W32/VB.Iu is a worm that will infect Windows systems and spreads through removable drive.

Upon execution, it copies as Win24DLL.exe, Festas.exe, autorun.inf in Windows System folder and Festas.exe in Windows folder.

The worm modifies registry at the following location to load itself during each startup:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

More information can be found at this Proland Software page.