I don't know if you've tried this already, Ba, but I have read that the Malwarebytes scan works better in safe mode, as the buggers aren't active. Then follow up with another scan in Normal mode.

However if that doesn't get it and unless its a well-known blighter and you can find instructions for manual removal then the next step would be something like Hijackthis. Unfortunately that is quite technical and a nightmare if you are not familiar with it. Could be what your "man" uses.

_________________
tribs

Well done again, HiJack is great. Have cleared out a load more MR2 and am hopeful to get the niggly little web-page-changers later. The other 5 BH are on the way. Never heard of HiJack, and as you pointed out, not for the casual user.

_________________
Four wheels move the body - 2 wheels move the soul.

Stay away from those 'dodgy' sites B

_________________
Yep, Im still here.

Wheee. Think I've cracked it. There was an instruction in the boot sequence to create a file which then created the bug. It was self-sustaining.
I eventually found a 4th. & 5th. registry entries, one of which re-inserted it after every deletion and the real pig which had a "no change" value set to "1" and referenced those other entries. I set that to "0" deleted all the others, Wiped out the original "run" instruction in the startup sequence and ran everything I've got at it. Seems perfect now, but it took a lot of effort. I deserve a drink.

_________________
Four wheels move the body - 2 wheels move the soul.

Sorry to bore some of you but it could be you next. Having spent ALL day AGAIN in this quest, I have a numb bumb and another win. It was ******* Yahooooo trying to hijack Google. 2 more to get I think.

_________________
Four wheels move the body - 2 wheels move the soul.

Yes that is a damn nuisance.

Yahoo search engine comes in with Nvidia settings and also I think, they have greased AMD's palm as well. (Intel is greased up with microsoft of course)
I removed Yahoo's dominance shortly after loading and configing this new Maxi box. It was continually attempting to identify and interupt.

Therefore, go to:

Internet Options in Tools

Delete everything you see in the home page window on the General tab.

Then manually type in on the window: http://www.google.co.uk/

Job done - Your default internet browser looks at Google - It can't look elsewhere, unless YOU instruct it to, cos you have deleted all those other search engines, and junk links in the default window.

I use Google classic, same as they use in the public library - very little advertising and niusance pop ups appear

Ba have you been running for a long time with that Google - V - Yahoo conflict ?

_________________
Duncan

Yep, there is a definite nvidia link. Tried to download a new spyware searcher and it was blocked by the buggy. Really don't want to reformat, so will carry on tomorow. Lovely Pinot Blanc almost compensates. I shall now massacre someone at poker...I'm wild man.

_________________
Four wheels move the body - 2 wheels move the soul.

Fingers crossed, I itnink it's all over. Deleted around 1000 registry entries today.

_________________
Four wheels move the body - 2 wheels move the soul.

...and still they came. New bit of kit got 3 out of last 4 (I hope). Info from that allowed me to get no.4 manually. It was hidden in one of the bits of software that I'd tried on it. Cunning little ******

_________________
Four wheels move the body - 2 wheels move the soul.

Having cleared out another huge number of bits and bobs, the m/c has been perfect. No naughty pop-ups, no browsr hijacking, no freeze-ups and no disappearing desk top. This is day 5 of the Troubles, and I reckon 25 hrs hard work.'Tis a gret relief. Shall celebrate with a drink this evening.

_________________
Four wheels move the body - 2 wheels move the soul.