Win32/Qhost [Threat Name] go to Threat
Win32/Qhost.LFS [Threat Variant Name]
| Category | trojan |
| Size | 11572 B |
| Aliases | Trojan.Win32.Qhost.lfs (Kaspersky) |
| Trojan:Win32/Comame (Microsoft) | |
| Infostealer.Gampass (Symantec) |
Short description
Win32/Qhost.LFS is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses. The file is run-time compressed using WINUPACK .
Installation
The trojan does not create any copies of itself.
Other information
Win32/Qhost.LFS is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses.
The trojan contains an URL address. It tries to download a file from the address.
The file is stored in the following location:
- %system%\drivers\etc\hosts
The HTTP protocol is used.
The trojan then removes itself from the computer.