QHosts-47!hosts

This page shows details and results of our analysis on the malware QHosts-47!hosts

Download Current DAT: 6616

Threat Detail

Malware Type: Trojan

Malware Sub-type:

Discovery Date: 2005-10-18

Next Steps:

Overview
Characteristics
Symptoms
Method of Infection
Removal

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Minimum DAT

4607 (2005-10-18)

Updated DAT

4687 (2006-02-01)

Minimum Engine

5.1.00

File Length

varies

Description Added

2005-10-18

Description Modified

2005-10-21

Malware Proliferation

Characteristics

QHosts-47!hosts detects modifications made to the system hosts file. At the time of this writing the modification consisted of entries redirecting various banking related domains to 211.136.108.76. A list of the redirected domains follows:

nwolb.com
hsbc.co.uk
www.hsbc.co.uk
abbey.com
www.abbey.com
www.abbey.co.uk
abbey.co.uk
cahoot.com
www.cahoot.com
www.cahoot.co.uk
cahoot.co.uk
www.co-operativebank.co.uk
co-operativebank.co.uk
www.co-operativebank.com
co-operativebank.com
welcome2.co-operativebankonline.co.uk
welcome6.co-operativebankonline.co.uk
welcome8.co-operativebankonline.co.uk
welcome10.co-operativebankonline.co.uk
www.smile.co.uk
smile.co.uk
www.cajamar.es
cajamar.es
www.cajamar.com
www.unicaja.es
unicaja.es
www.unicaja.com
unicaja.com
www.caixagalicia.es
caixagalicia.es
www.caixagalicia.com
caixagalicia.com
activa.caixagalicia.es
www.caixapenedes.es
caixapenedes.es
www.caixapenedes.com
caixapenedes.com
bancae.caixapenedes.com
www.caixasabadell.es
caixasabadell.es
www.caixasabadell.net
caixasabadell.net
www.cajamadrid.es
cajamadrid.es
www.cajamadrid.com
cajamadrid.com
oi.cajamadrid.es
www.ccm.es
ccm.es
www.haspa.de
haspa.de
ssl2.haspa.de
www.dresdner-bank.de
dresdner-bank.de
www.dresdner-privat.de
postbank.de
www.postbank.de
banking.postbank.de
www.sparda-b.de
sparda-b.de
www.bankingonline.de
www.raiffeisenbank-erding.de
raiffeisenbank-erding.de
www.vr-networld-ebanking.de
vr-networld-ebanking.de
www.bnhof.de
bnhof.de
www.deutsche-bank.de
deutsche-bank.de
meine.deutsche-bank.de
www.citibank.de
citibank.de
cipehb13.cdg.citibank.de
www.dkb.de
dkb.de
www.sparkasse-regensburg.de
sparkasse-regensburg.de
www.berliner-bank.de
berliner-bank.de
www.berliner-sparkasse.de
berliner-sparkasse.de

Symptoms

Redirected web pages

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.

Qhosts trojan are often installed by dropper trojans.

Removal

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.

Additional Windows ME/XP removal considerations