W32/Oscabot.O is a Trojan for the Windows systems. It spreads via AOL Instant Messenger.

Upon execution, the worm copies itself as msclean.exe in the Windows folder.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

The worm runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control to the infected computer via IRC channels.

This worm first appeared on July 7, 2006.

 Other names of W32/Oscabot.O Worm:

This Worm is also known as W32/Oscabot-O, Backdoor.Win32.Aimbot.v .