Anti-malware programs won’t detect this, for starters, I’m going to assume you’re using Firefox… go to Tools/Add-ons/plugins and disable Java anything. Don’t worry, the next time you need Java you’ll be prompted to d/l a clean version from Oracle. Then in your browser location bar (where you type http://blahblahbl.com) type in about:config. Notice anything that’s bold is something that has been changed since you installed Firefox… look at the browser.search section and right-click the values that are bold… then choose “reset.” Look through your about:config for anything similar (values that say “search” or “Google” and reset those back to default. Shut down Firefox (and make sure it’s not still a running process) and go to your Firefox folder (usually c:\Program Files\Mozilla\Firefox and in the “Searchplugins” folder delete google.xml (you can just add google once your browser is fixed).Then go to the “Extensions” folder (still in your firefox directory) and make sure you don’t have anything that looks weird like {432dkfhdskjfhdskfjh984729847743} (usually anything between brackets) if so, delete it. Now go to your windows Start menu and In your search bar type “regedit” (without the quotes) be careful with this program! Before doing ANYTHING go to File and Export and type in a name and save a copy of your current registry. This is just in case you screw something up. Now in Regedit, Search for ‘google.com’ (in the top menu choose “Edit” and then “find”) you will see one or two of the hijacked URLs, delete the value that you see (not the key). By hijacked urls, I mean it doesn’t say www.google.com or has some funky random stuff inside brackets again. After it finds the first entry just hit F3 (your function 3 key) to search for the next entry… repeat same steps until you get through entire registry). Finally, reset your windows host file (here’s some instructions http://support.microsoft.com/kb/972034) back to the default values. I had the same problem a couple months ago, and after TONS of research… and trying EVERYTHING… this was the only process that 100% worked for me. I no longer have problems. Hope this works for ya. If you need anymore assistance feel free to ask.