Trojan.Win32.Qhost.nhn

Detected	Jun 11 2010 01:43 GMT
Released	Jun 11 2010 17:56 GMT
Published	Mar 24 2011 14:49 GMT

Technical Details
Payload
Removal instructions

Technical Details

This Trojan delivers a malicious payload to the user's computer. It is a Windows application (PE EXE file). It is 16 384 bytes in size. It is written in C++.

Payload

The Trojan overwrites the file:

C:\WINDOWS\system32\drivers\etc\hosts

with the following content:

127.0.0.1        adwor***oom.com

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
Restore the original content of the file:
```
%System%\drivers\etc\hosts
```
which by default has the following structure:
Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Print

Share

Malicious programs

Trojans

Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.

Other versions

Trojan.Win32.Qhost.b

Trojan.Win32.Qhost.br

Trojan.Win32.Qhost.e

Trojan.Win32.Qhost.fe

Trojan.Win32.Qhost.gg

Trojan.Win32.Qhost.gl

Trojan.Win32.Qhost.gu

Trojan.Win32.Qhost.hc

Trojan.Win32.Qhost.hl

Trojan.Win32.Qhost.hx

Trojan.Win32.Qhost.ii