- Threat Encyclopedia
- Malware
- WORM_TWITBOT.A
Windows 2000, Windows XP, Windows Server 2003
<P>This worm is the Trend Micro detection name for the Mehika <i>Twitter</i> botnet binary. Cybercriminals used a <i>Twitter</i> account in order to send commands to this botnet's new zombies. </p>
To get a one-glance comprehensive view of the behavior of this Worm, refer to the Threat Diagram shown below.
This worm may arrive bundled with malware packages as a malware component. It may be downloaded by other malware/grayware/spyware from remote sites.
It executes commands from a remote malicious user, effectively compromising the affected system.
It modifies the user's Internet Explorer home page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection. It modifies the user's Internet Explorer search page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection.
74,435 bytes
PE
No
16 Jul 2010
Connects to URLs/Ips, Compromises system security, Steals information, Modifies HOSTS file
Arrival Details
This worm may arrive bundled with malware packages as a malware component.
It may be downloaded by other malware/grayware/spyware from remote sites.
Backdoor Routine
This worm executes the following commands from a remote malicious user:
It connects to the following URL(s) to send and receive commands from a remote malicious user:
Web Browser Home Page and Search Page Modification
This worm modifies the user's Internet Explorer home page to the following websites:
It modifies the user's Internet Explorer search engine into the following websites:
NOTES:
It requires other components to effectively perform its malicious routines.
8.900
7.315.00
16 Jul 2010
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Scan your computer with your Trend Micro product to delete files detected as WORM_TWITBOT.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.