Alias:Magistr
Type:Worm 
Size:30 KB 
Origin: 
Date:03-20-2001 
Damage:Sent by email. 
VDF Version:6.23.00.00 
Danger:High 
Distribution:Medium 

DistributionW95/Begemont.B spreads over Internet, by sending infected emails on Outlook Express, Netscape Messanger or Internet Mail and News. For doing this, the worm reads all settings of the email Clients directly from the registry.
Subject: is built out of words and phrases found in DOC and TXT files.
Body: remains empty.
Attachment: variable, usually an infected EXE file of 132 KByte size.

Technical DetailsIf an infected file is opened, the worm is installed as memory resident and shows a message: ""Kommandolinjen har forkert format".
Then it remains for some minutes on memory without making any visible change on the system. First, it changes its name into the name of the Explorer. Using a ~100 Byte routine, the worm "shifts" into the Explorer's memory and pretends to be an Explorer component. The next damage routine is started after ~4 minutes. W95/Begemont.B infects an EXE file in Windows directory. It makes the registry entry:
HKLM\Software\Microsoft\Windows\Current Version\Run
and in WIN.INI it registers under "run=".
W95/Begemont.B will thus be automatically started.
Then, all EXE files from Windows system directory are infected.
The worm searches all network drives for Windows-, WINNT-, Win95- or Win98 directories. There, it infects all .EXE files and modifies the "run=" entry in WIN.INI. Thus, it will be automatically activated when the modified systems will be restarted.
While Begemont.B executes its routine, a DAT file is created on C:\. The file name is always the name of the computer used under Windows:

Computer name File name
WIN95 WIN95.DAT
PC750M PC750M.DAT


A month after infecting the system, W95/Begemont.B executes another routine, by overwritting all files saved on a floppy disk with the following text:
"YOURESHIT".
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .