Tuvaro Toolbar

Tuvaro Toolbar Description

Tuvaro is free browser add-on, which is pushed via other free program downloads. When installed on a targeted computer, Tuvaro will add the Tuvaro Toolbar, alter the default homepage and search engine of the hijacked Internet browser with tuvaro.com. The Tuvaro Search Bar will show advertisements and sponsored links in hijacked search results, and may gather search terms from search queries of a victimized web user. Tuvaro Toolbar enters the corrupted PC after the computer user has installed another free application or add-on that had packed into their installer Tuvaro Toolbar. For instance, when the Internet user installs vPlay, he/she will also agree to alter the default homepage and search engine with tuvaro.com, and install the Tuvaro Toolbar. However, when the computer user uninstalls vPlay from the PC, the Internet browser's default settings will not be restored. This means that the web user will have to uninstall Tuvaro Search from the favorite Internet browser manually.

Technical Information

File System Details

Tuvaro Toolbar creates the following file(s):
# File Name Size MD5
1 tuvaro_1.8.16.19.exe 2,530,872 df6b943df9c64b7353bb900556930ad7

Registry Details

Tuvaro Toolbar creates the following registry entry or registry entries:
CLSID
{033998B0-0745-472D-8F2B-EB55EBA42F58}
{09C554C3-109B-483C-A06B-F14172F1A947}
{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}
{23D1685B-A018-430F-B3AB-F517B471569E}
{240A6AD4-4868-4513-A8DD-3ABF47E1F146}
{2768469C-717B-401F-8532-C6D88BAE0339}
{2792F312-417E-4517-A824-7F55A2F18BE5}
{2A3FF0D3-4417-492B-8929-11AB24EA0A90}
{33278AD4-8305-49E1-A58B-E5A9057BFDC3}
{427F9EE7-35CB-4EC6-ACCA-122AE77C68B8}
{4C694E60-4549-466D-83FB-C4C162FB53E2}
{4CBF0FC8-4222-435B-9E57-0DE807350D39}
{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
{4F3868C3-C08B-490E-93AD-834413F7FD22}
{5CB02877-EFBC-4317-B608-9E24B11BAB40}
{6BE4B879-4E7D-4AE8-A356-DCBD7029612E}
{6F001652-AF51-45C6-B029-86E0265A1851}
{78888F8B-D5E4-43CE-89F5-C8C18223AF64}
{7F4EFF06-7032-458e-AE16-1C1D8255C28A}
{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}
{9E393F82-2644-4AB6-B994-1AD39D6C59EE}
{A02005FA-FFF4-4099-9D14-E097378574C4}
{A88A4515-66BC-413B-9526-3FF53B5F21C8}
{A9379648-F6EB-4F65-A624-1C10411A15D0}
{B12E99ED-69BD-437C-86BE-C862B9E5444D}
{B98D2F59-0329-4A5A-B112-B989B4D4BACA}
{C6712CEF-79A8-440E-A7AC-4EF00C856922}
{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
{DD973375-0904-4886-8F63-6FC3A2BE6544}
{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
{F77B6A63-1EC9-45FB-A7AB-F9930CBBAD32}
Registry key
SOFTWARE\Classes\esrv.tuvaroESrvc
SOFTWARE\Classes\esrv.tuvaroESrvc.1
SOFTWARE\Classes\tuvaro.tuvaroappCore
SOFTWARE\Classes\tuvaro.tuvaroappCore.1
SOFTWARE\Classes\tuvaro.tuvarodskBnd
SOFTWARE\Classes\tuvaro.tuvarodskBnd.1
SOFTWARE\Classes\tuvaro.tuvaroHlpr
SOFTWARE\Classes\tuvaro.tuvaroHlpr.1
Software\Microsoft\Internet Explorer\Approved Extensions\{5CB02877-EFBC-4317-B608-9E24B11BAB40}
Software\Microsoft\Internet Explorer\Approved Extensions\{6F001652-AF51-45C6-B029-86E0265A1851}
Software\Microsoft\Internet Explorer\DOMStorage\www-search.net
Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5CB02877-EFBC-4317-B608-9E24B11BAB40}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6F001652-AF51-45C6-B029-86E0265A1851}
Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5CB02877-EFBC-4317-B608-9E24B11BAB40}
Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F001652-AF51-45C6-B029-86E0265A1851}
Software\tuvaro
Software\tuvaroToolbar
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E40E840E-5A15-4A29-9C51-9A060EEB192B}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{6F001652-AF51-45C6-B029-86E0265A1851}
SOFTWARE\Wow6432Node\Microsoft\Tracing\tuvaro_482013_RASAPI32
SOFTWARE\Wow6432Node\Microsoft\Tracing\tuvaro_482013_RASMANCS
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5CB02877-EFBC-4317-B608-9E24B11BAB40}
SOFTWARE\Wow6432Node\tuvaro
Uninstaller
tuvaro
Directory
%APPDATA%\tuvaro
%PROGRAMFILES%\tuvaro
%PROGRAMFILES(x86)%\tuvaro
%TEMP%\mt_ffx\tuvaro
%USERPROFILE%\AppData\LocalLow\tuvaro

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

One Comment

  • rollyn edquist:

    somehow tuvaro.com got inside my computer Thursday - says it is easy to uninstall but is not - was inhabiting IF and Firefox and Chrome - out of IE but still in the other two - by the look of programs is gone but it isn't - extremely frustrating - to have it in hiding - attempts to remove it have all failed

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.


HTML is not allowed.