you could download a protocol sniffer like EtherDetect
and see what the traffic looks like....
That's what I use when things look weird around the router LEDs.
Maybe some kind of monitor was installed & is running ?
If XP, try the ctrl-alt-del and take a look at the activity.