Win32/Qhost [Threat Name] go to Threat
Win32/Qhost.NQU [Threat Variant Name]
Category | trojan |
Size | 90112 B |
Aliases | Trojan.Win32.VkHost.jc (Kaspersky) |
Trojan.Hosts.259 (Dr.Web) | |
PWS-Banker.gen.ec (McAfee) |
Short description
Win32/Qhost.NQU is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses.
Installation
The trojan does not create any copies of itself.
Other information
Win32/Qhost.NQU is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses.
The trojan modifies the following file:
- %system%\drivers\etc\hosts
The trojan writes the following entries to the file:
- # Copyright (c) 1985-2009 Microsoft Corp.
- # This file was created by AutoDesk AntiSpam System
- # your system hash is e98dfhusdiudsfjkgasdf3
- # Warning! Do not edit this file! It may be way to crash system!
- 210.51.166.234 vkontakte.ru
- 210.51.166.234 www.vkontakte.ru
- 210.51.166.234 vkontakte.com
- 210.51.166.234 www.vkontakte.com
- 210.51.166.234 vk.com
- 210.51.166.234 www.vk.com