Yesterday, my wife clicked a link in an email and shortly thereafter started seeing popups by Norton Internet Security about email errors. They varied in content, but were usually to the tune of "AOL will not accept this message" or "recipient does not exist." Norton doesn't really explain what this is all about, but I summized by reading the Norton community that this meant something on the PC was spamming emails and I was getting the bounceback messages.
The email warnings came one after the other, and only but shutting the internet connection off could I get them to stop.
Scanned with NIS using the latest virus definitions. No threats found.
Downloaded Malwarebytes and tried it. No threats found BUT there were popups saying it blocked connections to potential malicious website.
Downloaded and tried tdsskiller; no threats found.
Downloaded and tried Microsoft MRT; no threats found.
In the morning, I redid the Malwarebytes and NIS scans in safe mode; nothing found.
Tonight, I did an update to NIS and Malwarebytes and ran quick scans (new long scans ongoing right now)
Quick scan of NIS found something: trojan.avlock. Removed it, but there were more NIS email popups (albeit a small number) and another few Malwarebytes IP address blocks, and Norton blocked an intrusion attempt.
Quick scan with Malware bytes found registry changes, but a quick look at the keys looked like it only turned regedit off.
I haven't seen any problems for a while, but considering that there was an IP address block AFTER norton's only successful removal, I am not at all convinced my mysterious visitors are gone.