I have a friend who received an email with a zip attachment about air line tickets. I was able to scan the computer and remove the virus. However now everytime he starts up his laptop, Explorer.exe runs at a hight cpu percent and there are over 100 connections to random IP addresses. Their status is either established, time_wait, or Close_wait.
His system is running windows 7 home premium.
On occasion, after arount 15minutes, the process will end, and system idle will be over 90%. On most occasions it never ends.
I have disabled all startup entries, processes not microsoft, and have disabled hidden startup's with sysinternals autoruns program.
When I boot to safemode, the same thing happens.
Not sure what to do next. I have used Kaspersky's cd scanner too. No virus was detected.