system memory infection???

[Brad the best]

hi, my sisters computer has been acting up for the past month , spyware like crazy , turns out she didnt update norton or ad-aware or spybot or run windows update sinse september . so of corse i have been working my but off to clear it out . so far atleast 1500 spyware have been found in ad-aware and spybots around the same . norton delt with some virus /worm that made 500 copies of it self . i had to click okay for half an hour . anyway she herd that nod , I think thats the name was a good program so she downloaded a trial . it detected this


Application win32/adaware.look2me found in operating memory .system memory infection originated from file C:/windows/system32/mbrmsg.dll .

this program cant seem to delete it . i downloaded spyware blaster . and tried to block pop ups . sorta worked . I run adaware spybot norton 2005 firefox with just about every anti spy pop up blocker available . still pop ups . i have disabled start up programs that i new were viruses or ads in msconfig . etc . still things seem to go wrong . is this ad ^ imbeded in the motherboard or the ram or something (Something i was most unfortunate to have a few months ago ) its not a consumer version of xp . x university . the computer is basically liek the one put below . grapghics is a ati 32mb or smaller . 3 sticks of 128 ram (100 oe 133 i forget) 2 hds 30 gb and a 20 gb . pentium 3 around 833mhz . its werid it ahs always ran alot slower then my 667mhz (i always found that od , anyone know why that is) anyway please some one tell me if htey know what is wrong with it , do i have to scrap the board or what . norton ad-aware and spybot show know spyware . this nod program shows a bunch (is it anygood) any input would be most aprechiated ,thank you in advance

[rspassey]

NOD is a good program. I would recommend running all your anti spyware and AV in safemode. Perhaps you will be able to get rid of what's left that way. Also, disable and clear system restore to assure that to viruses are hidding in there and reappearing. You will also want to run scans from Ewido (www.ewido.net) and HouseCall (http://housecall.trendmicro.com/) - which can be done in SafeMode with networking.

Lastly, post a hijackthis log (after following the instructions in the security forum) and let us have a look. The root of some of your problems may be fixable with hijackthis.

[Brad the best]

Thanks for the reply i will do that , i think i already turned off system restore . and ran av scans in safemode . i will do an eweido scan . and the highjack this once i read how to do it