Heartless Bagle.U worm on the loose

Security experts have warned on a new strain of the Bagle worm which launches the Hearts card game when it executes.

Network Associates said one of the symptoms of an infection is that the Microsoft Hearts game, if present on a victim machine, will run when the worm executes.

Unlike some of its predecessors, Bagle.U carries its payload as an .exe file rather than in a .zip archive, which may make it easier for corporate email filters to block.

Bagle.U sends out emails with a blank subject line and message, and an attachment with a randomised name. Antivirus company Sophos said email addresses belonging to the domains AVP and Microsoft are skipped.

Virus expert Ken Dunham, of security company iDefense, said: "There is nothing compelling in the email, literally nothing, to make a user click on the attachment."

The worm also embeds itself into the Windows System directory and sets up a 'listener' to allow the host PC to be taken over remotely.

Users are advised to be wary and not open any suspicious e-mails or attachments.

After the end of 2004 the worm will remove itself from the system.

More information can be found here.