Delta.
I-Worm.NetSky.
|
|
