W32/Pushbot-B is a worm for the Windows platform.
W32/Pushbot-B spreads to removeable drives.
When run W32/Pushbot-B copies itself to:
<removeable device>\driver\usb\<random name>.exe
<Windows>\rndll.exe
and creates an autorun.inf file in the root of the removeable drive in an attempt to run itself automatically when the drive is loaded (detected separately as W32/SdBot-DNU).
New files and folders on the removeable drive will have the hidden, system and read-only attributes set.
The following registry entries are created to run rndll.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Firevall Administrating
rndll.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
Firevall Administrating
rndll.exe
The following registry entry is set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
<Current Folder>\gdfsgdf.exe
<Current Folder>\gdfsgdf.exe:*:Enabled:Firevall Administrating