Trojan.Win32.Qhost

Detect Date 09/27/2009
Class Trojan
Platform Win32
Description
  1. Modify the %System%driversetchosts file using any standard application (e.g. Notepad). Delete the strings added by the Trojan. The original hosts file has the following contents:

    # Copyright (c) 1993-1999 Microsoft Corp.

    #

    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

    #

    # This file contains the mappings of IP addresses to host names. Each

    # entry should be kept on an individual line. The IP address should

    # be placed in the first column followed by the corresponding host name.

    # The IP address and the host name should be separated by at least one

    # space.

    #

    # Additionally, comments (such as these) may be inserted on individual

    # lines or following the machine name denoted by a ‘#’ symbol.

    #

    # For example:

    #

    #      102.54.94.97     rhino.acme.com          # source server

    #       38.25.63.10     x.acme.com           # x client host

    127.0.0.1       localhost

  2. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).