W32/Eboscro is a worm. The worm will infect Windows systems and spreads through removable drives.

The worm will arrive as a dropped file from the network or removable drive.

Upon execution, the worm copies itself as hdcu.exe, iexplore.exe and aKiller.dll in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also copies escro.exe and autorun.inf in the removable drives.

The worm also has backdoor capabilities that connect to eboss.3322.org using TCP port 8111, allowing the remote attacker to perform some of the following actions:

Capture screen shots
Download and execute files
Monitor Internet Explorer activities
Gather some basic system information
Capture Input Method Editor (IME) result strings

The worm also tries to terminate some of the system processes and security related processes.

This worm first appeared on November 06, 2006.

 Other names of W32/Eboscro Worm:

This Worm is also known as W32.Eboscro.