One of my clients have reported Popups, we instructed how to removed, then they get a extreme high usage Bill 300% over. This afternoon we have tracked it down to one PC by installing a lightweight Network bandwidth which showed in a minute 20 MB downloaded and continues to go up. under task manager Found iexplorer.exe high memory usage. Ran Adwcleaner which found some PUP but same problem, malwarebytes same thing. booted to safe mode with networking same problem. Removed Internet explorer 11 from add and remove features, now instead of Iexplorer.exe is it under it is under Explorer.exe. If you try to close the problem process fixes the problem for few seconds but starts backup. We can gone through Auto runs (all tabs) nothings out of the ordinary, failing all this we have ran combofix on the infected computer this found MBR infection but unfortunately after a restart same problem. Tomorrow i will be clearing the java cache and running MBAM Rootkit tool time and access is not a luxury if we cant solve problem by afternoon we will have to reinstall makes this worse only access is remotely.
Any advise would be fantastic