[Kaspersky]Trojan.Win32.Qhost.hn,Trojan.Win32.Qhost.pg,Trojan.Win32.Qhost.aei;
[Panda]Trj/Qhost.U,Trj/StartPage.BF,Trj/Conspy.B;
[Computer Associates]Win32.Qhosts.G,Win32/QHosts.AntiAdware!Trojan,Win32/QHosts!Trojan,Win32.Startpage.CB,Win32.Startpage.BV;
[Other]W32/Digarix.B!tr,VBS/QHosts,Win32/Qhosts.AB,Win32/Qhosts.AZ,Trojan:Win32/SystemHijack.gen,Sandbox W32/Malware.BLDRCategories:Trojan,Adware,BHO,Toolbar
Platforms / OS: Windows 2000, Windows XP, Windows 2003, Windows Vista
How to detecting QHosts:
Search Files on the disk:
[%DESKTOP%]\kill spyware.url
[%SYSTEM%]\nsi189.dll
[%SYSTEM%]\nsl17D.dll
[%SYSTEM%]\nsm182.dll
[%SYSTEM%]\nsn178.dll
[%SYSTEM%]\nst173.dll
[%SYSTEM%]\nst2E.dll
[%SYSTEM%]\poker112.ico
[%SYSTEM%]\poker11212.ico
[%SYSTEM%]\poker11232112.ico
[%SYSTEM%]\rtneg2.dll
[%SYSTEM%]\tb22.dll
[%WINDOWS%]\downloaded program files\winb2s32.inf
[%DESKTOP%]\download free movies.url
[%DESKTOP%]\download free mp3s.url
[%DESKTOP%]\download movies.url
[%DESKTOP%]\free sony ps3.url
[%DESKTOP%]\free xbox 360.url
[%DESKTOP%]\gambling board.url
[%DESKTOP%]\hot sexy mamma.url
[%DESKTOP%]\kill all spyware.url
[%DESKTOP%]\kill evidence.url
[%DESKTOP%]\kill spyware.url
[%DESKTOP%]\kill viruses.url
[%DESKTOP%]\popup killer.url
[%DESKTOP%]\rate me.url
[%DESKTOP%]\sexsearch.url
[%DESKTOP%]\spyware killer.url
[%DESKTOP%]\xbox 360 free.url
[%SYSTEM%]\nsu2.tmp
[%SYSTEM%]\nsz1d.dll
[%SYSTEM%]\winb2s32.dll
[%DESKTOP%]\kill spyware.url
[%SYSTEM%]\nsi189.dll
[%SYSTEM%]\nsl17D.dll
[%SYSTEM%]\nsm182.dll
[%SYSTEM%]\nsn178.dll
[%SYSTEM%]\nst173.dll
[%SYSTEM%]\nst2E.dll
[%SYSTEM%]\poker112.ico
[%SYSTEM%]\poker11212.ico
[%SYSTEM%]\poker11232112.ico
[%SYSTEM%]\rtneg2.dll
[%SYSTEM%]\tb22.dll
[%WINDOWS%]\downloaded program files\winb2s32.inf
[%DESKTOP%]\download free movies.url
[%DESKTOP%]\download free mp3s.url
[%DESKTOP%]\download movies.url
[%DESKTOP%]\free sony ps3.url
[%DESKTOP%]\free xbox 360.url
[%DESKTOP%]\gambling board.url
[%DESKTOP%]\hot sexy mamma.url
[%DESKTOP%]\kill all spyware.url
[%DESKTOP%]\kill evidence.url
[%DESKTOP%]\kill spyware.url
[%DESKTOP%]\kill viruses.url
[%DESKTOP%]\popup killer.url
[%DESKTOP%]\rate me.url
[%DESKTOP%]\sexsearch.url
[%DESKTOP%]\spyware killer.url
[%DESKTOP%]\xbox 360 free.url
[%SYSTEM%]\nsu2.tmp
[%SYSTEM%]\nsz1d.dll
[%SYSTEM%]\winb2s32.dll
Search Folders on the disk:
[%SYSTEM%]\b2s_cache
[%SYSTEM%]\cache32_trgen
[%PROFILE_TEMP%]\nsu3.tmp
Search registry keys in system registry:
HKEY_CLASSES_ROOT\clsid\{07e9cdf4-20d2-46b1-b681-663968f527ce}
HKEY_CLASSES_ROOT\fixcore.mmfixcore.1
HKEY_CLASSES_ROOT\interface\{018c5406-aee6-4a68-980f-2ceb1e9416fb}
HKEY_CLASSES_ROOT\interface\{02b577d5-2212-42f3-ad51-2f6a9ae43233}
HKEY_CLASSES_ROOT\Interface\{0A0CB91F-304B-44AD-9460-9C55465163A4}
HKEY_CLASSES_ROOT\interface\{0a7fc040-f84a-4ad7-9439-798b6c0f861e}
HKEY_CLASSES_ROOT\interface\{35ae618d-45f7-4aa7-a373-300dcb98858a}
HKEY_CLASSES_ROOT\interface\{6fe4aadf-edac-4037-9164-0b60179a4f12}
HKEY_CLASSES_ROOT\interface\{71c456dd-f55b-46ce-adcf-53d5899b8f79}
HKEY_CLASSES_ROOT\interface\{806fca2b-146f-4dc3-9ce7-3c576fea15c3}
HKEY_CLASSES_ROOT\interface\{94984402-b480-45c7-ad2d-84e5eb52cfcd}
HKEY_CLASSES_ROOT\interface\{a797a41d-f9f0-4a32-b9b5-af927cb5ae54}
HKEY_CLASSES_ROOT\interface\{b12508ad-ca55-4238-8db3-55808ba6915a}
HKEY_CLASSES_ROOT\interface\{bf7cb2c3-55b6-44c1-9615-920d004c27f7}
HKEY_CLASSES_ROOT\interface\{cb08e48a-fe7e-4f13-8593-b7ae6ec81d83}
HKEY_CLASSES_ROOT\interface\{d7a6df8d-b6cf-4c27-8e99-eca2ce370ea7}
HKEY_CLASSES_ROOT\interface\{ef90eb04-44c3-4ae5-9d01-c8def134d82a}
HKEY_CLASSES_ROOT\interface\{f912c325-5b26-4ad6-bf39-84370833e972}
HKEY_CLASSES_ROOT\typelib\{081de2f6-927b-4aa9-88c1-f531c9387383}
HKEY_CLASSES_ROOT\TypeLib\{33ADD70F-53AB-4F97-B4B6-997881820F6D}
HKEY_CLASSES_ROOT\typelib\{45782901-ba9f-422d-b231-bcb6487fac4b}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\richedtr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\richup
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:\windows\system32\winb2s32.dll
HKEY_CLASSES_ROOT\clsid\{0962da67-db64-465c-8cd7-cbb357caf825}
HKEY_CLASSES_ROOT\clsid\{09c14745-90fd-42d1-9276-4924d7dbc274}
HKEY_CLASSES_ROOT\clsid\{22b720c7-5fa6-40a8-9f8f-8584bf669690}
HKEY_CLASSES_ROOT\clsid\{356b2bd0-d206-4e21-8c85-c6f49409c6a9}
HKEY_CLASSES_ROOT\clsid\{486145b0-37d1-428b-b3e1-26d26f690c79}
HKEY_CLASSES_ROOT\clsid\{4d568f0f-8ac9-40ab-88b7-415134c78777}
HKEY_CLASSES_ROOT\clsid\{52add86d-9561-4c40-b561-4204dbc139d1}
HKEY_CLASSES_ROOT\clsid\{52fe5233-367c-4efb-bdd7-0be4d212c107}
HKEY_CLASSES_ROOT\clsid\{6024fcd5-91fc-4dc7-8481-63eabd5051d8}
HKEY_CLASSES_ROOT\clsid\{62631e26-b5a1-4ac4-a3ae-1cb72c6819c5}
HKEY_CLASSES_ROOT\clsid\{7c5e5671-7a1d-4ae8-91f0-496adf2825f7}
HKEY_CLASSES_ROOT\clsid\{8037f7f0-80b6-453a-a7cb-5371a4a09bb8}
HKEY_CLASSES_ROOT\clsid\{82f55658-ca6d-4754-b313-5dcaafa0bb42}
HKEY_CLASSES_ROOT\clsid\{999a06ff-10ef-4a29-8640-69e99882c26b}
HKEY_CLASSES_ROOT\clsid\{c8186977-4d5e-4c2b-a5ab-98d59f05c610}
HKEY_CLASSES_ROOT\clsid\{cb5b2bc6-f957-4d8a-be67-83f3ec58ba01}
HKEY_CLASSES_ROOT\clsid\{d86f8319-7c7a-4f2c-927b-6fd286dc4371}
HKEY_CLASSES_ROOT\clsid\{e4776f3a-6936-4a9c-b2da-e57c239fd2f8}
HKEY_CLASSES_ROOT\clsid\{f90b494e-39e5-497d-ae7e-72a2bdca76d3}
HKEY_CLASSES_ROOT\clsid\{ff81672f-13ff-401f-8662-6e895c564cc4}
HKEY_CLASSES_ROOT\interface\{0a0cb91f-304b-44ad-9460-9c55465163a4}
HKEY_CLASSES_ROOT\interface\{1bd50530-0f3c-463a-8020-64075f16490c}
HKEY_CLASSES_ROOT\interface\{2f952b57-0af1-4306-9aaa-3fdc5d8919fe}
HKEY_CLASSES_ROOT\interface\{4530cf0d-266e-44f3-b84c-8a0f8c7434eb}
HKEY_CLASSES_ROOT\interface\{50060c0f-3ccd-4a68-a819-da20a8ae1885}
HKEY_CLASSES_ROOT\interface\{61883b41-a9c0-46de-a6d9-67e4983ae25e}
HKEY_CLASSES_ROOT\interface\{99e5004a-8fca-4780-8fc6-9a70ec0c70c4}
HKEY_CLASSES_ROOT\trfdsk.amo
HKEY_CLASSES_ROOT\trfdsk.amo.1
HKEY_CLASSES_ROOT\trfdsk.iiittt
HKEY_CLASSES_ROOT\trfdsk.iiittt.1
HKEY_CLASSES_ROOT\trfdsk.momo
HKEY_CLASSES_ROOT\trfdsk.momo.1
HKEY_CLASSES_ROOT\trfdsk.ohb
HKEY_CLASSES_ROOT\trfdsk.ohb.1
HKEY_CLASSES_ROOT\typelib\{33add70f-53ab-4f97-b4b6-997881820f6d}
HKEY_CLASSES_ROOT\typelib\{4dfd0b10-93db-4d7e-9b34-3d92ca493be4}
HKEY_CLASSES_ROOT\typelib\{7812d585-c5f0-458e-9922-c9b4ebe837e8}\1.0
HKEY_CLASSES_ROOT\winb2s.amo
HKEY_CLASSES_ROOT\winb2s.amo.1
HKEY_CLASSES_ROOT\winb2s.dbi
HKEY_CLASSES_ROOT\winb2s.dbi.1
HKEY_CLASSES_ROOT\winb2s.iiittt
HKEY_CLASSES_ROOT\winb2s.iiittt.1
HKEY_CLASSES_ROOT\winb2s.momo
HKEY_CLASSES_ROOT\winb2s.momo.1
HKEY_CLASSES_ROOT\winb2s.ohb
HKEY_CLASSES_ROOT\winb2s.ohb.1
HKEY_CLASSES_ROOT\zippyl.amo
HKEY_CLASSES_ROOT\zippyl.amo.1
HKEY_CLASSES_ROOT\zippyl.iiittt
HKEY_CLASSES_ROOT\zippyl.iiittt.1
HKEY_CLASSES_ROOT\zippyl.momo
HKEY_CLASSES_ROOT\zippyl.momo.1
HKEY_CLASSES_ROOT\zippyl.ohb
HKEY_CLASSES_ROOT\zippyl.ohb.1
HKEY_CLASSES_ROOT\{0e9f6ac0-a21a-4591-910f-e2c6f3ca094c}
HKEY_CURRENT_USER\clsid\{0962da67-db64-465c-8cd7-cbb357caf825}
HKEY_CURRENT_USER\clsid\{356b2bd0-d206-4e21-8c85-c6f49409c6a9}
HKEY_CURRENT_USER\clsid\{52add86d-9561-4c40-b561-4204dbc139d1}
HKEY_CURRENT_USER\clsid\{999a06ff-10ef-4a29-8640-69e99882c26b}
HKEY_CURRENT_USER\interface\{018c5406-aee6-4a68-980f-2ceb1e9416fb}
HKEY_CURRENT_USER\interface\{0a7fc040-f84a-4ad7-9439-798b6c0f861e}
HKEY_CURRENT_USER\interface\{32a9d21f-f510-44dc-9ea6-0456eda04668}
HKEY_CURRENT_USER\interface\{c93cc79d-02d5-45b0-be39-7f5b0e5dda31}
HKEY_CURRENT_USER\interface\{da4b919f-b757-4e32-8d79-dec5c2704c4b}
HKEY_CURRENT_USER\software\aaa_soft
HKEY_CURRENT_USER\software\nsz1d.dll
HKEY_CURRENT_USER\software\_dsktptr
HKEY_CURRENT_USER\software\_rtneg4
HKEY_CURRENT_USER\software\_trgen
HKEY_CURRENT_USER\trfdsk.iiittt
HKEY_CURRENT_USER\trfdsk.iiittt.1
HKEY_LOCAL_MACHINE\clsid\{52add86d-9561-4c40-b561-4204dbc139d1}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\richedtr
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\richup
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22b720c7-5fa6-40a8-9f8f-8584bf669690}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4d568f0f-8ac9-40ab-88b7-415134c78777}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{55be9f0d-6caf-4c3e-b125-5a13a8c9d0ec}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{8037f7f0-80b6-453a-a7cb-5371a4a09bb8}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{999a06ff-10ef-4a29-8640-69e99882c26b}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\[%SYSTEM%]\winb2s32.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\0cj9lp4k
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\richeditor
HKEY_LOCAL_MACHINE\software\riched\stats\abi941
HKEY_LOCAL_MACHINE\software\riched\stats\rmg2
HKEY_LOCAL_MACHINE\software\riched\stats\sah
HKEY_LOCAL_MACHINE\software\winsoftware\winfixer
Search registry values in system registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{07e9cdf4-20d2-46b1-b681-663968f527ce}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\riched
HKEY_LOCAL_MACHINE\software\riched\lib
How To Remove QHosts:
You must download ExterminateIt. It can detect QHosts and prevent infection.
You can run trial version of ExterminateIt to detect,and then remove QHosts manually.
- Use Task Manager to terminate the QHosts process.
- Delete the original QHosts file and folders.
- Delete the system registry key parameters
Note that the easiest way is to buy antivirus software and be protected 24/7/365
This antivirus, ExterminateIt effectively and automatically removes viruses from you computer.
Download ExterminateIt! to instantly get rid of QHosts!
Check now if your PC is infected with QHosts
You can buy full version of ExterminateIt at RegNow.com.
Also Be Aware of the Following Threats:
Removing Meplex Adware
Earthlink.net.Tracking.Cookie Tracking Cookie Information
Remove SillyDl.DND Downloader
ABetterInternet.Aurora Adware Cleaner
cars.com Tracking Cookie Cleaner