W32/VB-CYG is a worm for the Windows platform.
W32/VB-CYG spreads via removable storage devices.
When first run W32/VB-CYG copies itself to \fun.xls.exe and creates the following files:
\autorun.inf
<Windows>\ufdata2000.log
These files can be deleted.
The worm may also create copies of itself as msime82.exe and msfun80.exe and create the following registry entries to run itself automatically on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
IMJPMIG8.2
msime82.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
MsServer
msfun80.exe
The following registry entry is also set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\ SHOWALL
CheckedValue
0