W32/VBNA-X is a pendrive worm, which spreads itself through networks, along with cloning itself within any removable media (like USB pendrives) that's avaliable at the moment.
W32/VBNA-X detects when the victim plugs-in any removable media, doing the following to the device:
- All folders will be marked as hidden.
- All files stored on root directory will be deleted.
- When no directory or file is accessible or visible by the victim, it will start to add a couple malicious executable files, all of them will have the same file/directory names as the deleted/hidden ones.
- The worm will also create several shortcut files and extra executable files, called "Sex.exe", "Nude.exe", "Porn.exe", "Password.exe" and "Secret.exe".
These steps will be followed only once, soon after W32/VBNA-X detects the presence of a removable media. After that, the worm will stop and don't do anything else. However, when plugged-out and then plugged-in again, the removable media will be infected again.