Content
QHosts-47!hosts
- Type
- Trojan
- SubType
- Discovery Date
- 10/18/2005
- Length
- varies
- Minimum DAT
- 4607 (10/18/2005)
- Updated DAT
- 4687 (02/01/2006)
- Minimum Engine
- 5.1.00
- Description Added
- 10/18/2005
- Description Modified
- 10/21/2005 12:16 AM (PT)
Tab Navigation
Characteristics
QHosts-47!hosts detects modifications made to the system hosts file. At the time of this writing the modification consisted of entries redirecting various banking related domains to 211.136.108.76. A list of the redirected domains follows:
- nwolb.com
- hsbc.co.uk
- www.hsbc.co.uk
- abbey.com
- www.abbey.com
- www.abbey.co.uk
- abbey.co.uk
- cahoot.com
- www.cahoot.com
- www.cahoot.co.uk
- cahoot.co.uk
- www.co-operativebank.co.uk
- co-operativebank.co.uk
- www.co-operativebank.com
- co-operativebank.com
- welcome2.co-operativebankonline.co.uk
- welcome6.co-operativebankonline.co.uk
- welcome8.co-operativebankonline.co.uk
- welcome10.co-operativebankonline.co.uk
- www.smile.co.uk
- smile.co.uk
- www.cajamar.es
- cajamar.es
- www.cajamar.com
- www.unicaja.es
- unicaja.es
- www.unicaja.com
- unicaja.com
- www.caixagalicia.es
- caixagalicia.es
- www.caixagalicia.com
- caixagalicia.com
- activa.caixagalicia.es
- www.caixapenedes.es
- caixapenedes.es
- www.caixapenedes.com
- caixapenedes.com
- bancae.caixapenedes.com
- www.caixasabadell.es
- caixasabadell.es
- www.caixasabadell.net
- caixasabadell.net
- www.cajamadrid.es
- cajamadrid.es
- www.cajamadrid.com
- cajamadrid.com
- oi.cajamadrid.es
- www.ccm.es
- ccm.es
- www.haspa.de
- haspa.de
- ssl2.haspa.de
- www.dresdner-bank.de
- dresdner-bank.de
- www.dresdner-privat.de
- postbank.de
- www.postbank.de
- banking.postbank.de
- www.sparda-b.de
- sparda-b.de
- www.bankingonline.de
- www.raiffeisenbank-erding.de
- raiffeisenbank-erding.de
- www.vr-networld-ebanking.de
- vr-networld-ebanking.de
- www.bnhof.de
- bnhof.de
- www.deutsche-bank.de
- deutsche-bank.de
- meine.deutsche-bank.de
- www.citibank.de
- citibank.de
- cipehb13.cdg.citibank.de
- www.dkb.de
- dkb.de
- www.sparkasse-regensburg.de
- sparkasse-regensburg.de
- www.berliner-bank.de
- berliner-bank.de
- www.berliner-sparkasse.de
- berliner-sparkasse.de
Symptoms
Redirected web pages
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.
Qhosts trojan are often installed by dropper trojans.
Removal
All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.
Variants
Variants
N/A
All Information
Overview -
This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
Characteristics
Characteristics -
QHosts-47!hosts detects modifications made to the system hosts file. At the time of this writing the modification consisted of entries redirecting various banking related domains to 211.136.108.76. A list of the redirected domains follows:
- nwolb.com
- hsbc.co.uk
- www.hsbc.co.uk
- abbey.com
- www.abbey.com
- www.abbey.co.uk
- abbey.co.uk
- cahoot.com
- www.cahoot.com
- www.cahoot.co.uk
- cahoot.co.uk
- www.co-operativebank.co.uk
- co-operativebank.co.uk
- www.co-operativebank.com
- co-operativebank.com
- welcome2.co-operativebankonline.co.uk
- welcome6.co-operativebankonline.co.uk
- welcome8.co-operativebankonline.co.uk
- welcome10.co-operativebankonline.co.uk
- www.smile.co.uk
- smile.co.uk
- www.cajamar.es
- cajamar.es
- www.cajamar.com
- www.unicaja.es
- unicaja.es
- www.unicaja.com
- unicaja.com
- www.caixagalicia.es
- caixagalicia.es
- www.caixagalicia.com
- caixagalicia.com
- activa.caixagalicia.es
- www.caixapenedes.es
- caixapenedes.es
- www.caixapenedes.com
- caixapenedes.com
- bancae.caixapenedes.com
- www.caixasabadell.es
- caixasabadell.es
- www.caixasabadell.net
- caixasabadell.net
- www.cajamadrid.es
- cajamadrid.es
- www.cajamadrid.com
- cajamadrid.com
- oi.cajamadrid.es
- www.ccm.es
- ccm.es
- www.haspa.de
- haspa.de
- ssl2.haspa.de
- www.dresdner-bank.de
- dresdner-bank.de
- www.dresdner-privat.de
- postbank.de
- www.postbank.de
- banking.postbank.de
- www.sparda-b.de
- sparda-b.de
- www.bankingonline.de
- www.raiffeisenbank-erding.de
- raiffeisenbank-erding.de
- www.vr-networld-ebanking.de
- vr-networld-ebanking.de
- www.bnhof.de
- bnhof.de
- www.deutsche-bank.de
- deutsche-bank.de
- meine.deutsche-bank.de
- www.citibank.de
- citibank.de
- cipehb13.cdg.citibank.de
- www.dkb.de
- dkb.de
- www.sparkasse-regensburg.de
- sparkasse-regensburg.de
- www.berliner-bank.de
- berliner-bank.de
- www.berliner-sparkasse.de
- berliner-sparkasse.de
Symptoms
Symptoms -
Redirected web pages
Method of Infection
Method of Infection -
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.
Qhosts trojan are often installed by dropper trojans.
Removal -
Removal -
All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
