VBS/ButSur-A is a Visual Basic script worm for the Windows platform.
When run VBS/ButSur-A copies itself to <Windows>\Bha.dll.vbs and creates the following registry entries to run itself on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MS32DLL
<Windows>\Bha.dll.vbs
VBS/ButSur-A also sets registry entries under:
HKCU\Software\Microsoft\Internet Explorer\Main\Window Title\
VBS/ButSur-A also copies itself to all removeable and shared drives as <Root>\Bha.dll.vbs and creates the file <Root>\autorun.inf. The file <Root>\autorun.inf can be safely removed.