W32/Oscabot-C is an instant messaging worm that can exploit users of AOL Instant Messaging clients.
W32/Oscabot-C connects to a specific channel on an IRC service and waits for an attacker to instruct the bot to send messages to contacts in the infected users AOL contacts list. The message reads "this was cool, check it out", where the word "this" is a link to the W32/Oscabot-C executable on the infected computer.
When first run W32/Oscabot-C copies itself to <WINDOWS>\userint32.exe.
The following registry entries are created to run userint32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Service Manager
<WINDOWS>\userint32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe <WINDOWS>\userint32.exe