iexplore.exe*32 / two processes at startup

Hoping you can lend a hand on this one. My uncle called me because he ended up with FBI MoneyPak. Got that ousted with no problem using Safe Mode and MalwareBytes. MBAM picked up 25 infections to start, and after McAfee was kicked to the curb, and AVG was installed it picked up 1 infection.

Problem is upon further inspection, there are two iexplore processes running at startup. I have scanned with MalwareBytes, AVG, and even Windows Defender and the results are zero. Even the anti-rootkit scan from AVG turned up nothing.

I can kill the processes after startup, but I can't expect my uncle to do such every time.

Any suggestions, or advice you may have would be helpful...

 

I looked at the properties on the bots that were running an Explorer 32 bit, and they were dated December 13 for file creation.

So I did a System Restore and killed the 2 bots that were taking up processes. Rolled it back to November 28th.

Main issue is he surfs European websites, But the system restore routed the last of the malware.