Worm:Win32/Pushbot.BZ

Worm:Win32/Pushbot.BZ is a worm that spreads via MSN Messenger when commanded to by a remote attacker. This worm contains backdoor functionality that allows unauthorized access and control of an affected machine.

When executed, Worm:Win32/Pushbot.BZ copies itself to %windir%\live.messenger.com and sets the attributes of this file to read-only, hidden and system. It then modifies the registry to ensure that this copy is executed at each Windows start:
 
Adds value: "MSN Messenger"
With data: "live.messenger.com"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
 
It creates a mutex named "sfkgdfgsdfg" in order to ensure that multiple copies of the worm do not run simultaneously.

Using backdoor functionality (see Payload section below for additional detail) Worm:Win32/Pushbot.BZ can be ordered to spread via MSN Messenger by a remote attacker. It sends a message to all of the infected user's contacts.
The worm can be ordered to send messages, which can contain URLs pointing to a remotely hosted copy of itself. The message is provided by the controller via the IRC backdoor. It has been observed to include a URL pointing to a copy of the worm executable on the domain 'hostsnake.com'.

Once installed, the worm connects to IRC server ‘c.milan-fans.com’ on port 8080 and awaits instructions. Using the backdoor, a remote attacker can perform a number of actions of the affected machine, including the following:

Pushbot.BZ drops a 0 byte file to %windir%\admintxt.txt.