Win32/Qhost [Threat Name] go to Threat

Win32/Qhost.NQU [Threat Variant Name]

Category trojan
Size 90112 B
Detection created Dec 09, 2009
Detection database version 4673
Aliases Trojan.Win32.VkHost.jc (Kaspersky)
  Trojan.Hosts.259 (Dr.Web)
  PWS-Banker.gen.ec (McAfee)
Short description

Win32/Qhost.NQU is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses.

Installation

The trojan does not create any copies of itself.

Other information

Win32/Qhost.NQU is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses.


The trojan modifies the following file:

  • %system%\­drivers\­etc\­hosts

The trojan writes the following entries to the file:

  • # Copyright (c) 1985-2009 Microsoft Corp.
  • # This file was created by AutoDesk AntiSpam System
  • # your system hash is e98dfhusdiudsfjkgasdf3
  • # Warning! Do not edit this file! It may be way to crash system!
  • 210.51.166.234 vkontakte.ru
  • 210.51.166.234 www.vkontakte.ru
  • 210.51.166.234 vkontakte.com
  • 210.51.166.234 www.vkontakte.com
  • 210.51.166.234 vk.com
  • 210.51.166.234 www.vk.com

Please enable Javascript to ensure correct displaying of this content and refresh this page.