Category: Trojan Horse
Active & Spreading
Asia, North and South America, and some parts of Europe and Australia
15 Mar 2004
The W32.Tuoba.Trojan application utilizes the exploit of Internet Explorer to add a server on the web to the internet zone and to re-route the traffic of the network to that server.
W32.Tuoba.Trojan Removal Tool
If you have Malware on your computer it will cause annoyances and will damage your system. You should either:
A. Manually remove the infected files from your computer, or
B. Automatically scan your system using trusted software
We recommend that you scan your system for malware. Our partner has a trojan horse removal tool to automatically clean W32.Tuoba.Trojan from your computer.
More details about W32.Tuoba.Trojan
When this Trojan Horse was executed, Run.exe adds the 126.96.36.199 to the Intranet local zone from the Internet Explorer using the modified values in the key of the registry. The requests will be redirected to particular Web sites using the 188.8.131.52 address. This was being done by overwriting the File of the Hosts. The lines added to the file will appear to the aimed web sites the 184.108.40.206 freshvideogals.com, 220.127.116.11 auto.ie.searchforge.com, 18.104.22.168 allneedsearch.com, 22.214.171.124 find.microgirls.com, 126.96.36.199 link.startmake.com, 188.8.131.52 best.royalsearch.net, 184.108.40.206 in.webcounter.cc, 220.127.116.11 aifind.info, 18.104.22.168 default-homepage-network.com, 22.214.171.124 www.2fastsearch.net, 126.96.36.199 www.couldnotfind.com, 188.8.131.52 tits.hardcore4ever.net, 184.108.40.206 www.alfa-search.com, 220.127.116.11 www.dreamwiz.com, 18.104.22.168 www.omega-search.com, 22.214.171.124 nativehardcore.com, etc.
When the W32.Tuoba.Trojan was installed when user visits a Web page that is malicious. The we b page utilizes exploit of the Internet Explorer so it can perform the file .php that is a CHM malicious file. The Content.php have three files which are the Index.html, Htm2chm_about, and Htm2chm_explorer. The Index.html utilizes the exploit of the Internet Explorer on downloading file, Run.exe to the Program of the Drive C and then performs it. XMLid.Exploit was the file being detected. The Htm2chm_about is not totally malicious. Htm2chm_explorer is also not a malicious. The additional lines added to the file that will appear to the web sites targeted are 126.96.36.199 aifind.cc, 188.8.131.52 awebfind.biz, 184.108.40.206 find4u.net,
220.127.116.11 itseasy.us, 18.104.22.168 searchmyrequest.com, 22.214.171.124 www.008i.com, 126.96.36.199 search.ieplugin.com, 188.8.131.52 qwertysearch123.biz, 184.108.40.206 just.find-itnow.com etc.