• Home
• >Threat Encyclopaedia
• >Descriptions
• > Win32/Qhost.PDQ

Short description

Win32/Qhost.PDQ is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses. It uses techniques common for rootkits.

Installation

When executed, the trojan creates the following files:

The trojan registers itself as a system service using the following name:

The following Registry entries are created:

This way the trojan ensures that the file is executed on every system start.

Other information

Win32/Qhost.PDQ is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses.

The trojan may create the following files:

The trojan may set the following Registry entries:

The trojan may perform operating system restart.

The trojan hooks the following Windows APIs:

The trojan hides files which contain one of the following strings in their name:

The trojan hides processes which contain one of the following strings in their name:

The trojan hides Registry entries which contain one of the following strings in their name:

Trojan blocks the opening of files with the following extensions:

The trojan can modify the following file:

The trojan writes the following entries to the file:

• Contact |
• Privacy |
• Legal Information |
• Sitemap