Bagle.U is a worm that spreads via e-mail in a message with no subject and no body, and an attached file with a variable file name, but which always has an EXE extension. Bagle.U contains a backdoor, which opens the TCP port 4751. It attempts to connect to a web page that hosts a PHP script. By doing this, Bagle.U notifies its author that the affected computer can be accessed through the port mentioned above. Once it is run, Bagle.U opens the Windows game Hearts, if it is installed in the affected computer. This game is usually installed with Windows operating systems. This worm only runs if the system date is January 1, 2005 or previous. After this date, Bagle.U stops functioning. |