I'm afraid I can't help a great deal as it was a one-off brute force effort. Most Googling finds pages telling you to download this or that scan and remove too

I'm afraid I can't help a great deal as it was a one-off brute force effort. Most Googling finds pages telling you to download this or that scan and remove tools. But I'm wary of doing that. What I manually did was roughly: 1) Use SysInternals Process Explorer to check for and kill any monitoring process 2) Use SysInternals Autoruns to find and remove all autorun info that I didn't recognise and to identify which executables may be doing it 3) Uninstall component through control panel 4) Restart 5) Change home page settings in browsers (restart, and observed that it only worked until the browser restarted) 6) Removed all browser plugins and extensions on all browsers, where I didn't recognise the extension 7) Repeat #5 8) Viewed source of Firefox browser config and still couldn't find it, but found Chrome had some crappy values referring to this stuff 9) Downloaded Chrome and Firefox, then uninstalled Chrome and Firefox. Deleted all local profile folders from %APP_DATA% and other hidden locations. 10) Manually entered the registry and deleted anything I identified as Search Protect, conduit, Firefox, and Chrome. 11) Manually delete any files identified by anything in the registry or earlier steps 12) Reboot 14) Install Chrome and Firefox Thankfully my girlfriend doesn't use IE, so aside from purging all extensions and resetting all defaults, I didn't have to concentrate on that. Interestingly, Chrome proved more susceptible to this than Firefox. Firefox scrubbed clean fairly quickly, but it was Chrome that really seemed determined to change search provider and home page. We chose to nuke her sync'd profile and the local copy entirely, and then install everything from fresh. This was a huge time-suck, and it's been years since I wandered through the registry... not fun. PS: And yes, I've told my girlfriend to organise her backups, ensure she's got everything and in a week or two we'll do the full reinstall thing. Sucks that she has to use Windows, but that's academia in the UK for you.