Benjamin Removal Tool

Benjamin Removal Tool is a simple utility that will enable you to clean the Win32.Worm.Benjamin malware from your system.

When an user runs the worm it will display an error message box. After that the worm creates two registry keys:

System Service with value C:\Windows\System\explorer.scr in

HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and

syscod with value 0065D7DB20008306B6A1 in

HKEY_LOCAL_MACHINE\Software\Microsoft.

Next it will create a copy of itself in %System%\explorer.scr and a lot of copies with names of movies songs and known software applications in C:\Windows\Temp\Sys32.

If Kazaa is installed it will change the share folder to C:\Windows\Temp\Sys32 so if an user from the Kazaa network searches for a file with name close to the names of files the worm creates in Temp\Sys32 it will found an infected file.

The worm opens the Internet explorer at the following URL: benjamin.xww.de