W32.Beagle.B@mm is a mass-mailing worm that opens a backdoor on TCP port 8866. The worm uses its own SMTP engine for email propagation. It can also send the attacker the port on which the backdoor listens and a randomized ID number.
The email has the following characteristics:
From: <spoofed>
Subject: ID <random characters>... thanks
Attachment: <random characters>.exe
http://securityresponse.symantec.com/avcen...eagle.b@mm.html
and if u are infected
get this tool:
ftp://ftp.f-secure.com/anti-virus/tools/f-bagle.zip
found from here:
http://www.f-secure.com/v-descs/bagle_b.shtml
which has the follwing info about the worm:
F-Secure is upgrading Bagle.B worm to Level 1, as it keeps spreading rapidly. It arrives in email with random subject and attachment name with an EXE extension. The worm installs a backdoor that listens on port 8866.
Bagle.B worm has been programmed to stop spreading on February 25th.