Trojan.Win32.Qhost.mxb

Detected	Mar 31 2010 14:45 GMT
Released	Mar 31 2010 19:49 GMT
Published	Mar 24 2011 14:54 GMT

Manual description Auto description

This description was created by experts at Kaspersky Lab. It contains the most accurate information available about this program.

Technical Details
Payload
Removal instructions

Technical Details

This Trojan delivers a malicious payload to the user's computer. It is a Windows application (PE EXE file). It is 2650 bytes in size. It is written in C++.

Payload

The Trojan creates a copy of the original "hosts" file under the following name:

C:\h.tmp

The Trojan writes the following string in the file created:

85.***.206.115 u070***010u.com

It replaces the original "hosts" file with the "h.tmp" file:

%System%\drivers\etc\hosts

The Trojan also creates the file:

C:\1.bat

by means of which both the original Trojan file and the created file "1.bat" are deleted. The Trojan then ceases running.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
Restore the original content of the file: %System%\drivers\etc\hosts which by default has the following structure:
Delete the following files:
```
C:\h.tmp
C:\1.bat
```
Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: 9E68E7C20BD226E5BEA24AAECE6B8125
SHA1: 916612EEC053D8BF99B8148D6909234E8F2139A5

Print

Share

Malicious programs

Trojans

Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.

Other versions

Trojan.Win32.Qhost.b

Trojan.Win32.Qhost.br

Trojan.Win32.Qhost.e

Trojan.Win32.Qhost.fe

Trojan.Win32.Qhost.gg

Trojan.Win32.Qhost.gl

Trojan.Win32.Qhost.gu

Trojan.Win32.Qhost.hc

Trojan.Win32.Qhost.hl

Trojan.Win32.Qhost.hx

Trojan.Win32.Qhost.ii