All google url's blocked

I think I may have gotten some spyware on my computer, not me personally but my sister. The only thing it did, the file she opened, it changed her wallpaper to black, and then deleted itself. And also changed her homepage to something other site. So I did a virus scan, came clean, then I did a system restore, and it was all good. Except that now any google site is blocked. www.google.com, www.google.ca. However www.earth.google.com works.I also tried FF and IE, both same problem. Any ideas how how to fix this one?

Have you done a spyware scan with Ad-Aware or SpyBot S&D?

Post your HJT and lets take a look.

Alright I figured that'd be the next step. I figured id post it before I tried both of those options, in the event that there was some special trick for this one, cause it seems somewhat unusual. But apparently not so I will do a spyware check with and get back with HJT log. Thanks guys.

It's been a while since I've had a good challenge with a HJT log. Post it up and we'll have a looksee.

Check c:\windows\system32\etc\drivers\hosts open it in a text editor and remove any entries except for the top one 127.0.0.1 localhost

Alright so I haven't had a chance to do any scans, but I did what you said Fenis and that cleared it up! There was a list of about 40 sites, microsoft, some tech forum sites and what not. So I think I should be good now, I still might do a few scans just to make sure. Thanks for the help guys.

I have heard of that before. (cant remember where) Just how does that file get altered?

Spyware, malware, etc.

Its just a text 'helper' file. the TCP/IP stack in Windows looks in there for DNS entries before requesting an answer from a real DNS server. Sypware likes to modify that file because it causes Windows own TCP/IP stack to redirect your traffic to certain sites to where ever they want-and you can see why a troublemaker could want that.