identifying malware process

I've got an XP with some sort of malware sending notification popup 'your
computer is infected'

I thought systeminternals 'process explorer' would show and help in
identifying what process is the rogue process ? but, not having much luck

clicking on balloon starts a process that tries to download stuff from
remote server, and, that process I can identify in 'process explorer',
and, from that, several related files

but, I can not identify anything that makes the ballon come up, can that
be running hidden in a 'normal' process

what other tools are there for identifying that sort of stuff ?



-- 
Voytek

-- 
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html