TSPY_QHOST.QFB

Posted: June 18, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	4,385
Threat Level:	9/10
Infected PCs:	6,626

First Seen:	June 18, 2013
Last Seen:	October 12, 2023
OS(es) Affected:	Windows

TSPY_QHOST.QFB is a new member of the Trojan Qhost family, a group of browser hijackers that modify your PC's Hosts file settings as a means of redirecting you to other websites – usually malicious domains, including those known for hosting phishing attacks, drive-by-downloads and similar browser-based PC threats. Browser hijackers ordinarily are categorized as low-level PC threats, but SpywareRemove.com malware experts noted that TSPY_QHOST.QFB's payload is somewhat more dangerous than the norm; TSPY_QHOST.QFB specializes in redirecting users of Korean financial websites away from those sites and to sites that attempt to harvest their personal information. Detecting and deleting TSPY_QHOST.QFB always should be left up to a suitable anti-malware product, and a thorough anti-malware scan usually is advised whenever you see unusual browser interaction, even when you're navigating to sites that you trust.

The Ghosts of Browser Hijackers Past Coming to Haunt Your Bank Account Anew

TSPY_QHOST.QFB is a new variant of a very old and well-defined type of PC threat – the browser hijacker that uses your Hosts file to trigger redirects automatically. Unlike the potentially less discriminate nature of DNS redirects (such as the attacks of the headlines-grabbing DNS Changer), Hosts file redirects usually are designed to trigger when you access a specific website. Less dangerous browser hijackers than TSPY_QHOST.QFB often use this attack for redirecting your online searches away from popular search engines, but TSPY_QHOST.QFB uses it to steal personal and financial information.

Targeting South Korean residents, TSPY_QHOST.QFB's redirects will affect your browser every time you try to navigate to various major financial and banking websites popular in that country. The secondary sites that your browser is forced to load will ask a series of fake 'security questions,' which are designed to gain the victim's trust, before requesting information like your account number, multiple passwords and user ID. Since these malicious sites are disguised as extensions of the original financial sites, SpywareRemove.com malware researchers advise all South Korean residents to be aware of the danger in carelessly entering data after navigating to a site that you trust – especially if you see unusual content, such as exceptionally involved and personal security questions.

Zapping TSPY_QHOST.QFB Out of Your Browser Before Your Bank Account Suffers for It

Since TSPY_QHOST.QFB, like all PC threats with an element of heavy social engineering in their attacks, require the victim to be unaware of its presence, a little awareness of the typical Web content of your financial sites, and what's inappropriate for them to request, will go a long way in shutting down TSPY_QHOST.QFB's phishing attempts. SpywareRemove.com malware researchers also warn that TSPY_QHOST.QFB, like all Hosts file-based browser hijackers, can initiate its attacks in a browser-independent fashion, whether you're using Chrome, Internet Explorer or some other type of browser.

If you've determined that your PC is infected by TSPY_QHOST.QFB, anti-malware software should delete TSPY_QHOST.QFB and be used to clean your Hosts file. Any confidential data handed out to TSPY_QHOST.QFB should be treated as being in criminal possession, and you should contact your bank or any other relevant financial companies to prevent this information from being exploited against you.

TSPY_QHOST.QFB

Threat Metric

The Ghosts of Browser Hijackers Past Coming to Haunt Your Bank Account Anew

Zapping TSPY_QHOST.QFB Out of Your Browser Before Your Bank Account Suffers for It

Leave a Reply