Bagle.E is a worm that spreads via e-mail in a message with variable characteristics, and an attached file that has an icon similar to the one belonging to Windows Notepad. Bagle.E contains a backdoor, which opens the TCP port 2745. It attempts to connect to several web pages that host a PHP script. By doing this, Bagle.E notifies its author that the affected computer can be accessed through the port mentioned above. In addition, Bagle.E ends the processes belonging to several antivirus update applications. This worm only runs if the system date is March 14, 2004 or previous. After this date, Bagle.E stops functioning. |