What is the Beagle.B worm?

Beagle.B is a mass-mailing worm that opens a backdoor on TCP port 8866. The worm uses its own SMTP engine for email propagation. It can also send the attacker the port on which the backdoor listens and a randomized ID number.

The email has the following characteristics:

From: <spoofed>
Subject: ID <random characters>... thanks
Attachment: <random characters>.exe

Also known as: W32.Alua@mm, Win32/Bagle.B.Worm, W32/Tanx-A

How Does the Beagle.B Worm Infect My Computer?

1. Checks the computer date, and if it is after February 25th, 2004, the worm will exit.
    
2. If the worm is not executed from %System%\Au.exe, it will launch Sndrec32.exe, which is the Windows Sound Recorder.
    
3. If the file, %System%\Au.exe, does not exist, it will copy itself to that location. If it copies itself to %System%\Au.exe, it will launch the newly created copy, and then terminate itself.
    
4. Adds the value:
   
   "au.exe"="%System%\au.exe"
   
   to the registry key:
   
   HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   This modification causes the worm to execute as Windows is started.
    
5. Adds the following two values:
   
   "frn" = "0x00000001" or "frn" = "0x00000000"
   
   and:
   
   "gid" = "<random value>"
   
   to the registry key: HKEY_CURRENT_USER\SOFTWARE\Windows2000
   
   The attacker uses the random value inserted in the "gid" key as a unique identifier.
    
6. Opens a backdoor on TCP port 8866 that allows an attacker to upload files to an infected computer. Any uploaded file will be saved in the %System% folder, and then executed.
    
7. Sends HTTP GET requests every 10,000 seconds to the following Web sites on TCP port 80.
    
8. Scans the local drives for the email addresses in the files with the following extensions:
   • .wab
   • .txt
   • .htm
   • .html
      
9. Uses its own SMTP engine to send itself to the email addresses found in those files. This worm contains its own MIME-encoding routine, and it will compose the email in memory and send it to all the email addresses it finds.

How Can I Remove the Beagle.B Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Beagle.B during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

Follow these steps in removing the Beagle.B worm.

1. Disabling System Restore (Windows Me/XP)

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: "How to disable or enable Windows Me/XP System Restore".

2. Updating the virus definitions

If you do not know which anti-virus software can provide strong protection for you, Kaspersky Internet Security is recommended.

1. Click Start, and then click Run. (The Run dialog box appears.)
2. Type regedit
   
   Then click OK. (The Registry Editor opens.)
   
   
3. Navigate to the key:
   
   HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   
4. In the right pane, delete the value:
   
   "au.exe"="%System%\au.exe"
   
   
5. Navigate to the key:
   
   HKEY_CURRENT_USER\SOFTWARE
   
   
6. Delete the subkey:
   
   Windows2000
   
   
7. Exit the Registry Editor.
   
   
8. Shut down the computer and turn off the power. Wait 30 seconds, and then restart the computer.

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Beagle.B, click Delete.

How to Disinfect My Computer from Worms?

In order to keep your computer protected, bear the following tips in mind:

1. If you have filtering tools installed, configure them to reject messages with the characteristics described above. If, in spite of doing this, you receive the message that contains the virus: do not open it, do not run the attached file and delete it, making sure that you also delete it from the Deleted Items folder.
2. Install a good antivirus in your computer. Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
3. Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
4. Keep your permanent antivirus protection enabled at all times.

Detect and Removal Instruction for Other Variants: