chk the run section of the windows registry....
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
delete all suspected executables
do the same fo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
and delete the exes.......