paultclark

Found it. Persistence pays. Installed superantispyware and it found a.sys file in my drivers. It also found the corresponding registry key. I am not sure I would have ever found it by myself. You can close this case. I checked my DNS and ran another scan and everything is fine. Thanks.

I have tried multiple methods for getting rid of the 017 entries. No matter what technique I try (housecall, smitfraud, mbam, spybot, adaware, regedit in safe mode, etc) it does not work. This may mean some TSR or program is reinserting it back. I do not think my router is affected since the DNS entries are correct on it and none of the other computers on my network are affected. I use firefox and only use IE when I need to run housecall. Thanks so much for your help. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:38:20 AM, on 12/25/2008 Platform: Windows XP SP3 (WinNT 5.01.2600)