Categories: Trojan

How to remove “Trojan.MSIL.Qhost.bdn”?

The Trojan.MSIL.Qhost.bdn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.MSIL.Qhost.bdn virus can do?

Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan.MSIL.Qhost.bdn?


File Info:
name: 487DA9607894A1AEC969.mlwpath: /opt/CAPEv2/storage/binaries/cb3513baa692de72e26529448e993c9d87b5296b364d59564e114eb07ff6e931crc32: 584CE96Emd5: 487da9607894a1aec9693ccbda52099csha1: 59fac330cd34388da9b0dfa9a631033c67dd319esha256: cb3513baa692de72e26529448e993c9d87b5296b364d59564e114eb07ff6e931sha512: 87b4ae84f8314f8844676490120e8af6edaf6d105ca2df64262d11be6f5f3bce95b25205acf905511570f2044941251fc02fa22422fc6a678e116c2762f5f133ssdeep: 12288:6Qi3q0o0wmg/lTccc1ng+p1cymfMXLb/Gu18OKbqQs:6Qia0LO90Rg+p6MX//h18jPstype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T198941342AAD1D036E02295F0993294555AB3BF372C38505EB6ED5E6C5F63FA18C0D3F2sha3_384: aa36803aeda812ac329c31e06782e36e19f8d22658995d9fbddba5050aa89a317c78ff159a46c23db1579e46e2d57f97ep_bytes: 558bec83c4c453565733c08945f08945timestamp: 1992-06-19 22:22:17
Version Info:
Comments: This installation was built with Inno Setup.CompanyName:                                                             FileDescription: SeachManager Setup                                          FileVersion:                     LegalCopyright:                                                                                                     ProductName: SeachManager                                                ProductVersion: 1.0                                               Translation: 0x0000 0x04b0

Trojan.MSIL.Qhost.bdn also known as:

Lionic	Trojan.Win32.Qhost.4!c
DrWeb	Trojan.Hosts.43503
MicroWorld-eScan	Trojan.GenericKD.6261732
FireEye	Trojan.GenericKD.6261732
ALYac	Trojan.GenericKD.6261732
Cylance	Unsafe
Zillya	Trojan.Qhost.Win32.18302
Sangfor	Riskware.Win32.Agent.ky
K7AntiVirus	Trojan-Downloader ( 0050cd791 )
Alibaba	TrojanDownloader:MSIL/Qhost.981a311b
K7GW	Trojan-Downloader ( 0050cd791 )
Cybereason	malicious.07894a
BitDefenderTheta	Gen:NN.ZemsilF.34294.bm0@a0b6RYj
Symantec	Trojan.Gen.2
ESET-NOD32	multiple detections
APEX	Malicious
Kaspersky	Trojan.MSIL.Qhost.bdn
BitDefender	Trojan.GenericKD.6261732
NANO-Antivirus	Trojan.Win32.Hosts.evbjbz
Avast	Win32:DropperX-gen [Drp]
Tencent	Msil.Trojan.Qhost.Pdmr
Ad-Aware	Trojan.GenericKD.6261732
Sophos	Mal/Generic-S
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DJS21
McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.gc
Emsisoft	Trojan.GenericKD.6261732 (B)
GData	Trojan.GenericKD.6261732
Jiangmin	Trojan.MSIL.algmp
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1129312
Arcabit	Trojan.Generic.D5F8BE4
Microsoft	Trojan:Win32/Skeeyah.A!rfn
AhnLab-V3	Trojan/Win32.Qhost.C2356826
McAfee	Artemis!487DA9607894
MAX	malware (ai score=99)
VBA32	Trojan.MSIL.Qhost
TrendMicro-HouseCall	TROJ_GEN.R002C0DJS21
Yandex	Trojan.DL.Agent!kiM+XKVoS3w
Fortinet	W32/Agent.DIO!tr.dldr
AVG	Win32:DropperX-gen [Drp]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (W)