The google search results look normal but the hyperlink is to a dubious site or another search engine. I've looked at other threads with the same problem but it doesn't help. task manager and regedit were disabled also but I've managed to get them back again. Analyse this in hijackthis doesn't seem to give a response. symantec av, lavasoft, ... don't get anthing - I guess because the m/c is running. Thanks for any help

have you tried safemode with networking? If you can get in, try this online scan: http://www.spywareinfo.com/xscan.php and remove all it finds Also I would suggest you run ALL the free cleaners listed in the link below. The first one you should run would be Ccleaner, that will get rid of all the excess cookies and junk, then run the cleaners....it will speed things up. That should get you started Some HELP in posting on Cnet plus free progs and instructions Glad to Help!

I've run fixwareout and ccleaner already - didn't help. fixwareout did seem to reduce the number of links redirected but the percentage is growing again. It's a company pc and the it guys can't fix it - think they just ran symentec av. I'm getting the pc rebuilt on thu/fri so I've got until then to play.

run the other cleaners I suggested. Another thing, did you run the x-cleaner scan I suggested? Some HELP in posting on Cnet plus free progs and instructions Glad to Help!

Thanks for the suggestionx. I'm not at work at the moment so will have to wait until tomorrow.

I left activescan running last night and it came up with Spyware:Cookie/Advertising C:\Documents and Settings\myname\Cookies\myname@advertising[1].txt Spyware:Cookie/Atlas DMT C:\Documents and Settings\myname\Cookies\myname@atdmt[2].txt Spyware:Cookie/Serving-sys C:\Documents and Settings\myname\Cookies\myname@bs.serving-sys[2].txt Spyware:Cookie/Doubleclick C:\Documents and Settings\myname\Cookies\myname@doubleclick[1].txt Spyware:Cookie/GoClick C:\Documents and Settings\myname\Cookies\myname@goclick[2].txt Spyware:Cookie/Mediaplex C:\Documents and Settings\myname\Cookies\myname@mediaplex[1].txt Spyware:Cookie/Serving-sys C:\Documents and Settings\myname\Cookies\myname@serving-sys[2].txt Spyware:Cookie/WebtrendsLive C:\Documents and Settings\myname\Cookies\myname@statse.webtrendslive[2].txt Spyware:Cookie/Tribalfusion C:\Documents and Settings\myname\Cookies\myname@tribalfusion[1].txt Potentially unwanted tool:Application/NirCmd.A C:\fixwareout\FindT\nircmd.exe Spyware:Cookie/Doubleclick C:\WINDOWS\system32\config\systemprofile\Cookies\administrator@doubleclick[1].txt Spyware:Cookie/WebtrendsLive C:\WINDOWS\system32\config\systemprofile\Cookies\administrator@statse.webtrendslive[2].txt I guess the nircmd.exe is because I ran fixwareout so nothing to worry about.

did you run the on-line scan? If so, I don't recall it ever catching cookies. Some HELP in posting on Cnet plus free progs and instructions Glad to Help!