W32/Forbot-CB is a network worm which also allows unauthorised remote access to the computer via IRC channels.
W32/Forbot-CB copies itself to the Windows system folder as dialup.exe and entries in the registry at the following locations to run itself on system logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Dialup Service
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Windows Dialup Service
HKLM\Software\Microsoft\Windows\CurrentVersion\RunService\
Windows Dialup Service
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Dialup Service
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Windows Dialup Service
HKLM\System\CurrentControlSet\Services\Windows Dialup Service\
ImagePath
W32/Forbot-CB may delete C$, D$, IPC$ and ADMIN$ shares.
The backdoor component of the worm can be used to cause a denial of service by flooding, steal information from predefined registry entries and terminate processes.