Worm:Win32/Pizbot.gen

Worm:Win32/Pizbot is a family of worms that spread via P2P file sharing networks. They also function as a backdoor that allows unauthorized access and control of an affected machine via IRC.

When Worm:Win32/Pizbot.gen runs, it copies itself to the %windir%\fonts directory. Filenames may differ according to minor variant, however, a typical filename used by the worm is “svchost.exe” (for example).

 

It then modifies the registry to execute itself at each Windows start, for example:
Adds value: “Host Process”
With data: "%windir%\fonts\svchost.exe"
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Worm:Win32/Pizbot.gen attempts to spread via P2P file sharing networks, using file sharing applications such as Gnutella, Limewire and Bearshare. It may compress a copy of itself as “setup.exe” into a zip archive with a filename similar to "zz45rhejfnmdsn654783hn666vb.zip" (for example) when spreading. The worm may also make changes to the targeted file sharing application's configuration in order to hide its activity.

Worm:Win32/Pizbot.gen connects to a specified IRC server and waits for instructions from a remote attacker. In the wild, this trojan has been observed contacting the following site in order to download advertising content: