Trojan:W32/Qhost

Classification

Malware

Trojan

W32

Trojan.Win32.Qhost

Summary

This is network worm with backdoor capabilities, which spreads itself under Win32 systems. The worm was reported in-the-wild in July-August, 2000. The worm itself is Win32 executable file and about 120K long, written in MS Visual C++.

Removal

F-Secure renames the malware-modified HOSTS file to HOSTS.0. Windows then creates a new file that restores website access. The renamed file can then be deleted.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Some malicious applications will modify the Windows HOSTS file in an attempt to block access to antivirus vendor web and update servers. As a result, the websites of several antivirus vendors may become inaccessible and some antivirus programs may stop receiving updates. The Windows HOSTS file typically contains information only about the localhost. Some malware variants add more entries to the HOSTS file, attempting to block access to antivirus websites and update servers.

Example

A normal HOSTS file will appear as follows:

# Copyright (c) 1993-1999 Microsoft Corp.

# # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# # This file contains the mappings of IP addresses to host names.

Each # entry should be kept on an individual line. 
The IP address should
# be placed in the first column followed by the corresponding host name. 
# The IP address and the host name should be separated by at least one # space.

# # Additionally, comments (such as these) may be inserted on individual
 
# lines or following the machine name denoted by a '#' symbol.

# # For example:

# # 102.54.94.97 rhino.acme.com

# source server

# 38.25.63.10 x.acme.com

# x client host
127.0.0.1 localhost

The typical file path is:

  • C:\%windir%\system32\drivers\etc\hosts

A malware-modified version of the HOSTS file will contain additional entries:

  • 127.0.0.1 avp.com
  • 127.0.0.1 ca.com
  • 127.0.0.1 customer.symantec.com
  • 127.0.0.1 dispatch.mcafee.com
  • 127.0.0.1 download.mcafee.com
  • 127.0.0.1 f-secure.com
  • 127.0.0.1 kaspersky.com
  • 127.0.0.1 liveupdate.symantec.com
  • 127.0.0.1 liveupdate.symantecliveupdate.com
  • 127.0.0.1 localhost
  • 127.0.0.1 mast.mcafee.com
  • 127.0.0.1 mcafee.com
  • 127.0.0.1 my-etrust.com
  • 127.0.0.1 nai.com
  • 127.0.0.1 networkassociates.com
  • 127.0.0.1 rads.mcafee.com
  • 127.0.0.1 secure.nai.com
  • 127.0.0.1 securityresponse.symantec.com
  • 127.0.0.1 sophos.com
  • 127.0.0.1 symantec.com
  • 127.0.0.1 trendmicro.com
  • 127.0.0.1 update.symantec.com
  • 127.0.0.1 updates.symantec.com
  • 127.0.0.1 us.mcafee.com
  • 127.0.0.1 viruslist.com
  • 127.0.0.1 viruslist.com
  • 127.0.0.1 www.avp.com
  • 127.0.0.1 www.ca.com
  • 127.0.0.1 www.f-secure.com
  • 127.0.0.1 www.kaspersky.com
  • 127.0.0.1 www.mcafee.com
  • 127.0.0.1 www.my-etrust.com
  • 127.0.0.1 www.nai.com
  • 127.0.0.1 www.networkassociates.com
  • 127.0.0.1 www.sophos.com
  • 127.0.0.1 www.symantec.com
  • 127.0.0.1 www.trendmicro.com
  • 127.0.0.1 www.viruslist.com

Websites or servers configured to an IP Address of 127.0.0.1 will loop back to the local machine, making them unreachable.