Internet threat level: 1
Home→Descriptions→Trojan.Win32.Qhost.br
Trojan.Win32.Qhost.br
| Detected | May 17 2005 10:48 GMT |
| Released | May 17 2005 10:48 GMT |
| Published | Nov 02 2005 13:27 GMT |
Technical Details
This Trojan is a Windows PE EXE file approximately 2KB in size, packed using FSG. The unpacked file is approximately 24KB in size.
When starting, the Trojan modifies the %System%\drivers\etc\hosts file which is used to transform domain names into IP addresses.
The worm adds the following text to the hosts file; this will prevent the user of the victim machine from accessing these sites.
127.0.0.1 e-finder.cc 127.0.0.1 fast-look.com 127.0.0.1 bin.wordsx.cc 127.0.0.1 s13.tempx.cc 127.0.0.1 vv7.al.57e.net 127.0.0.1 ewizard.cc 127.0.0.1 awmdabest.com 127.0.0.1 20x2p.com 127.0.0.1 rf104.com 127.0.0.1 75tz.com 127.0.0.1 v-224.com 127.0.0.1 rf104.com 127.0.0.1 ga31.com 127.0.0.1 crl.thawte.com 127.0.0.1 t34rulit.com 127.0.0.1 win-eto.com 127.0.0.1 super-spider.com 127.0.0.1 letgohome.com 127.0.0.1 cc20foreva.com 127.0.0.1 solongas.com 127.0.0.1 tracking.allposters.com 127.0.0.1 vparivalka.com 127.0.0.1 greg-tut.com 127.0.0.1 toprefsys.com 127.0.0.1 free-spy-cam.net 127.0.0.1 terra.hcworld.com 127.0.0.1 visitfriend.net 127.0.0.1 tracktraff.cc 127.0.0.1 love-catalog.net 127.0.0.1 trackhits.cc 127.0.0.1 u47.cc 127.0.0.1 u48.cc 127.0.0.1 u45.cx 127.0.0.1 u46.cx 127.0.0.1 www.6o9.com 127.0.0.1 new.8ad.com 127.0.0.1 veryeasysearch.com 127.0.0.1 msnprotection.com 127.0.0.1 adulthell.com 127.0.0.1 datingforlove.org 127.0.0.1 meetyourfriend.biz
This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.
This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.
Trojan.
- Trojan:
QHosts. gen (McAfee) - Mal/Generic-A (Sophos)
- Heuristic.
WinPE-Statistical (Panda) - W32/TrojanX.
PYQ (FPROT) - Trojan:
Win32/Comame (MS(OneCare)) - Trojan.
Qhost. 45057 (DrWeb) - Win32/Qhosts.
BR trojan (Nod32) - Trojan.
Generic. 214788 (BitDef7) - Trojan.
Agent. CMGR (VirusBuster) - Win32:
QHost-H [Trj] (AVAST) - Trojan.
Win32. Qhost. BR (Ikarus) - Generic.
JK (AVG) - TR/Crypt.
XPACK. Gen (AVIRA) - Trojan.
Qhosts (NAV) - W32/Qhost.
HJ (Norman) - QHosts.
gen (NAI) - Trojan.
Qhost (Rising) - Trojan.
Win32. Qhost. br [AVP] (FSecure) - Trojan.
Win32. Generic!BT (Sunbelt) - Trojan.
Agent. CMGR (VirusBusterBeta)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.