Bagle worm
|
|
Bagle is a computer worm affecting Microsoft Windows. The first strain, Bagle.A, did not propagate widely. A second variation, Bagle.B is considerably more virulent.
Bagle is a mass-mailing worm. It copies itself to the Windows system directory (Bagle.A as bbeagle.exe, Bagle.B as au.exe) and opens a backdoor on TCP port 6777 (Bagle.A) or 8866 (Bagle.B). It does not mail itself to addresses containing the strings "@hotmail.com", "@msn.com", "@microsoft" or "@avp".
The initial strain, Bagle.A, was first sighted on January 18, 2004. It was not widespread and stopped spreading after January 28, 2004.
The second strain, Bagle.B, was first sighted on February 17, 2004. It is already much more widespread and is showing in large quantities; Network Associates rates it a "medium" threat. It is designed to stop spreading after February 25, 2004.
Subsequent variants have later been discovered. Although they have not all been successful, a number remain notable threats.