Someone I know has a slow Windows XP computer and they asked me to look at it. I found that the drive was constantly being accessed, and so would be any removable drive that was plugged in (making it nearly impossible to remove safely without shutting down the machine). When I used Process Explorer to find out what was causing this, I found one service scanning the removable drive (I forget which). I stopped the service, and a different service immediately seemed to pick up the scan. I did this a dozen times, as it rotated through both plausible and implausible services, the only seeming commonality being that they run as LocalSystem.
I installed and used AVG Free and MalwareBytes, which detected Trojan.FakeMS and Trojan.Dropper among others, but most of the files detected seem to be in no position to be run, and in any case fixing them did not fix the problem. Trend Micro's rootkit and botnet detectors also found nothing, but the scanning goes on. What is going on here? Is there some known malware that does this, but can't be detected by any of these scanners?
Oh, and I'm not sure if it's related, but Windows CardSpace (infocard.exe) keeps crashing.