Categories: Malware

How to remove “Win32/Qhost.PED”?

The Win32/Qhost.PED is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Qhost.PED virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Unconventionial language used in binary resources: Russian
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Qhost.PED?


File Info:
crc32: 39B38C05md5: c2bac3b1f9e3a789e36ed25092b67a06name: C2BAC3B1F9E3A789E36ED25092B67A06.mlwsha1: e002e819be14c0954f4d15f26290c051810658a8sha256: 4c54f67521fd8caccc8fcc7c058fb2f48682bd57bf7c597c161b35a8d23ab35fsha512: 64a4b4a4a4c72882eb1d58ab3a550f7f23126212bc3a6fe40c95e953259377cd61028bebef089be2c5999cc4d459978f1ab76b6ad4341ed683e0a5ff1f1636c7ssdeep: 6144:727gCbTehEqclWYac67TJx4dGazSDKTsmReZGVrV:727/bTehEqclr0mimIZGbtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Win32/Qhost.PED also known as:

DrWeb	Trojan.Hosts.6156
Cynet	Malicious (score: 99)
ALYac	Gen:Trojan.Heur.DP.cKW@aaaKr7l
Cylance	Unsafe
Cybereason	malicious.1f9e3a
Baidu	Win32.Trojan.Generic.u
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Qhost.PED
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Trojan.Ag-9
Kaspersky	Trojan-Ransom.Win32.Gimemo.arvh
BitDefender	Gen:Trojan.Heur.DP.cKW@aaaKr7l
NANO-Antivirus	Trojan.Win32.Gimemo.duisfi
MicroWorld-eScan	Gen:Trojan.Heur.DP.cKW@aaaKr7l
Tencent	Win32.Trojan.Gimemo.Syhu
Sophos	Mal/Generic-S
Comodo	Malware@#17esa6bf7igvh
F-Secure	Trojan.TR/Spy.43520.205
BitDefenderTheta	AI:Packer.E99AD09B1C
VIPRE	Trojan.Win32.Generic.pak!cobra
McAfee-GW-Edition	BehavesLike.Win32.Emotet.cc
FireEye	Gen:Trojan.Heur.DP.cKW@aaaKr7l
Emsisoft	Gen:Trojan.Heur.DP.cKW@aaaKr7l (B)
Jiangmin	Trojan/Gimemo.ejj
Avira	TR/Dropper.Gen
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Heur.DP.EB1D85
ZoneAlarm	Trojan-Ransom.Win32.Gimemo.arvh
GData	Gen:Trojan.Heur.DP.cKW@aaaKr7l
AhnLab-V3	Trojan/Win32.Chifrax.C160330
McAfee	Artemis!C2BAC3B1F9E3
MAX	malware (ai score=89)
VBA32	Hoax.Gimemo
Malwarebytes	Trojan.Dropper.SFXAI
Panda	Trj/CI.A
Rising	Ransom.Gimemo!8.306 (CLOUD)
Yandex	Trojan.GenAsa!nIHrkMdLyF8
Ikarus	Trojan-Ransom.Gimemo
Fortinet	W32/Qhost.PED!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml