MS Security Essentials (up to date) and it was a concerted malware attack, i.e. InstallBrain, Weatherbug, Driver Protect, and one other to do with performance. Her itunes told her that she needed to upgrade (which was valid) but some link came up and in a dialog to download itunes... but it was only 100k. It was from what used to be a pretty good download site too... download central? I forget. Thankfully, she realized that itunes had never triggered winpatrol, so kept saying no- so many times that it asked if it was bothering her. A resounding NO on that one. I think when I upgraded her machine, I'd forgotten to install malwarebytes, so I reinstalled it, and was able to thankfully after a couple of reboots get rid of everything.
I think I'm going to invest in spybot as it's been pretty reliable, though I only use it when I'm cleaning someone's system... it's a one time purchase, which sticks in my craw less than a subscription.