It notifies its author that the affected computer is reachable through the port 8866. It stops functioning after February 25, 2004.

Windows 2003/XP/2000/NT/ME/98/95

Bagle.B is a worm that spreads via e-mail in a message with the subject ID <random text>... thanks, and an attached file that has the same icon as a WAV audio file.

Bagle.B attempts to connect to several web pages that host a PHP script. By doing this, Bagle.B notifies its author that the affected computer can be accessed through the port 8866.

This worm only runs if the system date is February 25, 2004 or previous. After this date, Bagle.B stops functioning.

Bagle.B is easy to recognize, as it reaches the computer in an e-mail message with the following characteristics:

• Subject:
  ID <random text 1>... thanks
• Message:
  Yours <random text 2>
  --
  Thank
• Attachments:
  The file name is variable, but always has an EXE extension. It has the following icon:
  
  

When the attached file is run, Bagle.B opens the Windows Sound Recorder:

Then, it displays the following error message on screen: