You're in: Panda Security > Home Users > security-info > about-malware > encyclopedia > overview
Active Scan. Scan your PC free
Panda Security Product Line 2012

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard True 0

Bagle.B

 
Threat LevelHigh threatDamageHighDistributionModerately widespread
Common name:Bagle.B
Technical name:W32/Bagle.B.worm
Threat level:High
Alias:W32/Yourid.A.worm
Type:Worm
Effects:  It notifies its author that the affected computer is reachable through the port 8866. It stops functioning after February 25, 2004.

Affected platforms:

Windows 2003/XP/2000/NT/ME/98/95

First detected on:Feb. 17, 2004
Detection updated on:March 6, 2006
StatisticsNo
Yes, using TruPrevent Technologies

Brief Description 

    

Bagle.B is a worm that spreads via e-mail in a message with the subject ID <random text>... thanks, and an attached file that has the same icon as a WAV audio file.

Bagle.B attempts to connect to several web pages that host a PHP script. By doing this, Bagle.B notifies its author that the affected computer can be accessed through the port 8866.

This worm only runs if the system date is February 25, 2004 or previous. After this date, Bagle.B stops functioning.

Visible Symptoms 

    

Bagle.B is easy to recognize, as it reaches the computer in an e-mail message with the following characteristics:

  • Subject:
    ID <random text 1>... thanks
  • Message:
    Yours <random text 2>
    --
    Thank
  • Attachments:
    The file name is variable, but always has an EXE extension. It has the following icon:

When the attached file is run, Bagle.B opens the Windows Sound Recorder:

Then, it displays the following error message on screen: