Users various license keys failing- possible virus?

Had a user one day, said her PC said her Quark software was expired and needed to re-enter code (trial done) (she has full, paid version)
Soon after, her Adobe XI pro did the same.
Yesterday, her Office said similar

I think there is some sort of virus deleting her keys
If I enter the keys, and she reboots--it *seems* to kill the licenses again---although I have not fully verified this.


Obviously this is a problem..

I have run malwarebytes, MS AV and even Combofix...nothing has found anything ...that fixed it anyway...  If anyone has a good (prefer free) AV/AMW/cleaning software...let me know

thanks!
DCratsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

strivoliCommented:
0
Thomas Zucker-ScharffSolution GuideCommented:
Are you sure these are valid key requests?  They might be fake dialogs to get you to put in the keys so a keylogger can steal them.  Not to be alarmist or anything, but I would first run Malwarebytes Chameleon on the machine following the instructions in the forum post below.

https://forums.malwarebytes.org/index.php?showtopic=125373

You might also want to do a rootkit scan with at least 3 of the free antirootkit apps reviewed in this article:

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_2245-Anti-rootkit-software.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DCratsAuthor Commented:
going to rebuild
0
Thomas Zucker-ScharffSolution GuideCommented:
Use Darik's boot and nuke first (dban). Backup then autonuke.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.