Trojan:Win32/Qhost removal guide

The Trojan:Win32/Qhost is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Qhost virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics
Binary compilation timestomping detected

How to determine Trojan:Win32/Qhost?


File Info:
name: 6C7DA427F9A60D3090B9.mlw
path: /opt/CAPEv2/storage/binaries/7cd5f6f03f4f0276d7a7e00a055edd22c0aed628616ffb412c391c530fa3bbef
crc32: 101DB1BA
md5: 6c7da427f9a60d3090b968c79d3dc364
sha1: 7b102204938fb7304395fb54aec653a399c9b783
sha256: 7cd5f6f03f4f0276d7a7e00a055edd22c0aed628616ffb412c391c530fa3bbef
sha512: 092aea2a4e71a70bd95af0adcb40d2d5dd2d446bdb54949454efe9dd803b205306d62e55f41b2c3c45f7155549029f7e3f3d54f133c260d3426d1c88bc695848
ssdeep: 49152:1qFG+LzAlmmrV3C5dlj+LzAlmmrV3C5dlJqFMUasqcVF//NMl/YMi/fMJS3MT:3lxC5nNlxC5nZPFmzMKMIMGMT
type: PE32+ executable (console) x86-64, for MS Windows
tlsh: T1A7D5AF5A7DD19074C09644F049EE93B15E39BC272A3086AE2F80F6367F70E65ABB7311
sha3_384: 9ac2ff9ec09696304f032d91354044ba373c51ec043c47ee180ff02fc8e95cf2e0491e4184547924adc4bb7e11d5efad
ep_bytes: 4883ec28488d0d75110100e8800b0100
timestamp: 2025-06-19 15:30:53

Version Info:
0: [No Data]

Trojan:Win32/Qhost also known as:

Lionic	Virus.Win32.Lamer.n!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Gen:Variant.Tedy.44099
McAfee	Artemis!6C7DA427F9A6
Malwarebytes	Malware.AI.930859438
Cybereason	malicious.7f9a60
Cyren	W32/CoinMiner.M.gen!Eldorado
Symantec	Trojan.Gen.6
ESET-NOD32	a variant of Win32/Agent.OAT
Paloalto	generic.ml
ClamAV	Win.Trojan.Qhost-160
Kaspersky	Virus.Win32.Lamer.ko
BitDefender	Gen:Variant.Tedy.44099
NANO-Antivirus	Trojan.Win32.BtcMine.exddfs
MicroWorld-eScan	Gen:Variant.Tedy.44099
Avast	Win32:Adware-gen [Adw]
Tencent	Win32.Virus.Lamer.Wqxh
Ad-Aware	Gen:Variant.Tedy.44099
Emsisoft	Gen:Variant.Tedy.44099 (B)
DrWeb	Tool.BtcMine.1051
TrendMicro	TROJ_GEN.R002C0DL821
McAfee-GW-Edition	Trojan-FOZT!AFD222B35657
Sophos	Generic ML PUA (PUA)
Ikarus	Worm.Win32.Agent
GData	Gen:Variant.Tedy.44099
Jiangmin	Worm.AutoRun.awwe
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.344D41C
Gridinsoft	Ransom.Win64.Sabsik.sa
ViRobot	Trojan.Win32.Z.Agent.2928307
Microsoft	Trojan:Win32/Qhost
BitDefenderTheta	AI:Packer.7BD4657620
ALYac	Gen:Variant.Tedy.44099
MAX	malware (ai score=87)
VBA32	Trojan.Qhost
TrendMicro-HouseCall	TROJ_GEN.R002C0DL821
Yandex	Trojan.GenAsa!QsT5y2rA9n0
MaxSecure	Virus.Win32.Lamer.KO
Fortinet	W64/Agent.DPI!tr
AVG	Win32:Adware-gen [Adw]
CrowdStrike	win/malicious_confidence_60% (W)

How to remove Trojan:Win32/Qhost?

Trojan:Win32/Qhost removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X