Qhosts.G is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. Qhosts.G is compressed using the executable packer and its file size is 31,232 bytes. Qhosts.G drops the following files on the hard drive: - C:\DOCUME~1\Administrator\LocalS~1\Progra~1\svchostss.exe (31232 bytes)
It also changes Windows registry: - Creates value "Windows Update System"="C:\DOCUME~1\Administrator\LocalS~1\Progra~1\svchostss.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
- Creates value "Windows Update System"="C:\DOCUME~1\Administrator\LocalS~1\Progra~1\svchostss.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".
It creates the following mutex to ensure only one instance is running: TTULOBDWIPMBI432DJASDJSDMSDL. It also monitors the list of running processes, is executed every time Windows starts.
|
