W32/Bagle.B is a mass mailing worm.This worm is a variant of W32/Bagle.A. The worm will infect Windows systems and spreads through email.

It arrives with the following subject;

ID <random characters> thanks

Infected email carries a spoofed 'From' and 'to' address picked up randomly from the infected system.

The body of the infected mail will be;

Yours ID <random characters>
--
Thank

It carries the following infected attachment;

<random characters>.exe

Upon execution of the attachment, the worm copies itself as au.exe in the Windows System folder.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_USERS\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system;

.wab, .txt, .htm, .html

The worm uses its own SMTP engine to mail itself to these email addresses. Also the worm opens TCP port 8866 for remote connections.

This worm first appeared on 17th February, 2004.

Other names of W32/Bagle.B Worm:

This Worm is also known as W32/Tanx-A, W32/Bagle.b@MM, WORM_BAGLE.B