Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Sent by email.
W95/Begemont.B spreads over Internet, by sending infected emails on Outlook Express, Netscape Messanger or Internet Mail and News. For doing this, the worm reads all settings of the email Clients directly from the registry.
Subject: is built out of words and phrases found in DOC and TXT files.
Body: remains empty.
Attachment: variable, usually an infected EXE file of 132 KByte size.
If an infected file is opened, the worm is installed as memory resident and shows a message: ""Kommandolinjen har forkert format".
Then it remains for some minutes on memory without making any visible change on the system. First, it changes its name into the name of the Explorer. Using a ~100 Byte routine, the worm "shifts" into the Explorer's memory and pretends to be an Explorer component. The next damage routine is started after ~4 minutes. W95/Begemont.B infects an EXE file in Windows directory. It makes the registry entry:
and in WIN.INI it registers under "run=".
W95/Begemont.B will thus be automatically started.
Then, all EXE files from Windows system directory are infected.
The worm searches all network drives for Windows-, WINNT-, Win95- or Win98 directories. There, it infects all .EXE files and modifies the "run=" entry in WIN.INI. Thus, it will be automatically activated when the modified systems will be restarted.
While Begemont.B executes its routine, a DAT file is created on C:\. The file name is always the name of the computer used under Windows:
Computer name File name
A month after infecting the system, W95/Begemont.B executes another routine, by overwritting all files saved on a floppy disk with the following text:
Description inserted by Crony Walker on Tuesday, June 15, 2004