WORM_TWITBOT.A
Windows 2000, Windows XP, Windows Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Worm
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
<P>This worm is the Trend Micro detection name for the Mehika <i>Twitter</i> botnet binary. Cybercriminals used a <i>Twitter</i> account in order to send commands to this botnet's new zombies. </p>
To get a one-glance comprehensive view of the behavior of this Worm, refer to the Threat Diagram shown below.
![](https://documents.trendmicro.com/images/worm_twitbot.a_bd.gif)
This worm may arrive bundled with malware packages as a malware component. It may be downloaded by other malware/grayware/spyware from remote sites.
It executes commands from a remote malicious user, effectively compromising the affected system.
It modifies the user's Internet Explorer home page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection. It modifies the user's Internet Explorer search page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection.
TECHNICAL DETAILS
Arrival Details
This worm may arrive bundled with malware packages as a malware component.
It may be downloaded by other malware/grayware/spyware from remote sites.
Backdoor Routine
This worm executes the following commands from a remote malicious user:
- Adds/Modifies entries to the HOSTS file
- Restarts a host machine
- Replaces HTTPs
- Sends email messages
- Downloads and executes files
- Monitors visited sites
- Logs keystrokes
- Sends messages to MSN containing a link pointing to its copy
- Updates its Twitter RSS feed on the link, http://{BLOCKED}r.com/statuses/user_timeline/118177052.rss with these actions
It connects to the following URL(s) to send and receive commands from a remote malicious user:
- http://{BLOCKED}.{BLOCKED}.133.57/~duskrow/Twitter/
Web Browser Home Page and Search Page Modification
This worm modifies the user's Internet Explorer home page to the following websites:
- http://www.google.com
It modifies the user's Internet Explorer search engine into the following websites:
- http://www.google.com
NOTES:
It requires other components to effectively perform its malicious routines.
SOLUTION
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Scan your computer with your Trend Micro product to delete files detected as WORM_TWITBOT.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.