Qhosts trojan

Discussion in 'NOD32 version 2 Forum' started by Mulpacha, Jun 12, 2007.

Thread Status:
Not open for further replies.
  1. Mulpacha

    Mulpacha Registered Member

    Joined:
    Jun 12, 2007
    Posts:
    2
    Hi everybody

    I apparently have a problem with a Virus called "Win32/Qhosts trojan".
    Every time i browse a web page in Firefox 2 or Internet Explorer, but also at random times, I get the following from NOD32:
    http://img214.imageshack.us/img214/6133/nod321xc4.jpg

    If I try to delete it I get this:
    http://img214.imageshack.us/img214/6936/nod322hp6.jpg

    And trying to rename it gives this:
    http://img214.imageshack.us/img214/976/nod323wt2.jpg

    I have the newest updates for NOD32 2.7 - and a In-depth scan comes up with nothing.
    I have also tried the Symantec removal tool here. But it also finds nothing.

    After this I tried to open C:\windows\system32\drivers\etc\hosts with Notepad but it says "Access is denied." (I haven't added anything to the hosts file myself previously)

    When I look in task manager i have 6 instances of svchost.exe running.

    All these NOD32 popup's are driving me crazy :p

    Any help would be very appreciated.
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,415
  3. Mulpacha

    Mulpacha Registered Member

    Joined:
    Jun 12, 2007
    Posts:
    2
    Ah, thank you for the ideer with safe mode. A NOD32 scan in safe mode found and deleted my hosts file, and no more popups. Now i have no hosts file though... but i found a place where I could see the default settings, and just made a new file and copied the settings over.

    Thank you.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.