W32/Forbot-G is a worm which attempts to spread to remote network shares.
The worm also contains backdoor functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Forbot-G copies itself to the Windows system folder as winupdate.exe and creates entries in the registry at the following locations so as to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 USB2 Driver=winupdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 USB2 Driver=winupdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Win32 USB2 Driver=winupdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 USB2 Driver=winupdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 USB2 Driver=winupdate.exe
W32/Forbot-G attempts to spread to network machines using various exploits including the LSASS vulnerability (see MS04-011).
W32/Forbot-G may function as a proxy server, delete network shares and steal information related to popular games.