Also check task manager and do a Google on all processes that you don't know anything about. I found a redirector at a client site that way. ProcView might also help as it breaks out the svchost entries.