You're probably ok if malwarebytes was up to date. But you should make sure AVG is updated and current and run a full scan with it to see it sets off a bad guy that again disables it.. If something should again disable it when running a scan,, you have some investigative work to do.

Mikie, you're right...something was going on. I ran Malwarebytes this evening and came up with the following log.

Malwarebytes' Anti-Malware 1.36
Database version: 2112
Windows 5.1.2600 Service Pack 3

05/11/2009 8:57:48 PM
mbam-log-2009-05-11 (20-57-48).txt

Scan type: Full Scan (C:\:)
Objects scanned: 130796
Time elapsed: 38 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\securentm (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I ran it again after quarantining and got this one. I had a terrible virus a few weeks ago and Landzdown helped me clear it up. Does this last log mean I'm ok? I wonder why AVG didn't find it?

Malwarebytes' Anti-Malware 1.36
Database version: 2112
Windows 5.1.2600 Service Pack 3

05/11/2009 9:52:46 PM
mbam-log-2009-05-11 (21-52-46).txt

Scan type: Full Scan (C:\:)
Objects scanned: 130145
Time elapsed: 34 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Run these 2 programs below ,Where are you picking up this stuff are you the only one using the computer?

ATF Cleaner by Atribune to your Desktop.

Note: Vista users must use Run As Administrator
 Under Main: Select Files to Delete choose: Select All.
 Click the Empty Selected button.
 If you use Firefox browser click Firefox at the top and choose: Select All
 Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
 If you use Opera browser click Opera at the top and choose: Select All
 Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
 Click Exit on the Main menu to close the program.

Use the Kaspersky Lab Online Scanner download from here click here

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.
 Click on SCAN NOW
 Click Accept.
 The program will then begin downloading the latest definition files.
 Once the files have been downloaded locate the Scan Settingsand have it scan My Computer.
 The scan will take a while, so be patient and let it finish.

When the scan is done, in the Scan is complete window, any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on Save Report As
 Next, in the Save as prompt, Save in area, select: Desktop.
 In the File name area use KScan, or something similar.
 In Save as type: click the drop arrow and select: Text file [*.txt]

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.

This is the same stuff you had last time.

You may consider installing the program below WOT..

Here is a link that might be useful: WOT

Hi Zep,
I don't know where I'm getting them. My husband uses it but I know he just has a few sites that he visits and no changes. I visited some clip art sites looking for something for a church breakfast program night before last. Maybe one of those? Sigh.

I ran Malwarebytes and AVG late last night and they both came up clean. I'll run ATF and the Kapersky scan. Is ATF Cleaner the same as fseasyclean? I still have that from the last time.

I have WOT and have seen a few of those warning signs but didn't continue. I'll go back and read the instructions carefully.

As always, thank you.
Pam

Is ATF Cleaner the same as fseasyclean. I don't know just want to make sure you clean out temp files, history ect. I'm sure fseasyclean will do the same...

ATF is really easy to use just place a check mark in select all and hit ok

You may need to use Internet Explorer for that kapersky scan.

Those are rootkits ati64s,amd64si

There function is to hide Malware from scanners, mikie is probably right an your ok now, but we want to see that kap scan that may show hiding Malware if any....

Zep and Mikie,
Zep, thanks for the info on those rootkits. Kapersky and FSEasyClean scans were both clean. When I opened the section for scan results to save the file the window was empty so I can't post a report. Should I be ok? No more clip art sites for me!
Pam

Pam be very careful of sites like clip art, wallpapers, any type of freebies, they set those sites up to lure you in with neat free stuff and you end up getting a nasty bonus along with your freebies. Rootkits are definitely something you do not want on your pc, they are one of the worst type of infections since they hide themselves so well, and are quite hard to detect with anything other than rootkit detection programs.
Do you have spywareblaster on the pc and updated and enabled also?

Kapersky clean then I'd say your ok and malwarebytes took care of it.

RC, Thanks for the advice. I'll remember it. Yes, I do have Spywareblaster and it's updated. I ran it and it was clean. Thank you both so much!
Pam