Trojan:Win32/QHost Removal Guide

Trojan:Win32/QHost is a Trojan that enters your system surreptitiously and reconfigures your browser to redirect you to a list of predetermined websites. Also, this Trojan is known to download other malware onto your computer, thus putting you into a risk of a serious malware infection. In order to redirect you to malicious websites Trojan:Win32/QHost needs to modify your hosts file. This is one of things that do not get restored when you remove Trojan:Win32/QHost from your PC. If you want to know how to recreate your hosts file scroll to the bottom of the article to find instructions on how to restore the hosts file to default.

As far as Trojan:Win32/QHost is concerned, the Trojan is commonly downloaded on your PC by other infections. It means that if you have Trojan:Win32/QHost in your system, it is highly probable, that there are other dangerous infections as well. The installation file for this Trojan can be delivered via social-engineering messages on social networking websites, via spam email message or even via P2P sharing, especially if you have downloaded something from unreliable gaming website. The P2P file for Trojan:Win32/QHost can even be called Naruto_Shippuuden.rar, so beware.

During the installation, Trojan:Win32/QHost installs 4 files into one folder that is left in ProgramFiles directory. The four files are: a batch file (BAT), a text file (TXT), a visual basic script file (VBS), and a second VBS file. The batch file is used to alter your hosts file, while the text file contains information necessary for the Trojan when it tries to connect to a remote server behind your back in order to download configuration data. The name of the folder and the files in general may differ in every infected computer.

Once the Trojan is installed, it redirects you to any of the following websites:

• m.ok.ru
• ok.ru
• vk.com
• m.odnaklassniki.ru
• www.odnaklassniki.ru
• my.mail.ru

It can also forcefully redirect traffic to a list of servers that collect data on web browsing. These servers are:

• 108.170.38.201
• 192.157.49.4
• 75.102.8.33
• 96.45.190.45
• 173.44.34.125

And so on. Aside from redirecting traffic to suspicious servers, Trojan:Win32/QHost can also connect to such remote hosts as 199.241.191.138:1335 and 94.248.188.143:9007 in order to download other files onto your computer.

You have to acquire a powerful antimalware tool to remove Trojan:Win32/QHost from your PC as soon as possible. This Trojan poses great security risks and you cannot wait until your personal information gets stolen or your system crashes. Remove Trojan:Win32/QHost automatically and safeguard your system against similar threats.

It has been mentioned in the first paragraph that you need to restore your hosts file after Trojan:Win32/QHost gets removed yourself. Follow the instructions below to do it:

How to restore hosts file back to default

1. Double-click My Computer and open Local Disk.
2. Go to Windows and open System32.
3. Go to drivers and open etc folder.
4. Open hosts file with Notepad.
5. For Windows XP, and the end of the file there should be only one line: 127.0.0.1 localhost. For Windows Vista, Windows 7 and Windows 8, there should be two lines: 127.0.0.1 localhost and ::11 localhost.
6. If you see anything below those lines, delete it and save changes.