Netstat will show you all processes that are making remote calls outbound and inbound.
In addition Watso could correlate this Pid ( process id) in task manager. He may need to goto options and select Pid to show the id value.
Then Watso should goto c:\windows\system32 as its a dumping ground for most virus, trojans etc.
Watso should look for *.exe files with datetimes stamps that are inconsistent with the majority of the other files. he may need to sort on Datetime in explorer for this.
Lastly Watso can configure his firewall to block outbound on the IRC port which is 6667. Will stop bots making calls outbound from your machine if its infected.
