Troj/Qhosts-AT is a Trojan for the Windows platform.
When run Troj/Qhosts-AT changes the following registry entry:
HKCU\Software\Microsoft\Internet Explorer\Main\
Start Page
and modifies the HOSTS file specifically redirecting banking websites like abbey.co.uk and commbank.com.au to fake banking website domains. The HOSTS file will contain the following additional entries:
<IP address> abbey.com
<IP address> www.abbey.com
<IP address> myonlineaccounts2.abbey.com
<IP address> www.abbey.co.uk
<IP address> abbey.co.uk
<IP address> www.cahoot.com
<IP address> cahoot.com
<IP address> ibank.cahoot.com
<IP address> cahoot.co.uk
<IP address> www.cahoot.co.uk
<IP address> netbank.commbank.com.au
<IP address> www.commbank.com.au
<IP address> commbank.com.au