if anyone have similiar problem with search engines domains (google,altavista,alltheweb etc.)
you may try this
Symantec Security Response
i've got this shit at 28 sep somewhere from web
it's very clever cause standard hosts file looks normal,
qhosts just created other copy and windows was using the second one instead the correct one