Qhosts trojan

Discussion in 'NOD32 version 2 Forum' started by Mulpacha, Jun 12, 2007.

Thread Status:
Not open for further replies.
  1. Mulpacha

    Mulpacha Registered Member

    Joined:
    Jun 12, 2007
    Posts:
    2
    Hi everybody

    I apparently have a problem with a Virus called "Win32/Qhosts trojan".
    Every time i browse a web page in Firefox 2 or Internet Explorer, but also at random times, I get the following from NOD32:
    http://img214.imageshack.us/img214/6133/nod321xc4.jpg

    If I try to delete it I get this:
    http://img214.imageshack.us/img214/6936/nod322hp6.jpg

    And trying to rename it gives this:
    http://img214.imageshack.us/img214/976/nod323wt2.jpg

    I have the newest updates for NOD32 2.7 - and a In-depth scan comes up with nothing.
    I have also tried the Symantec removal tool here. But it also finds nothing.

    After this I tried to open C:\windows\system32\drivers\etc\hosts with Notepad but it says "Access is denied." (I haven't added anything to the hosts file myself previously)

    When I look in task manager i have 6 instances of svchost.exe running.

    All these NOD32 popup's are driving me crazy :p

    Any help would be very appreciated.
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
  3. Mulpacha

    Mulpacha Registered Member

    Joined:
    Jun 12, 2007
    Posts:
    2
    Ah, thank you for the ideer with safe mode. A NOD32 scan in safe mode found and deleted my hosts file, and no more popups. Now i have no hosts file though... but i found a place where I could see the default settings, and just made a new file and copied the settings over.

    Thank you.
     
Thread Status:
Not open for further replies.