Internet threat level: 1
Follow us on
Home→Descriptions→Trojan.Win32.Qhost.gu
Trojan.Win32.Qhost.gu
| Detected | May 23 2006 15:47 GMT |
| Released | May 23 2006 15:47 GMT |
| Published | May 29 2006 12:00 GMT |
Technical Details
This Trojan is a modified Windows %System%\drivers\etc\hosts file which is used to translate DNS entries to IP addresses. The modified file is 6666 bytes in size and it is modified in such a way so as to prevent the user of the victim machine from viewing the sites listed below:
The following strings are added to the hosts file:
127.0.0.1 ad.doubleclick.net 127.0.0.1 ad.fastclick.net 127.0.0.1 ads.fastclick.net 127.0.0.1 ar.atwola.com 127.0.0.1 atdmt.com 127.0.0.1 avp.ch 127.0.0.1 avp.com 127.0.0.1 avp.com 127.0.0.1 avp.ru 127.0.0.1 awaps.net 127.0.0.1 banner.fastclick.net 127.0.0.1 banners.fastclick.net 127.0.0.1 ca.com 127.0.0.1 click.atdmt.com 127.0.0.1 clicks.atdmt.com 127.0.0.1 customer.symantec.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 download.mcafee.com 127.0.0.1 download.microsoft.com 127.0.0.1 downloads.microsoft.com 127.0.0.1 downloads1.kaspersky-labs.com 127.0.0.1 downloads1.kaspersky-labs.com 127.0.0.1 downloads1.kaspersky-labs.com 127.0.0.1 downloads2.kaspersky-labs.com 127.0.0.1 downloads3.kaspersky-labs.com 127.0.0.1 downloads4.kaspersky-labs.com 127.0.0.1 downloads-us1.kaspersky-labs.com 127.0.0.1 downloads-us2.kaspersky-labs.com 127.0.0.1 downloads-us3.kaspersky-labs.com 127.0.0.1 engine.awaps.net 127.0.0.1 fastclick.net 127.0.0.1 f-secure.com 127.0.0.1 ftp.avp.ch 127.0.0.1 ftp.downloads2.kaspersky-labs.com 127.0.0.1 ftp.f-secure.com 127.0.0.1 ftp.kasperskylab.ru 127.0.0.1 ftp.sophos.com 127.0.0.1 go.microsoft.com 127.0.0.1 ids.kaspersky-labs.com 127.0.0.1 kaspersky.com 127.0.0.1 kaspersky-labs.com 127.0.0.1 liveupdate.symantec.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 mast.mcafee.com 127.0.0.1 mcafee.com 127.0.0.1 media.fastclick.net 127.0.0.1 msdn.microsoft.com 127.0.0.1 my-etrust.com 127.0.0.1 nai.com 127.0.0.1 networkassociates.com 127.0.0.1 office.microsoft.com 127.0.0.1 phx.corporate-ir.net 127.0.0.1 rads.mcafee.com 127.0.0.1 secure.nai.com 127.0.0.1 secure.nai.com 127.0.0.1 securityresponse.symantec.com 127.0.0.1 service1.symantec.com 127.0.0.1 sophos.com 127.0.0.1 spd.atdmt.com 127.0.0.1 support.microsoft.com 127.0.0.1 symantec.com 127.0.0.1 trendmicro.com 127.0.0.1 update.symantec.com 127.0.0.1 updates.symantec.com 127.0.0.1 updates1.kaspersky-labs.com 127.0.0.1 updates1.kaspersky-labs.com 127.0.0.1 updates2.kaspersky-labs.com 127.0.0.1 updates3.kaspersky-labs.com 127.0.0.1 updates3.kaspersky-labs.com 127.0.0.1 updates4.kaspersky-labs.com 127.0.0.1 updates5.kaspersky-labs.com 127.0.0.1 us.mcafee.com 127.0.0.1 vil.nai.com 127.0.0.1 viruslist.com 127.0.0.1 viruslist.ru 127.0.0.1 windowsupdate.microsoft.com 127.0.0.1 www.avp.ch 127.0.0.1 www.avp.com 127.0.0.1 www.avp.com 127.0.0.1 www.avp.ru 127.0.0.1 www.awaps.net 127.0.0.1 www.fastclick.net 127.0.0.1 www.f-secure.com 127.0.0.1 www.grisoft.com 127.0.0.1 www.kaspersky.com 127.0.0.1 www.kaspersky.ru 127.0.0.1 www.kaspersky-labs.com 127.0.0.1 www.mcafee.com 127.0.0.1 www.my-etrust.com 127.0.0.1 www.nai.com 127.0.0.1 www.networkassociates.com 127.0.0.1 www.sophos.com 127.0.0.1 www.symantec.com 127.0.0.1 www.trendmicro.com 127.0.0.1 www.viruslist.com 127.0.0.1 www.viruslist.ru 127.0.0.1 ad.doubleclick.net 127.0.0.1 ad.fastclick.net 127.0.0.1 ads.fastclick.net 127.0.0.1 ar.atwola.com 127.0.0.1 atdmt.com 127.0.0.1 avp.ch 127.0.0.1 avp.com 127.0.0.1 avp.com 127.0.0.1 avp.ru 127.0.0.1 awaps.net 127.0.0.1 banner.fastclick.net 127.0.0.1 banners.fastclick.net 127.0.0.1 ca.com 127.0.0.1 click.atdmt.com 127.0.0.1 clicks.atdmt.com 127.0.0.1 customer.symantec.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 download.mcafee.com 127.0.0.1 download.microsoft.com 127.0.0.1 downloads.microsoft.com 127.0.0.1 downloads1.kaspersky-labs.com 127.0.0.1 downloads1.kaspersky-labs.com 127.0.0.1 downloads1.kaspersky-labs.com 127.0.0.1 downloads2.kaspersky-labs.com 127.0.0.1 downloads3.kaspersky-labs.com 127.0.0.1 downloads4.kaspersky-labs.com 127.0.0.1 downloads-us1.kaspersky-labs.com 127.0.0.1 downloads-us2.kaspersky-labs.com 127.0.0.1 downloads-us3.kaspersky-labs.com 127.0.0.1 engine.awaps.net 127.0.0.1 fastclick.net 127.0.0.1 f-secure.com 127.0.0.1 ftp.avp.ch 127.0.0.1 ftp.downloads2.kaspersky-labs.com 127.0.0.1 ftp.f-secure.com 127.0.0.1 ftp.kasperskylab.ru 127.0.0.1 ftp.sophos.com 127.0.0.1 go.microsoft.com 127.0.0.1 ids.kaspersky-labs.com 127.0.0.1 kaspersky.com 127.0.0.1 kaspersky-labs.com 127.0.0.1 liveupdate.symantec.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 mast.mcafee.com 127.0.0.1 mcafee.com 127.0.0.1 media.fastclick.net 127.0.0.1 msdn.microsoft.com 127.0.0.1 my-etrust.com 127.0.0.1 nai.com 127.0.0.1 networkassociates.com 127.0.0.1 office.microsoft.com 127.0.0.1 phx.corporate-ir.net 127.0.0.1 rads.mcafee.com 127.0.0.1 secure.nai.com 127.0.0.1 secure.nai.com 127.0.0.1 securityresponse.symantec.com 127.0.0.1 service1.symantec.com 127.0.0.1 sophos.com 127.0.0.1 spd.atdmt.com 127.0.0.1 support.microsoft.com 127.0.0.1 symantec.com 127.0.0.1 trendmicro.com 127.0.0.1 update.symantec.com 127.0.0.1 updates.symantec.com 127.0.0.1 updates1.kaspersky-labs.com 127.0.0.1 updates1.kaspersky-labs.com 127.0.0.1 updates2.kaspersky-labs.com 127.0.0.1 updates3.kaspersky-labs.com 127.0.0.1 updates3.kaspersky-labs.com 127.0.0.1 updates4.kaspersky-labs.com 127.0.0.1 updates5.kaspersky-labs.com 127.0.0.1 us.mcafee.com 127.0.0.1 vil.nai.com 127.0.0.1 viruslist.com 127.0.0.1 viruslist.ru 127.0.0.1 windowsupdate.microsoft.com 127.0.0.1 www.avp.ch 127.0.0.1 www.avp.com 127.0.0.1 www.avp.com 127.0.0.1 www.avp.ru 127.0.0.1 www.awaps.net 127.0.0.1 www.fastclick.net 127.0.0.1 www.f-secure.com 127.0.0.1 www.grisoft.com 127.0.0.1 www.kaspersky.com 127.0.0.1 www.kaspersky.ru 127.0.0.1 www.kaspersky-labs.com 127.0.0.1 www.mcafee.com 127.0.0.1 www.my-etrust.com 127.0.0.1 www.nai.com 127.0.0.1 www.networkassociates.com 127.0.0.1 www.sophos.com 127.0.0.1 www.symantec.com 127.0.0.1 www.trendmicro.com 127.0.0.1 www.viruslist.com 127.0.0.1 www.viruslist.ru 127.0.0.1 www3.ca.com
This blocks all requests from the victim machine to the servers listed above.
The modified hosts file which is detected as Trojan.Win32.Qhost.gu is the result of another Trojan modifying the file.
Trojan
This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.
This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.
Other versions
Aliases
Trojan.
- Trj/Qhost.
gen (Panda) - HOST_trojan (FPROT)
- Win32/Qhosts trojan (Nod32)
- Generic.
Qhost. 2538473D (BitDef7) - Trojan.
QHosts. AA (VirusBuster) - BV:
Qhost-F [Trj] (AVAST) - Trojan.
Win32. Qhost (Ikarus) - TR/Qhost.
GU (AVIRA) - Trojan.
SpamThru (NAV) - Qhosts.
apd (NAI) - TROJ_Generic (PCCIL)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.