Qhosts trojan

Hi everybody

I apparently have a problem with a Virus called "Win32/Qhosts trojan".
Every time i browse a web page in Firefox 2 or Internet Explorer, but also at random times, I get the following from NOD32:
http://img214.imageshack.us/img214/6133/nod321xc4.jpg

If I try to delete it I get this:
http://img214.imageshack.us/img214/6936/nod322hp6.jpg

And trying to rename it gives this:
http://img214.imageshack.us/img214/976/nod323wt2.jpg

I have the newest updates for NOD32 2.7 - and a In-depth scan comes up with nothing.
I have also tried the Symantec removal tool here. But it also finds nothing.

After this I tried to open C:\windows\system32\drivers\etc\hosts with Notepad but it says "Access is denied." (I haven't added anything to the hosts file myself previously)

When I look in task manager i have 6 instances of svchost.exe running.

All these NOD32 popup's are driving me crazy

Any help would be very appreciated.

 

That's odd. Try booting to safe mode and make sure the file only contains
127.0.0.1 localhost
You can disregard the comments starting with #, these lines are ignored. Also please send a log from Autoruns (http://www.microsoft.com/technet/sysinternals/utilities/Autoruns.mspx) to support[at]eset.com with this thread's url for perusal.

 

Ah, thank you for the ideer with safe mode. A NOD32 scan in safe mode found and deleted my hosts file, and no more popups. Now i have no hosts file though... but i found a place where I could see the default settings, and just made a new file and copied the settings over.

Thank you.