Bagle.U

It creates a backdoor that opens TCP port 4751, and notifies its author that the computer can be accessed through it. It opens the Windows game Hearts, if it is installed. It stops functioning after January 1, 2005.

Windows 2003/XP/2000/NT/ME/98/95

Bagle.U is a worm that spreads via e-mail in a message with no subject and no body, and an attached file with a variable file name, but which always has an EXE extension.

Bagle.U contains a backdoor, which opens the TCP port 4751. It attempts to connect to a web page that hosts a PHP script. By doing this, Bagle.U notifies its author that the affected computer can be accessed through the port mentioned above.

Once it is run, Bagle.U opens the Windows game Hearts, if it is installed in the affected computer. This game is usually installed with Windows operating systems.

This worm only runs if the system date is January 1, 2005 or previous. After this date, Bagle.U stops functioning.

Bagle.U is easy to recognize when it reaches the computer, as the attached file has the following icon:

In addition, Bagle.U opens the Windows game Hearts, if it is installed in the affected computer. This game is usually installed with Windows operating systems.