Hi MagentaPlacenta, :o
You have to examine all the windows startup locations to see where the programs are being launched from. Specifically, you must look at:
1. win.ini, and system.ini - Check for win.ini's Run= and load= lines. Also check system.ini's Shell=Explorer.exe to see if any trojan executable follows the explorere.exe reference.
2. Windows Services - start-run-type in "services.msc" or Click Start, Settings, Control Panel.
Open the Administrative Tools and click Services.
3. The windows registry run keys:
# Click Start, Run, and type regedit and press enter.
# Click HKEY_LOCAL_MACHINE
# Click Software
# Click Microsoft
# Click Windows
# Click Current Version
# Click Run
Also inspect the runonce and runservices keys
4. The windows startup folders:
The Autostart folder is located in C:\Windows\Start Menu\Programs\startup
5. Downloaded programs (Active-X locations)
To complicate matters, some malware processes may hide behind and be launched by the valid system svchost process, which you may see multiple occurrences of in task mgr.. This makes their identification and removal more difficult:
http://windowsxp.mvps.org/svchost.htmIf you Download and install WinPatrol, You can click on services to see what is running behind each occurrence of svchost. You can also manage your startups by clicking on startups, and 'active tasks' will be you active list of running processes, similar to what you would see if you openned task Mgr.
http://www.winpatrol.com