What is the Beagle.U worm?

Beagle.U is a variant of Beagle.T. The worm sends itself as an email with a blank subject and body and a randomly named attachment. It also opens a backdoor on TCP port 4751.The attachment name is a random string of letters with a .exe extension.

Also known as: Bagle.U, WORM_BAGLE.U, W32/Bagle-U, W32/Bagle.u@MM

When Beagle.U is executed, it performs the following actions:

1. If the system clock's year is 2005 or later, the worm will exit.
   
   
2. Copies itself as %System%\gigabit.exe.
   
   
3. Adds the value:
   
   "gigabit.exe"="%System%\gigabit.exe"
   
   to the registry key:
   
   HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   so that the worm runs when you start Windows.
   
   
4. Creates the key:
   
   HKEY_CURRENT_USER\SOFTWARE\Windows2004.
   
   
5. Opens a backdoor on TCP port 4751, which allows for file download and execution.
   
   
6. Attempts to execute Mshearts.exe, the executable for the Microsoft Hearts game, if the file is present on an infected computer.
   
   
7. Attempts to notify a predetermined Web server of the infection.
   
   
8. Searches the local disk drives for the email addresses in the files with the following extensions:
   
   • .wab
   • .txt
   • .msg
   • .htm
   • .shtm
   • .stm
   • .xml
   • .dbx
   • .mbx
   • .mdx
   • .eml
   • .nch
   • .mmf
   • .ods
   • .cfg
   • .asp
   • .php
   • .pl
   • .wsh
   • .adb
   • .tbb
   • .sht
   • .xls
   • .oft
   • .uin
   • .cgi
   • .mht
   • .dhtm
   • .jsp
     
     
9. Sends email messages to the addresses that it finds. The Subject and Body of the email are blank, and the Attachment is a copy of the worm with a random file name. The name consists of a random string of letters with a .exe file extension (for example, jwopbh.exe).
   
   
10. Avoids sending email messages to addresses that contain the strings:
    
    • @avp
    • @microsoft

How to Remove the Beagle.U Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Beagle.U during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

Follow these steps in removing the Beagle.U worm.

1. Disabling System Restore (Windows Me/XP)

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: "How to disable or enable Windows Me/XP System Restore".

2. Reversing the changes made to the registry

• Click Start, and then click Run. (The Run dialog box appears.)
• Type regedit
  
  Then click OK. (The Registry Editor opens.)
  
  
• Navigate to the key:
  
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  
  
• In the right pane, delete the value:
  
  "gigabit.exe"="%System%\gigabit.exe"
  
  
• Navigate to the key:
  
  HKEY_CURRENT_USER\SOFTWARE
  
  
• Delete the subkey:
  
  Windows2004
  
  
• Exit the Registry Editor.

3. Updating the virus definitions

If you do not know which anti-virus software can provide strong protection for you, Kaspersky Internet Security is recommended.

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Beagle.U, click Delete.

Detect and Removal Instruction for Other Variants: