Hi. I am new here and need some help. Have a friend's pc that in safe mode seems okay. however when I boot it normally, there is a lot of disk thrashing for about 10 minutes, with trend micro spitting out messages that explorer.exe has been stopped from performing illegal changes. when all the thrashing stops I cannot open control panel due to no available memory identified with the following message "delete some programs and try again later". My start/all programs list is empty and I cannot do anything at all. Trend Micro continues to explain and since 8/4/08 over 148,000 explorer.exe illegal detections have been filed. Could this be rootkit behavior and is the system salvageable? In safemode I ran the up to date adware, and spybot programs, with only minor findings (cookies mostly). I also get a boot.ini error message, booting from c:\windows, but cannot find the boot.ini file in the listing. I don't know what my friend opened. She does not remember. Any ideas? I can run hijackthis in safemodebut not in normal windows xp home edition. Not enough memory again! :pullhair: Jerry